Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Microsoft.Sbom.Targets] License detection properties have no effect #718

Open
Tracked by #693
KalleOlaviNiemitalo opened this issue Sep 19, 2024 · 0 comments
Open
Tracked by #693
Labels
.NET Pull requests that update .net code

Comments

@KalleOlaviNiemitalo
Copy link

KalleOlaviNiemitalo commented Sep 19, 2024

These properties don't take effect when I set them in my project:

<PropertyGroup>
    <SbomGenerationFetchLicenseInformation>true</SbomGenerationFetchLicenseInformation>
    <SbomGenerationEnablePackageMetadataParsing>true</SbomGenerationEnablePackageMetadataParsing>
</PropertyGroup>

They are passed to parameters of the GenerateSbom task, but the resulting SBOM contains no license information, and the SBOMTelemetry log entry shows FetchLicenseInformation=null, EnablePackageMetadataParsing=null.

If I instead use sbom-tool with -pm true -li true, then the SBOM shows "licenseConcluded": "MIT" and/or "licenseDeclared": "MIT" for some packages, so the bug is in the MSBuild integration.

AFAICT, src/Microsoft.Sbom.Targets/SbomCLIToolTask.cs for .NET Framework uses those parameters (but then fails because of #719), but src/Microsoft.Sbom.Targets/GenerateSbomTask.cs for .NET Core ignores the parameters.

Originally posted by @KalleOlaviNiemitalo in #693 (comment)

@sfoslund sfoslund added needs triage Default status upon issue submission .NET Pull requests that update .net code and removed needs triage Default status upon issue submission labels Sep 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
.NET Pull requests that update .net code
Projects
None yet
Development

No branches or pull requests

2 participants