/cyclonedx-dotnet-library

.NET library to consume and produce CycloneDX Software Bill of Materials (SBOM)

Primary LanguageC#Apache License 2.0Apache-2.0

Build Status License NuGet Version Nuget Website Slack Invite Group Discussion Twitter

CycloneDX libraries for .NET

The CycloneDX libraries for .NET support programmatically consuming and producing CycloneDX bill-of-materials. CycloneDX is a lightweight BOM specification that is easily created, human readable, and simple to parse.

The libraries support .NET Standard 2.0.

Getting Started

For help getting started using the CycloneDX .NET Library refer to the documentation.

SPDX Interop

The CycloneDX.Spdx.Interop library includes methods for converting between CycloneDX and SPDX formats. (Currently only SPDX v2.2 JSON format is supported.)

High level overview of information lost during conversion:

This is a high level overview of information that will be lost during conversion. This is current state only, some features are yet to be implemented as indicated below.

If you are familiar with both formats, and would like to contribute to minimising data loss during conversion, pull requests are welcome :)

SPDX -> CycloneDX

Feature Notes
Relationship Information Implementation pending, related to CycloneDX component assemblies, dependency graph, and composition.
License information in files Needs review, the way SPDX and CycloneDX handle license information evidence is slightly different.
Snippet Information Snippets are not currently supported by CycloneDX
Non-SPDX licenses Implementation pending

CycloneDX -> SPDX

Feature Notes
Component assemblies Implementation pending - related to SPDX Relationship Information
Hashes SPDX documents are unable to represent the following hash algorithms: SHA3-256, SHA3-384, SHA3-512, BLAKE2b-256, BLAKE2b-384, BLAKE2b-512, BLAKE3.
SWID Tags SPDX doesn't support SWID tags.
Component Type Information SPDX doesn't support designating a component as a particular type (i.e. library, framework, container).
CPE and Package URL for Component Identity SPDX supports multiple CPEs and PURLs for a package. But doesn't support specifying if any are a component identifier.
Device & Hardware Components SPDX does not support devices or hardware as components.
Composition Implementation pending - related to SPDX Relationship Information
Dependency Graph Implementation pending - related to SPDX Relationship Information
External References External references are handled differently between the two formats.
Non-SPDX licenses Implementation pending

License

Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the LICENSE file for the full license.

Contributing

Pull requests are welcome. But please read the CycloneDX contributing guidelines first.

To build and test the solution locally standard commands like dotnet build and dotnet test work.

The protocol buffer tests require the protocol buffer compiler executable protoc to be available in your path.

Documentation is generated using DocFX.

It is generally expected that pull requests will include relevant tests. Tests are automatically run on Windows, MacOS and Linux for every pull request. And build warnings will break the build.

If you are having trouble debugging a test that is failing for a platform you don't have access to please us know.