{"id":20617789,"url":"https://github.com/cyclonedx/cyclonedx-dotnet","last_synced_at":"2026-04-27T02:00:51.496Z","repository":{"id":39612261,"uuid":"151328875","full_name":"CycloneDX/cyclonedx-dotnet","owner":"CycloneDX","description":"Creates CycloneDX Software Bill of Materials (SBOM) from .NET Projects","archived":false,"fork":false,"pushed_at":"2026-04-27T00:07:46.000Z","size":3379,"stargazers_count":264,"open_issues_count":53,"forks_count":120,"subscribers_count":11,"default_branch":"master","last_synced_at":"2026-04-27T01:18:30.407Z","etag":null,"topics":["bill-of-materials","bom","cyclonedx","dotnet","dotnet-core","hacktoberfest","mbom","obom","owasp","package-url","purl","saasbom","sbom","sbom-generator","software-bill-of-materials","spdx","vex"],"latest_commit_sha":null,"homepage":"https://cyclonedx.org/","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CycloneDX.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE","maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"custom":["https://owasp.org/donate/?reponame=www-project-cyclonedx\u0026title=OWASP+CycloneDX"]}},"created_at":"2018-10-02T21:58:30.000Z","updated_at":"2026-04-27T00:03:57.000Z","dependencies_parsed_at":"2024-01-18T12:41:50.303Z","dependency_job_id":"fd3ec047-8cc9-4e17-b92b-572930cbfa2b","html_url":"https://github.com/CycloneDX/cyclonedx-dotnet","commit_stats":{"total_commits":626,"total_committers":47,"mean_commits":"13.319148936170214","dds":0.7156549520766773,"last_synced_commit":"3ad0483c8724b6ddd0c20506b034dde5f8555b44"},"previous_names":[],"tags_count":63,"template":false,"template_full_name":null,"purl":"pkg:github/CycloneDX/cyclonedx-dotnet","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CycloneDX%2Fcyclonedx-dotnet","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CycloneDX%2Fcyclonedx-dotnet/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CycloneDX%2Fcyclonedx-dotnet/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CycloneDX%2Fcyclonedx-dotnet/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CycloneDX","download_url":"https://codeload.github.com/CycloneDX/cyclonedx-dotnet/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CycloneDX%2Fcyclonedx-dotnet/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32319560,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-26T23:26:28.701Z","status":"online","status_checked_at":"2026-04-27T02:00:06.769Z","response_time":128,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bill-of-materials","bom","cyclonedx","dotnet","dotnet-core","hacktoberfest","mbom","obom","owasp","package-url","purl","saasbom","sbom","sbom-generator","software-bill-of-materials","spdx","vex"],"created_at":"2024-11-16T12:05:58.266Z","updated_at":"2026-04-27T02:00:51.487Z","avatar_url":"https://github.com/CycloneDX.png","language":"C#","funding_links":["https://owasp.org/donate/?reponame=www-project-cyclonedx\u0026title=OWASP+CycloneDX"],"categories":[],"sub_categories":[],"readme":"# CycloneDX module for .NET\n\n[![shield_nuget-version]][link_nuget]\n[![shield_docker-version]][link_docker]\n[![shield_github_ci]][link_github_ci]\n[![shield_license]][License]  \n[![shield_website]][link_website]\n[![shield_slack]][link_slack]\n[![shield_groups]][link_discussion]\n[![shield_twitter-follow]][link_twitter]\n\n[shield_nuget-version]: https://img.shields.io/nuget/v/CycloneDX?label=NuGet\u0026logo=nuget\u0026logoColor=white \"NuGet Version\"\n[shield_docker-version]: https://img.shields.io/docker/v/cyclonedx/cyclonedx-dotnet?label=Docker\u0026logo=docker\u0026logoColor=white \"docker\"\n[shield_github_ci]: https://img.shields.io/github/actions/workflow/status/CycloneDX/cyclonedx-dotnet/dotnetcore.yml?branch=master\u0026logo=github\u0026logoColor=white \"Build Status\"\n[shield_coverage]: https://img.shields.io/codacy/coverage/xxxx?logo=Codacy\u0026logoColor=white \"test coverage\"\n[shield_license]: https://img.shields.io/github/license/CycloneDX/cyclonedx-dotnet?logo=open%20source%20initiative\u0026logoColor=white \"license\"\n[shield_website]: https://img.shields.io/badge/https://-cyclonedx.org-blue.svg \"homepage\"\n[shield_slack]: https://img.shields.io/badge/slack-join-blue?logo=Slack\u0026logoColor=white \"slack join\"\n[shield_groups]: https://img.shields.io/badge/discussion-groups.io-blue.svg \"groups discussion\"\n[shield_twitter-follow]: https://img.shields.io/badge/Twitter-follow-blue?logo=Twitter\u0026logoColor=white \"twitter follow\"\n\n[link_nuget]: https://www.nuget.org/packages/CycloneDX/\n[link_docker]: https://hub.docker.com/r/cyclonedx/cyclonedx-dotnet\n[link_github_ci]: https://github.com/CycloneDX/cyclonedx-dotnet/actions/workflows/dotnetcore.yml\n[link_codacy]: https://app.codacy.com/gh/CycloneDX/cyclonedx-dotnet\n[link_website]: https://cyclonedx.org/\n[link_slack]: https://cyclonedx.org/slack/invite\n[link_discussion]: https://groups.io/g/CycloneDX\n[link_twitter]: https://twitter.com/CycloneDX_Spec\n\n----\n\nThe CycloneDX module for .NET creates a valid CycloneDX bill-of-material document containing an aggregate of all project dependencies. CycloneDX is a lightweight BOM specification that is easily created, human readable, and simple to parse.\n\nThis module runs on \n* .NET 10.0\n* .NET 9.0\n* .NET 8.0\n\n## Usage\n\nCycloneDX for .NET is distributed via [NuGet][link_nuget] and [Docker Hub][link_docker]. \n\n#### Installing via NuGet\n\n```bash\ndotnet tool install --global CycloneDX\n```\n\nIf you already have a previous version of **CycloneDX** installed, you can upgrade to the latest version using the following command:\n\n```bash\ndotnet tool update --global CycloneDX\n```\n\n#### Execution  \n\n```bash\ndotnet-CycloneDX \u003cpath\u003e -o \u003cOUTPUT_DIRECTORY\u003e\n```  \n\n\u003e **Note:** If you encounter a \"command not found\" error after installation, try restarting your terminal. Also, ensure that the `~/.dotnet/tools` directory is included in your `PATH`.\n\n#### Execution via Docker\n\n```bash\ndocker run --rm --user $(id -u):$(id -g) \\\n  -v $(pwd):/work \\\n  cyclonedx/cyclonedx-dotnet [OPTIONS] /work/\u003cpath\u003e\n```\n\n\u003e **Note:** The `--user $(id -u):$(id -g)` flag runs the container as your host user,\n\u003e ensuring `dotnet restore` can write to the mounted volume and output files are owned by\n\u003e you rather than root. A future major release will make non-root the default. See\n\u003e [docs/adr-001-rootless-container.md](docs/adr-001-rootless-container.md) for background.\n\n#### Options\n\n```text\nUsage:\n  dotnet-CycloneDX \u003cpath\u003e [options]\n\nArguments:\n  \u003cpath\u003e  The path to a .sln, .slnf, .slnx, .csproj, .fsproj, .vbproj, .xsproj, or packages.config file or the path to a directory which will be recursively analyzed for packages.config files.\n\nOptions:\n  -tfm, --framework \u003cframework\u003e                                                The target framework to use. If not defined, all will be aggregated.\n  -rt, --runtime \u003cruntime\u003e                                                     The runtime to use. If not defined, all will be aggregated.\n  -o, --output \u003coutput\u003e                                                        The directory to write the BOM\n  -fn, --filename \u003cfilename\u003e                                                   Optionally provide a filename for the BOM (default: bom.xml or bom.json)\n  -ed, --exclude-dev                                                           Exclude development dependencies from the BOM (see https://github.com/NuGet/Home/wiki/DevelopmentDependency-support-for-PackageReference)\n  -t, --exclude-test-projects                                                  Exclude test projects from the BOM\n  -u, --url \u003curl\u003e                                                              Alternative NuGet repository URL to https://\u003cyoururl\u003e/nuget/\u003cyourrepository\u003e/v3/index.json\n  -us, --baseUrlUsername \u003cbaseUrlUsername\u003e                                     Alternative NuGet repository username (env: CYCLONEDX_NUGET_USERNAME)\n  -usp, --baseUrlUserPassword \u003cbaseUrlUserPassword\u003e                            Alternative NuGet repository username password/apikey (env: CYCLONEDX_NUGET_PASSWORD)\n  -uspct, --isBaseUrlPasswordClearText                                         Alternative NuGet repository password is cleartext\n  -rs, --recursive                                                             To be used with a single project file, it will recursively scan project references of the supplied project file\n  -ns, --no-serial-number                                                      Optionally omit the serial number from the resulting BOM\n  -gu, --github-username \u003cgithub-username\u003e                                     Optionally provide a GitHub username for license resolution. If set you also need to provide a GitHub personal access token (env: CYCLONEDX_GITHUB_USERNAME)\n  -gt, --github-token \u003cgithub-token\u003e                                           Optionally provide a GitHub personal access token for license resolution. If set you also need to provide a GitHub username (env: CYCLONEDX_GITHUB_TOKEN)\n  -gbt, --github-bearer-token \u003cgithub-bearer-token\u003e                            Optionally provide a GitHub bearer token for license resolution. This is useful in GitHub actions (env: CYCLONEDX_GITHUB_BEARER_TOKEN, GITHUB_TOKEN)\n  -egl, --enable-github-licenses                                               Enables GitHub license resolution\n  -dpr, --disable-package-restore                                              Optionally disable package restore\n  -dhc, --disable-hash-computation                                             Optionally disable hash computation for packages\n  -dct, --dotnet-command-timeout \u003cdotnet-command-timeout\u003e                      dotnet command timeout in milliseconds (primarily used for long dotnet restore operations) [default: 300000]\n  -biop, --base-intermediate-output-path \u003cbase-intermediate-output-path\u003e       Optionally provide a folder for customized build environment. Required if folder 'obj' is relocated.\n  -imp, --import-metadata-path \u003cimport-metadata-path\u003e                          Optionally provide a metadata template which has project specific details.\n  -ipr, --include-project-references                                           Include project references as components (can only be used with project files).\n  -sn, --set-name \u003cset-name\u003e                                                   Override the autogenerated BOM metadata component name.\n  -sv, --set-version \u003cset-version\u003e                                             Override the default BOM metadata component version (defaults to 0.0.0).\n  -st, --set-type   \u003cApplication|Container|Data|Device|Device_Driver|          Override the default BOM metadata component type (defaults to application). [default: Application]\n                     File|Firmware|Framework|Library|\n                     Machine_Learning_Model|Null|Operating_System|Platform\u003e\n  -ef, --exclude-filter \u003cexclude-filter\u003e                                       A comma separated list of dependencies to exclude in form 'name1@version1,name2@version2' or 'name1,name2' (to exclude all versions). Transitive dependencies will also be removed.\n  -F, --output-format \u003cAuto|Json|UnsafeJson|Xml\u003e                               Select the BOM output format: auto (default), xml, json, or unsafeJson (relaxed escaping). [default: Auto]                            \n  --set-nuget-purl                                                             Override the default BOM metadata component bom ref and PURL as NuGet package.\n  -spv, --spec-version \u003c1.0|1.1|1.2|1.3|1.4|1.5|1.6|1.7\u003e                       Which version of CycloneDX spec to use. [default: 1.7]\n  --version                                                                    Show version information\n  -?, -h, --help                                                               Show help and usage information\n```\n\n*   `-ef, --exclude-filter`  \n    The exclude filter may be used to exclude any packages, which are resolved by NuGet, but do not exist\n    in the final binary output. For example, an application targets .NET 8, but has a dependency to a library,\n    which only supports .NET Standard 1.6. Without filter, the libraries of .NET Standard 1.6 would be in the\n    resulting SBOM. But they are not used by application as they do not exist in the binary output folder.\n\n#### Examples\nTo run the **CycloneDX** tool you need to specify a solution or project file. In case you pass a solution, the tool will aggregate all the projects.\n\nThe following will create a BOM from a solution and all projects defined within:\n```bash\ndotnet-CycloneDX YourSolution.sln -o /output/path\n```\n\nThe following will recursively scan the directory structure for packages.config and create a BOM:\n```bash\ndotnet-CycloneDX /path/to/project -o /output/path\n```\n\nThe following will recursively scan the project references of the supplied project file, and create a BOM of all package references from all included projects:\n```bash\ndotnet-CycloneDX /path/to/project/MyProject.csproj -o /output/path -rs\n```\n\nThe following will create a BOM from a project and exclude transitive dependency .NET Standard:\n```bash\ndotnet-CycloneDX /path/to/project/MyProject.csproj -o /output/path -ef NETStandard.Library@1.6.0\n```\n\n\n\n#### BOM metadata\nThe BOM `\u003cmetadata\u003e` block is populated from three sources in priority order:\nCLI arguments (`--set-name`, `--set-version`, `--set-type`) override a template\nfile (`--import-metadata-path`), which in turn overrides the automatic fallback\nderived from the scanned project name.\n\nSee **[docs/bom-metadata.md](docs/bom-metadata.md)** for the full reference:\ntemplate file format, precedence rules, and common CI patterns.\n\n#### Credentials via environment variables\n\nAll credential options can be supplied through environment variables instead of\ncommand-line arguments. This avoids exposing secrets in process listings, shell\nhistory, and CI logs.\n\n| Environment variable | Equivalent CLI flag | Description |\n|---|---|---|\n| `CYCLONEDX_NUGET_USERNAME` | `-us` / `--baseUrlUsername` | NuGet feed username |\n| `CYCLONEDX_NUGET_PASSWORD` | `-usp` / `--baseUrlUserPassword` | NuGet feed password or API key |\n| `CYCLONEDX_GITHUB_USERNAME` | `-gu` / `--github-username` | GitHub username for Basic auth |\n| `CYCLONEDX_GITHUB_TOKEN` | `-gt` / `--github-token` | GitHub personal access token |\n| `CYCLONEDX_GITHUB_BEARER_TOKEN` | `-gbt` / `--github-bearer-token` | GitHub bearer token |\n| `GITHUB_TOKEN` | `-gbt` / `--github-bearer-token` | GitHub bearer token (standard Actions variable, used as fallback for `CYCLONEDX_GITHUB_BEARER_TOKEN`) |\n\nWhen both a CLI argument and an environment variable are set, the CLI argument takes precedence.\n\n#### GitHub License Resolution\n\nSPDX license IDs can be resolved for packages that reference a supported license\nfile in a GitHub repository.\n\nThe GitHub license API has an unauthenticated call limit of 60 calls per hour.\nTo ensure consistent output if a rate limit is exceeded BOM generation will\nfail. If you start hitting rate limits you will need to generate a personal\naccess token and provide this, and your username, when running CycloneDX.\n\nTo generate a token go to\n[Personal access tokens](https://github.com/settings/tokens) under\n`Settings / Developer settings`. From there, select the option to\n[Generate new token](https://github.com/settings/tokens/new). No special token\npermissions are required.\n\nDue to current limitations in the GitHub API licenses will only be resolved for\nmaster branch license references.\n\n## License\n\nPermission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the [LICENSE] file for the full license.\n\n[License]: https://github.com/CycloneDX/cyclonedx-dotnet/blob/master/LICENSE\n\n## Contributing\n\nPull requests are welcome. But please read the\n[CycloneDX contributing guidelines](https://github.com/CycloneDX/.github/blob/master/CONTRIBUTING.md) first.\n\nTo build and test the solution locally you should have .NET 8.0, .NET 9.0 or .NET 10.0 SDK\ninstalled. Standard commands like `dotnet build` and `dotnet test` work.\n\nAlternatively, you can use VS Code and the included devcontainer configuration\nto work in a pre-configured docker image. (You will also need the \"Remote - Containers\"\nextension and Docker)\n\nIt is generally expected that pull requests will include relevant tests.\nTests are automatically run on Windows, MacOS and Linux for every pull request.\nAnd build warnings will break the build.\n\nIf you are having trouble debugging a test that is failing for a platform you\ndon't have access to please let us know.\n\nThanks to [Gitpod](https://gitpod.io/) there is a really easy way of creating\na ready to go development environment with VS Code. You can open a Gitpod\nhosted development environment in your browser.\n\n[![Open in Gitpod](https://gitpod.io/button/open-in-gitpod.svg)](https://gitpod.io/#https://github.com/CycloneDX/cyclonedx-dotnet)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcyclonedx%2Fcyclonedx-dotnet","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcyclonedx%2Fcyclonedx-dotnet","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcyclonedx%2Fcyclonedx-dotnet/lists"}