Add dotnet deps parsing

[noqcks]

Fixes: #257

cc: @nikpivkin @DmitriyLewen

[CLAassistant]

All committers have signed the CLA.

[DmitriyLewen]

Hello @noqcks
Thanks for your work!

I will check your PR and write to you.

[DmitriyLewen]

Hello @noqcks
Left some comments. Take a look, when you have time, please

[DmitriyLewen]

Can we discuss about this:

It looks like we can take package name and version from pkgNameVersion.
Do we need to check "Libraries"?
Is this necessary for backwards compatibility?

[noqcks]

I think I did this initially because I wanted to keep track of whether a Library was a project or not and then be able to set the CycloneDX componentType in response, but I don't think go-dep-parser keeps track of this? I don't see any field on the Library struct that would allow us to set something resembling componentType

[noqcks]

So, in this case, we don't need to check Libraries at all

[DmitriyLewen]

I don't think go-dep-parser keeps track of this

We set componentType in Trivy.

I wanted to keep track of whether a Library was a project or not

We currently take only packages -

go-dep-parser/pkg/dotnet/core_deps/parse.go

Line 35 in 1237b47

if !strings.EqualFold(lib.Type, "package") {

For project we use application type with filepath as name:

➜  trivy -d fs -f cyclonedx pkg/dotnet/core_deps/testdata/ExampleApp1.deps.json | jq '.components[] | select(.type == "application")'
...
{
  "bom-ref": "908ce44b-3644-44ce-b282-8f0d44566e20",
  "type": "application",
  "name": "ExampleApp1.deps.json",
  "properties": [
    {
      "name": "aquasecurity:trivy:Class",
      "value": "lang-pkgs"
    },
    {
      "name": "aquasecurity:trivy:Type",
      "value": "dotnet-core"
    }
  ]
}

[DmitriyLewen]

Is there reason to add project to result?
We didn't include this earlier:

go-dep-parser/pkg/dotnet/core_deps/parse.go

Line 35 in 6eff475

if !strings.EqualFold(lib.Type, "package") {

[noqcks]

yes, because otherwise you can't extract a full and complete dependency tree if you need to parse the SBOM

[DmitriyLewen]

This makes sense for SBOM, but can be confusing when used by default (like json format).
We save project in dependencies. This can be confusing.

Perhaps we need to add new type or field for Library for project name/version. But I think it is change for another PR.

We use application componentType for SBOM - #258 (comment)
Previously this was enough.

[noqcks]

@DmitriyLewen ready for another review

[DmitriyLewen]

I left 2 small comment. Take a look, please.

Also i understood that MyExample.deps.json already contains dependencies.
Do we need new test file or will MyExample.deps.json be enough?

[DmitriyLewen]

Suggested change

	func packageID(name, version string) string {
	// .NET uses `<name>/<version>` ID format:
	// https://github.com/dotnet/cli/blob/f0ee1e44114f161ce9268103d18ce32d2a995d0f/Documentation/specs/runtime-configuration-file.md?plain=1#L87
	func packageID(name, version string) string {

[DmitriyLewen]

Libraries and Dependencies can be sorted.

Suggested change

	return libraries, deps, nil
	sort.Sort(types.Libraries(libs))
	sort.Sort(types.Dependencies(deps))
	return libraries, deps, nil

After these changes you can remove sorting from tests.