Add TargetFramework awareness to NuGet detector

src/Microsoft.ComponentDetection.Contracts/TypedComponent/NugetComponent.cs

@@ -1,5 +1,6 @@
 namespace Microsoft.ComponentDetection.Contracts.TypedComponent;
 
+using System.Collections.Generic;
 using PackageUrl;
 
 public class NuGetComponent : TypedComponent
@@ -22,6 +23,8 @@ public NuGetComponent(string name, string version, string[] authors = null)
 
     public string[] Authors { get; set; }
 
+    public ISet<string> TargetFrameworks { get; set; } = new HashSet<string>();
+
     public override ComponentType Type => ComponentType.NuGet;
 
     public override string Id => $"{this.Name} {this.Version} - {this.Type}";

src/Microsoft.ComponentDetection.Detectors/nuget/FrameworkPackages/FrameworkPackages.cs

@@ -0,0 +1,122 @@
+namespace Microsoft.ComponentDetection.Detectors.NuGet;
+
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using global::NuGet.Frameworks;
+using global::NuGet.Versioning;
+
+/// <summary>
+/// Represents a set of packages that are provided by a specific framework.
+/// At the moment this only represents the packages that are provided by the Microsoft.NETCore.App framework.
+/// We could extend this to represent the packages provided by other frameworks like Microsoft.AspNetCore.App and Microsoft.WindowsDesktop.App.
+/// </summary>
+internal sealed partial class FrameworkPackages : IEnumerable<KeyValuePair<string, NuGetVersion>>, IEnumerable
+{
+    private static readonly Dictionary<NuGetFramework, FrameworkPackages> FrameworkPackagesByFramework = [];
+
+    static FrameworkPackages()
+    {
+        AddPackages(NETStandard20.Instance);
+        AddPackages(NETStandard21.Instance);
+        AddPackages(NETCoreApp20.Instance);
+        AddPackages(NETCoreApp21.Instance);
+        AddPackages(NETCoreApp22.Instance);
+        AddPackages(NETCoreApp30.Instance);
+        AddPackages(NETCoreApp31.Instance);
+        AddPackages(NETCoreApp50.Instance);
+        AddPackages(NETCoreApp60.Instance);
+        AddPackages(NETCoreApp70.Instance);
+        AddPackages(NETCoreApp80.Instance);
+        AddPackages(NETCoreApp90.Instance);
+
+        static void AddPackages(FrameworkPackages packages) => FrameworkPackagesByFramework[packages.Framework] = packages;
+    }
+
+    public FrameworkPackages(NuGetFramework framework) => this.Framework = framework;
+
+    public FrameworkPackages(NuGetFramework framework, FrameworkPackages frameworkPackages)
+        : this(framework) => this.Packages = new(frameworkPackages.Packages);
+
+    public NuGetFramework Framework { get; }
+
+    public Dictionary<string, NuGetVersion> Packages { get; } = new Dictionary<string, NuGetVersion>(StringComparer.OrdinalIgnoreCase);
+
+    public static FrameworkPackages GetFrameworkPackages(NuGetFramework framework)
+    {
+        if (FrameworkPackagesByFramework.TryGetValue(framework, out var frameworkPackages))
+        {
+            return frameworkPackages;
+        }
+
+        // if we didn't predefine the package overrides, load them from the targeting pack
+        // we might just leave this out since in future frameworks we'll have this functionality built into NuGet.
+        var frameworkPackagesFromPack = LoadFrameworkPackagesFromPack(framework);
+
+        return FrameworkPackagesByFramework[framework] = frameworkPackagesFromPack ?? new FrameworkPackages(framework);
+    }
+
+    private static FrameworkPackages LoadFrameworkPackagesFromPack(NuGetFramework framework)
+    {
+        if (framework is null || framework.Framework != FrameworkConstants.FrameworkIdentifiers.NetCoreApp)
+        {
+            return null;
+        }
+
+        // packs location : %ProgramFiles%\dotnet\packs
+        var packsFolder = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ProgramFiles), "dotnet", "packs", "Microsoft.NETCore.App.Ref");
+        if (!Directory.Exists(packsFolder))
+        {
+            return null;
+        }
+
+        var packVersionPattern = $"{framework.Version.Major}.{framework.Version.Minor}.*";
+        var packDirectories = Directory.GetDirectories(packsFolder, packVersionPattern);
+        var packageOverridesFile = packDirectories
+                                        .Select(d => (Overrides: Path.Combine(d, "data", "PackageOverrides.txt"), Version: ParseVersion(Path.GetFileName(d))))
+                                        .Where(d => File.Exists(d.Overrides))
+                                        .OrderByDescending(d => d.Version)
+                                        .FirstOrDefault().Overrides;
+
+        if (packageOverridesFile == null)
+        {
+            // we should also try to grab them from the user's package folder - they'll be in one location or the other.
+            return null;
+        }
+
+        // Adapted from https://github.com/dotnet/sdk/blob/c3a8f72c3a5491c693ff8e49e7406136a12c3040/src/Tasks/Common/ConflictResolution/PackageOverride.cs#L52-L68
+        var frameworkPackages = new FrameworkPackages(framework);
+        var packageOverrides = File.ReadAllLines(packageOverridesFile);
+
+        foreach (var packageOverride in packageOverrides)
+        {
+            var packageOverrideParts = packageOverride.Trim().Split('|');
+
+            if (packageOverrideParts.Length == 2)
+            {
+                var packageId = packageOverrideParts[0];
+                var packageVersion = ParseVersion(packageOverrideParts[1]);
+
+                frameworkPackages.Packages[packageId] = packageVersion;
+            }
+        }
+
+        return frameworkPackages;
+
+        static NuGetVersion ParseVersion(string versionString) => NuGetVersion.TryParse(versionString, out var version) ? version : null;
+    }
+
+    private void Add(string id, string version)
+    {
+        // intentionally redirect to indexer to allow for overwrite
+        this.Packages[id] = NuGetVersion.Parse(version);
+    }
+
+    public bool IsAFrameworkComponent(string id, NuGetVersion version) => this.Packages.TryGetValue(id, out var frameworkPackageVersion) && frameworkPackageVersion >= version;
+
+    IEnumerator<KeyValuePair<string, NuGetVersion>> IEnumerable<KeyValuePair<string, NuGetVersion>>.GetEnumerator() => this.Packages.GetEnumerator();
+
+    IEnumerator IEnumerable.GetEnumerator() => throw new NotImplementedException();
+}

src/Microsoft.ComponentDetection.Detectors/nuget/FrameworkPackages/FrameworkPackages.net5.0.cs

@@ -0,0 +1,81 @@
+namespace Microsoft.ComponentDetection.Detectors.NuGet;
+
+using global::NuGet.Frameworks;
+
+/// <summary>
+/// Framework packages for net5.0.
+/// </summary>
+internal partial class FrameworkPackages
+{
+    internal static class NETCoreApp50
+    {
+        internal static FrameworkPackages Instance { get; } = new(NuGetFramework.Parse("net5.0"), NETCoreApp31.Instance)
+        {
+            { "Microsoft.CSharp", "4.7.0" },
+            { "runtime.debian.8-x64.runtime.native.System", "4.3.0" },
+            { "runtime.debian.8-x64.runtime.native.System.IO.Compression", "4.3.0" },
+            { "runtime.debian.8-x64.runtime.native.System.Net.Http", "4.3.0" },
+            { "runtime.debian.8-x64.runtime.native.System.Net.Security", "4.3.0" },
+            { "runtime.debian.8-x64.runtime.native.System.Security.Cryptography", "4.3.0" },
+            { "runtime.fedora.23-x64.runtime.native.System", "4.3.0" },
+            { "runtime.fedora.23-x64.runtime.native.System.IO.Compression", "4.3.0" },
+            { "runtime.fedora.23-x64.runtime.native.System.Net.Http", "4.3.0" },
+            { "runtime.fedora.23-x64.runtime.native.System.Net.Security", "4.3.0" },
+            { "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography", "4.3.0" },
+            { "runtime.fedora.24-x64.runtime.native.System", "4.3.0" },
+            { "runtime.fedora.24-x64.runtime.native.System.IO.Compression", "4.3.0" },
+            { "runtime.fedora.24-x64.runtime.native.System.Net.Http", "4.3.0" },
+            { "runtime.fedora.24-x64.runtime.native.System.Net.Security", "4.3.0" },
+            { "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography", "4.3.0" },
+            { "runtime.opensuse.13.2-x64.runtime.native.System", "4.3.0" },
+            { "runtime.opensuse.13.2-x64.runtime.native.System.IO.Compression", "4.3.0" },
+            { "runtime.opensuse.13.2-x64.runtime.native.System.Net.Http", "4.3.0" },
+            { "runtime.opensuse.13.2-x64.runtime.native.System.Net.Security", "4.3.0" },
+            { "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography", "4.3.0" },
+            { "runtime.opensuse.42.1-x64.runtime.native.System", "4.3.0" },
+            { "runtime.opensuse.42.1-x64.runtime.native.System.IO.Compression", "4.3.0" },
+            { "runtime.opensuse.42.1-x64.runtime.native.System.Net.Http", "4.3.0" },
+            { "runtime.opensuse.42.1-x64.runtime.native.System.Net.Security", "4.3.0" },
+            { "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography", "4.3.0" },
+            { "runtime.osx.10.10-x64.runtime.native.System", "4.3.0" },
+            { "runtime.osx.10.10-x64.runtime.native.System.IO.Compression", "4.3.0" },
+            { "runtime.osx.10.10-x64.runtime.native.System.Net.Http", "4.3.0" },
+            { "runtime.osx.10.10-x64.runtime.native.System.Net.Security", "4.3.0" },
+            { "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography", "4.3.0" },
+            { "runtime.rhel.7-x64.runtime.native.System", "4.3.0" },
+            { "runtime.rhel.7-x64.runtime.native.System.IO.Compression", "4.3.0" },
+            { "runtime.rhel.7-x64.runtime.native.System.Net.Http", "4.3.0" },
+            { "runtime.rhel.7-x64.runtime.native.System.Net.Security", "4.3.0" },
+            { "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography", "4.3.0" },
+            { "runtime.ubuntu.14.04-x64.runtime.native.System", "4.3.0" },
+            { "runtime.ubuntu.14.04-x64.runtime.native.System.IO.Compression", "4.3.0" },
+            { "runtime.ubuntu.14.04-x64.runtime.native.System.Net.Http", "4.3.0" },
+            { "runtime.ubuntu.14.04-x64.runtime.native.System.Net.Security", "4.3.0" },
+            { "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography", "4.3.0" },
+            { "runtime.ubuntu.16.04-x64.runtime.native.System", "4.3.0" },
+            { "runtime.ubuntu.16.04-x64.runtime.native.System.IO.Compression", "4.3.0" },
+            { "runtime.ubuntu.16.04-x64.runtime.native.System.Net.Http", "4.3.0" },
+            { "runtime.ubuntu.16.04-x64.runtime.native.System.Net.Security", "4.3.0" },
+            { "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography", "4.3.0" },
+            { "runtime.ubuntu.16.10-x64.runtime.native.System", "4.3.0" },
+            { "runtime.ubuntu.16.10-x64.runtime.native.System.IO.Compression", "4.3.0" },
+            { "runtime.ubuntu.16.10-x64.runtime.native.System.Net.Http", "4.3.0" },
+            { "runtime.ubuntu.16.10-x64.runtime.native.System.Net.Security", "4.3.0" },
+            { "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography", "4.3.0" },
+            { "System.Buffers", "4.5.1" },
+            { "System.Collections.Immutable", "5.0.0" },
+            { "System.ComponentModel.Annotations", "5.0.0" },
+            { "System.Diagnostics.DiagnosticSource", "5.0.0" },
+            { "System.Formats.Asn1", "5.0.0" },
+            { "System.Net.Http.Json", "5.0.0" },
+            { "System.Reflection.DispatchProxy", "4.7.1" },
+            { "System.Reflection.Metadata", "5.0.0" },
+            { "System.Runtime.CompilerServices.Unsafe", "5.0.0" },
+            { "System.Text.Encoding.CodePages", "5.0.0" },
+            { "System.Text.Encodings.Web", "5.0.0" },
+            { "System.Text.Json", "5.0.0" },
+            { "System.Threading.Channels", "5.0.0" },
+            { "System.Threading.Tasks.Dataflow", "5.0.0" },
+        };
+    }
+}

src/Microsoft.ComponentDetection.Detectors/nuget/FrameworkPackages/FrameworkPackages.net6.0.cs

@@ -0,0 +1,34 @@
+namespace Microsoft.ComponentDetection.Detectors.NuGet;
+
+using global::NuGet.Frameworks;
+
+/// <summary>
+/// Framework packages for net6.0.
+/// </summary>
+internal partial class FrameworkPackages
+{
+    internal static class NETCoreApp60
+    {
+        internal static FrameworkPackages Instance { get; } = new(NuGetFramework.Parse("net6.0"), NETCoreApp50.Instance)
+        {
+            { "Microsoft.Win32.Registry", "5.0.0" },
+            { "System.Collections.Immutable", "6.0.0" },
+            { "System.Diagnostics.DiagnosticSource", "6.0.1" },
+            { "System.Formats.Asn1", "6.0.1" },
+            { "System.IO.FileSystem.AccessControl", "5.0.0" },
+            { "System.IO.Pipes.AccessControl", "5.0.0" },
+            { "System.Net.Http.Json", "6.0.1" },
+            { "System.Reflection.Metadata", "6.0.1" },
+            { "System.Runtime.CompilerServices.Unsafe", "6.0.0" },
+            { "System.Security.AccessControl", "6.0.1" },
+            { "System.Security.Cryptography.Cng", "5.0.0" },
+            { "System.Security.Cryptography.OpenSsl", "5.0.0" },
+            { "System.Security.Principal.Windows", "5.0.0" },
+            { "System.Text.Encoding.CodePages", "6.0.0" },
+            { "System.Text.Encodings.Web", "6.0.0" },
+            { "System.Text.Json", "6.0.9" },
+            { "System.Threading.Channels", "6.0.0" },
+            { "System.Threading.Tasks.Dataflow", "6.0.0" },
+        };
+    }
+}

src/Microsoft.ComponentDetection.Detectors/nuget/FrameworkPackages/FrameworkPackages.net7.0.cs

@@ -0,0 +1,26 @@
+namespace Microsoft.ComponentDetection.Detectors.NuGet;
+
+using global::NuGet.Frameworks;
+
+/// <summary>
+/// Framework packages for net7.0.
+/// </summary>
+internal partial class FrameworkPackages
+{
+    internal static class NETCoreApp70
+    {
+        internal static FrameworkPackages Instance { get; } = new(NuGetFramework.Parse("net7.0"), NETCoreApp60.Instance)
+        {
+            { "System.Collections.Immutable", "7.0.0" },
+            { "System.Diagnostics.DiagnosticSource", "7.0.2" },
+            { "System.Formats.Asn1", "7.0.0" },
+            { "System.Net.Http.Json", "7.0.1" },
+            { "System.Reflection.Metadata", "7.0.2" },
+            { "System.Text.Encoding.CodePages", "7.0.0" },
+            { "System.Text.Encodings.Web", "7.0.0" },
+            { "System.Text.Json", "7.0.4" },
+            { "System.Threading.Channels", "7.0.0" },
+            { "System.Threading.Tasks.Dataflow", "7.0.0" },
+        };
+    }
+}

src/Microsoft.ComponentDetection.Detectors/nuget/FrameworkPackages/FrameworkPackages.net8.0.cs

@@ -0,0 +1,26 @@
+namespace Microsoft.ComponentDetection.Detectors.NuGet;
+
+using global::NuGet.Frameworks;
+
+/// <summary>
+/// Framework packages for net8.0.
+/// </summary>
+internal partial class FrameworkPackages
+{
+    internal static class NETCoreApp80
+    {
+        internal static FrameworkPackages Instance { get; } = new(NuGetFramework.Parse("net8.0"), NETCoreApp70.Instance)
+        {
+            { "System.Collections.Immutable", "8.0.0" },
+            { "System.Diagnostics.DiagnosticSource", "8.0.1" },
+            { "System.Formats.Asn1", "8.0.1" },
+            { "System.Net.Http.Json", "8.0.0" },
+            { "System.Reflection.Metadata", "8.0.0" },
+            { "System.Text.Encoding.CodePages", "8.0.0" },
+            { "System.Text.Encodings.Web", "8.0.0" },
+            { "System.Text.Json", "8.0.4" },
+            { "System.Threading.Channels", "8.0.0" },
+            { "System.Threading.Tasks.Dataflow", "8.0.1" },
+        };
+    }
+}