Issues retrieving package info for Private Azure DevOps Nuget feed since 0.9.1 about cyclonedx-dotnet

[karolswdev]

We incorporated the creating of a NuGet.Config file in our CI/CD pipeline to ensure private package reference resolution. The entire content of the NuGet.Config file is stored in a GItHub secret.

This is our step:

- name: Create Nuget.Config file 🔑
      run: |
        cat << EOF > ./NuGet.Config
        ${{ secrets.nuget_config }}
        EOF

[coderpatros]

Ah, that might actually be the same issue as #74.

I have a fix pending merge in PR #75.

[Zargath]

@coderpatros, I just tested your latest PR merge (built it locally) and it looks to have fixed my issue! 🎉The package information from my private feed is there, with the description this time, and its child dependencies are now included in that bom.

Thanks for the quick fix!

Edouard

[Zargath]

Hi @coderpatros, Just tested with v0.9.2, working as expected now!

Thank you!

[coderpatros]

Hi @Zargath. Internally it uses dotnet restore so it should pick up any configured nuget feeds, credentials and credential providers available to the standard restore task.

Are you getting this running it locally, or in a CI/CD pipeline?

The easiest way, I've come across, to edit your nuget sources for credentials is to use the nuget sources command https://docs.microsoft.com/en-us/nuget/reference/cli-reference/cli-ref-sources

[coderpatros]

And the reason for the change is that previously any direct or transitive dependencies in your private nuget packages were not being added to the BOM.

[Zargath]

Hi @coderpatros,
Thanks for the quick response! I look forward to being able to use the update since we have been creating a BOM for the private feed projects as well to be scanned separately.

I initially received the error in the CI pipeline and I've been able to reproduce it locally. We use Azure Active directory integration for our authentication. dotnet restore works without a hitch and the source is properly configured in the dotnet sources listing. No credentials are stored in the NuGet.config file for this source.

This is the original error I received that I get locally as well when I don't specify the feed url as a parameter to CycloneDX.

[Zargath]

Ohhh that does look like it would fix my issue as well!

[coderpatros]

@Zargath this should be fixed now in v0.9.2. Can you please confirm and close this issue if it has. Thanks