https://github.com/cyclonedx/cyclonedx-dotnet-library
.NET library to consume and produce CycloneDX Software Bill of Materials (SBOM)
https://github.com/cyclonedx/cyclonedx-dotnet-library
bill-of-materials bom cyclonedx dotnet dotnet-core mbom nuget obom owasp saasbom sbom software-bill-of-materials vex
Last synced: 24 days ago
JSON representation
.NET library to consume and produce CycloneDX Software Bill of Materials (SBOM)
- Host: GitHub
- URL: https://github.com/cyclonedx/cyclonedx-dotnet-library
- Owner: CycloneDX
- License: apache-2.0
- Created: 2020-10-19T11:52:20.000Z (over 4 years ago)
- Default Branch: main
- Last Pushed: 2025-01-24T21:10:02.000Z (3 months ago)
- Last Synced: 2025-03-28T15:09:55.900Z (about 1 month ago)
- Topics: bill-of-materials, bom, cyclonedx, dotnet, dotnet-core, mbom, nuget, obom, owasp, saasbom, sbom, software-bill-of-materials, vex
- Language: C#
- Homepage:
- Size: 4.67 MB
- Stars: 17
- Watchers: 6
- Forks: 24
- Open Issues: 34
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Codeowners: CODEOWNERS
Awesome Lists containing this project
README
[](https://github.com/CycloneDX/cyclonedx-dotnet-library/actions?workflow=.NET+Core+CI)
[][License]
[](https://www.nuget.org/packages/CycloneDX.Core/)
[](https://cyclonedx.org/)
[](https://cyclonedx.org/slack/invite)
[](https://groups.io/g/CycloneDX)
[](https://twitter.com/CycloneDX_Spec)
# CycloneDX libraries for .NET
The CycloneDX libraries for .NET support programmatically consuming and producing CycloneDX bill-of-materials. CycloneDX is a lightweight BOM specification that is easily created, human readable, and simple to parse.
The libraries support .NET Standard 2.0.
## Getting Started
For help getting started using the CycloneDX .NET Library refer to the [documentation](https://cyclonedx.github.io/cyclonedx-dotnet-library/).
## SPDX Interop
The `CycloneDX.Spdx.Interop` library includes methods for converting between
CycloneDX and SPDX formats. (Currently only SPDX v2.2 JSON format is supported.)
### High level overview of information lost during conversion:
This is a high level overview of information that will be lost during
conversion. This is current state only, some features are yet to be
implemented as indicated below.
If you are familiar with both formats, and would like to contribute to
minimising data loss during conversion, pull requests are welcome :)
#### SPDX -> CycloneDX
| Feature | Notes |
| --- | --- |
| Relationship Information | Implementation pending, related to CycloneDX component assemblies, dependency graph, and composition. |
| License information in files | Needs review, the way SPDX and CycloneDX handle license information evidence is slightly different. |
| Snippet Information | Snippets are not currently supported by CycloneDX |
| Non-SPDX licenses | Implementation pending |
#### CycloneDX -> SPDX
| Feature | Notes |
| --- | --- |
| Component assemblies | Implementation pending - related to SPDX Relationship Information |
| Hashes | SPDX documents are unable to represent the following hash algorithms: SHA3-256, SHA3-384, SHA3-512, BLAKE2b-256, BLAKE2b-384, BLAKE2b-512, BLAKE3. |
| SWID Tags | SPDX doesn't support SWID tags. |
| Component Type Information | SPDX doesn't support designating a component as a particular type (i.e. library, framework, container). |
| CPE and Package URL for Component Identity | SPDX supports multiple CPEs and PURLs for a package. But doesn't support specifying if any are a component identifier. |
| Device & Hardware Components | SPDX does not support devices or hardware as components. |
| Composition | Implementation pending - related to SPDX Relationship Information |
| Dependency Graph | Implementation pending - related to SPDX Relationship Information |
| External References | External references are handled differently between the two formats. |
| Non-SPDX licenses | Implementation pending |
## License
Permission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the [LICENSE] file for the full license.
[License]: https://github.com/CycloneDX/cyclonedx-dotnet-library/blob/master/LICENSE
## Contributing
Pull requests are welcome. But please read the
[CycloneDX contributing guidelines](https://github.com/CycloneDX/.github/blob/master/CONTRIBUTING.md) first.
To build and test the solution locally standard commands like `dotnet build` and `dotnet test` work.
The protocol buffer tests require the protocol buffer compiler executable `protoc` to be available in your path.
Documentation is generated using [DocFX](https://dotnet.github.io/docfx/index.html).
It is generally expected that pull requests will include relevant tests.
Tests are automatically run on Windows, MacOS and Linux for every pull request.
And build warnings will break the build.
If you are having trouble debugging a test that is failing for a platform you
don't have access to please us know.