Prevent Unable to locate valid bom ref for package error when using a range and there are multiple versions of a package referenced

[tl-maisie-sadler]

Context

I have come across an issue while using this tool to generate an SBOM for one of our larger solutions.

When the following occurs:

1. Package dependency is specified with range syntax, e.g. [1.4.0, 1.4.0]
2. Multiple versions of the package referenced throughout the solution

We get an error message as below, even though there are packages available.

Unable to locate valid bom ref for TrueLayer.Observability.Abstractions [1.4.0, 1.4.0]

Solution

The proposed solution chooses the first referenced package, rather than assuming none exists if the found packages != 1.

[mtsfoni]

The core issue is, that a c#-solution is not one software-solution (as in tool, library or service) but rather an arbitrary collection of one or more software-solution or parts of such.

The issue comes from the idea, that a software-solution can only have one version of a dependency at one time. Which is basically correct for C#.

This bases on the assumption that you would create a SBOM (in the context of this tool) for a single software-solution. Which makes sense.

Running this tool against a c#-solution, now assumes that multiple software-solution are actually just one because they are arbitrarily grouped, might find multiple dependencies with same name but different version - which basically is correct, because they are used in different software-solutions.

If one just discards all versions but the first, one creates an incomplete SBOM. In my opinion it's actually a flaw that you can run this tool against a .sln-file and I'd recommend running it against the root-component (.csproj) of each included software-solution separately and potentially - if necessary - merge them after. If the project uses PackageReferences inside the project file, transitive dependencies will be detected and resolved to the correct version.

The correct solution for this problem, would be, to simply add all versions of that library to the sbom, because all of them might be in use by some of the parts of the software solution. We can't easily know when creating a sbom for solutions.