.NET package files not being scanned

[nbarry10]

I've been having some issues with using cdxgen when scanning deployed .Net web applications on our Windows and Linux servers ranging from some MVC web apps as well as dotnet core web apps.

File that works fine (but does not always exist).

• packages.config

Does not work, appears to ignore these package files.

• appname.deps.json
• libman.json
• web.config

I'd like some guidance on how to produce a full SBOM for .Net applications that are published and deployed on Windows (IIS) and Linux (Kestrel).

Thanks in advance.

[prabhu]

@nbarry10, Like you point out we currently do not support those package formats. We had a sponsorship enquiry for deps.json recently, but not others. We currently do not have anyone working full-time on cdxgen, so rely on code contributions or donations. Please consider donating or contributing a PR, if these package files are important for your organization.

[nbarry10]

Thanks for the response, and I was afraid that was the answer. We aren't experts with JS or TS, but we might try to look into adding the capability.

[prabhu]

Have you looked into https://github.com/CycloneDX/cyclonedx-dotnet . If you're familiar with dotnet, perhaps it might be easier for your team to contribute to this project?