Some transitive dependencies do not add as dependencies

[msherms2]

I originally created this in DTrack as I misread the generated SBOM and guessed it was the cause. However, through discussion, it was shown to me that a valid dependency tree and NuGet Restore scenario can create correct Components data (it pulls the right packages) but does not properly show the full Dependency Graph. This is because some packages do not properly set up as Dependencies in the dependencies section for an unknown reason (but not all, some do).

The attached SBOM you can see not all dependency data below is present - for instance the OpenXML.Framework package depending on System.Packaging.IO. The result of this is an incomplete DTrack dependency graph:

bom.xml

Unfortunately I don't really understand why it does it with some but not all dependencies. We successfully proved if you hand add the dependencies in the expected form, the Dependency Graph works as expected.

[andreas-hilti]

@msherms2 I doubt that this is an issue of the cli. What do you use to generate the BOM, https://github.com/CycloneDX/cyclonedx-dotnet?
It might be an issue of the CycloneDX module for .NET, but even more likely it is an issue with the meta-data of the NuGet packages. (Without having investigated it at all.)

[msherms2]

@msherms2 I doubt that this is an issue of the cli. What do you use to generate the BOM, https://github.com/CycloneDX/cyclonedx-dotnet? It might be an issue of the CycloneDX module for .NET, but even more likely it is an issue with the meta-data of the NuGet packages. (Without having investigated it at all.)

Yes, I originally opened it under DTrack but it was quickly pointed out that the BOM was missing dependency data. Do you know how I can determine if the cause is nuget itself or cyclone DX (dotnet or CLI) ? I can investigate some metadata in the packages that work and the packages that don't, but I'm not really seeing why the BOM would need anything more than the dependency tree, which it clearly has

[trivalik]

You could check the NuGet part \obj\project.assets.json in your project, if dependencies are in.