dotnet-deps-binary-cataloger selects package versions that are written over by the runtime #4166
Description
What happened:
Generated a sbom for an application that references an old dotnet standard package that is written over by the runtime. But the sbom contained the package reference version and not the runtime version which is actually contained in the output folder. This can cause false positive/negatives and is detrimental to sbom quality/actionability.
What you expected to happen:
If I build in a certain dotnet version including a package reference with a version that is lower than what is listed under the runtime dependencies dotnet will resolve the dependency from the sdk version.
These packages are still referenced for dotnet standard compatability, but are these days included in the sdk/runtime and will be written over by them when building.
They're listed here for the runtime's master but you should reference the tag for the version you build with.
Blazor WASM for example extends these because they also need certain wasm packages.
Microsoft themselves at one point maintained a list with some of these for aspnet, but its not complete and its applied here.
In their own component detector (their equivelent of our cataloger) they used such lists to exclude these entries.
You could do the same by writing an app that dynamicly builds these projects with plausable projects to generate such a list, which is not unlike what they have done. But this seems unfruitfull and needlessly complex as they themselves missed Systems.Numeric.Vector for example.
It's far easier to compare the deps.json runtime section with the package entries in the same file.
The version of the package would then be set to the version you built with to accurately reflect the resolved version.
I think its worth considering if these should be included to begin with as they often do not exist on NuGet and vulnerabilities in these cases are listed under cve's that adress the sdk. Maybe this deserves a seperate issue.
(same section)
And under the packages:
The DLL in ILSPY
Steps to reproduce the issue:
syft scan the outputfolder of a dotnet project which references for example System.Security.Cng:5.0.0 or any of the packages that are now included in the runtime/sdk
Environment:
- Output of
syft version: 1.31.0 - OS (e.g:
cat /etc/os-releaseor similar): win-x64