.NET6 Client-Side Libraries Missing from BOM

[curnsey]

I noticed today that a .NET6 project in Dependency Track was missing Bootstrap and jQuery components. Project is a basic .NET6 webapp generated from CLI with default folder structure.

wwwroot --css --js --lib ----boostrap ------dist ----jquery ------dist

I generated a libman.json file and updated the bootstrap and jquery references for the client side libraries thinking maybe that would get picked up and processed.

  "version": "1.0",
  "defaultProvider": "cdnjs",
  "libraries": [
    {
      "provider": "cdnjs",
      "library": "[email protected]",
      "destination": "wwwroot/lib/bootstrap/dist"
    },
    {
      "provider": "cdnjs",
      "library": "[email protected]",
      "destination": "wwwroot/lib/jquery/dist"
    }
  ]
}

Attempted to recreate the BOM after the references were restored and the same result - missing client-side libraries. Any thoughts, suggestions, advice? TIA

[ArjenKorevaar]

Any thoughts or update on this ?

[ArjenKorevaar]

I wouldn't mind spending some time trying to add the client-side libraries from libman.json files to the BOM, but would like to know if this idea is supported by the maintainers first.

[Bertk]

Cyclone dotnet tool uses immediate build output (obj folder) to identify nuget packages and transitive dependencies.

Please check cyclonedx-npm tool.

[ArjenKorevaar]

Cyclone dotnet tool uses immediate build output (obj folder) to identify nuget packages and transitive dependencies.

CycloneDX dotnet tool should create SBoMs from dotnet projects. Imho that should include Libman as well.

Please check cyclonedx-npm tool.

Afaik the CycloneDX tool for NPM does not scan Libman packages.

[Bertk]

Sorry, I did not recognize the libman detail and we use npm for angular client.

I guess there is no CycloneDX support for libman tool.

Microsoft published a SBOM tool as well. I am not sure whether this supports libman.

[ArjenKorevaar]

I guess there is no CycloneDX support for libman tool.

... hence this issue to request support for Libman to be added :)

[Bertk]

Contributions are welcome :wink:

Please update the issue title which suggests a bug and add the information „Libman support (enhancement)“

[ArjenKorevaar]

Contributions are welcome 😉

No offense, but I would like to hear that from the owner(s) to make sure I'm not wasting my time. Support for Libman must fit the owners idea of the purpose and scope of this tool and accept to maintaining it.

@coderpatros ?

[coderpatros]

@ArjenKorevaar Libman is part of the ASP.NET ecosystem, so I think it makes sense to have support for it here. A PR for this functionality would be great.

[github-actions[bot]]

This issue is stale because it has been open for 3 months with no activity.