Microsoft SBOM-Tool在Linux/Windows环境未检测到包的问题求助

问题 #

在Linux和Windows环境中安装并运行Microsoft SBOM-Tool，尝试基于SBOM-Tool v0.3.1版本源码生成SBOM，但工具仅能通过SPDX22SBOM检测器识别到1个组件，其余20个默认检测器均未检测到任何依赖包，同时日志提示指定的Plugins路径不存在。

操作步骤 #

Linux环境

1. 按照README文档获取Linux可执行文件
2. 获取并解压v0.3.1版本的SBOM-Tool源码
3. 执行命令：

./sbom-tool generate -b <output path> -bc <source path> -pn TestProject -pv 1.0.0 -ps MyCompany -nsb http://mycompany.com

Windows环境

1. 下载v0.3.1版本的Windows可执行文件
2. 获取并解压同版本SBOM-Tool源码
3. 执行命令：

sbom-tool-win-x64.exe generate -b <output path> -bc <source path> -pn TestProject -pv 1.0.0 -ps MyCompany -nsb http://mycompany.com

运行日志片段 #

[INFO] Log file: XXXX.log
[INFO] Run correlation id: XXX

[INFO] Attempting to load default detectors
[INFO] 20 detectors were found in Microsoft.ComponentDetection.Detectors

[WARN] Provided search path XXX/Plugins does not exist.

[INFO] Finding components...
[INFO] Starting enumeration of XXX
[INFO] No instructions received to scan docker images.
[INFO] Enumerated 388 files and 80 directories in 00:00:00.0409279
[WARN] SPDX file at XXX/manifest.spdx.json does not have root elements in documentDescribes section, considering SPDXRef-Document as a root element.
[INFO]
[INFO] _______________________________________________________________________________________________________________________________________
[INFO] |Component Detector Id         |Detection Time                |# Components Found            |# Explicitly Referenced                 |
[INFO] |______________________________|______________________________|______________________________|________________________________________|
[INFO] |CocoaPods                     |0.088 seconds                 |0                             |0
[INFO] |Go                            |0.088 seconds                 |0                             |0
[INFO] |Gradle                        |0.088 seconds                 |0                             |0
[INFO] |Ivy (Beta)                    |0.15 seconds                  |0                             |0
[INFO] |Linux                         |0.047 seconds                 |0                             |0
[INFO] |MvnCli                        |0.15 seconds                  |0                             |0
[INFO] |Npm                           |0.088 seconds                 |0                             |0
[INFO] |NpmWithRoots                  |0.088 seconds                 |0                             |0
[INFO] |NuGet                         |0.089 seconds                 |0                             |0
[INFO] |NuGetPackagesConfig (Beta)    |0.088 seconds                 |0                             |0
[INFO] |NuGetProjectCentric           |0.092 seconds                 |0                             |0
[INFO] |Pip                           |0.088 seconds                 |0                             |0
[INFO] |Pnpm                          |0.088 seconds                 |0                             |0
[INFO] |Poetry (Beta)                 |0.089 seconds                 |0                             |0
[INFO] |Ruby                          |0.088 seconds                 |0                             |0
[INFO] |RustCrateDetector             |0.088 seconds                 |0                             |0
[INFO] |SPDX22SBOM                    |0.13 seconds                  |1                             |0
[INFO] |Vcpkg (Beta)                  |0.089 seconds                 |0                             |0
[INFO] |Yarn                          |0.091 seconds                 |0                             |0
[INFO] |Total                         |0.17 seconds                  |1                             |0
[INFO] |______________________________|______________________________|______________________________|________________________________________|

解决方案 #

• 处理Plugins路径警告：该警告是工具默认尝试加载自定义插件目录但目录不存在导致，若无需自定义插件可直接忽略；若需要则手动创建指定Plugins目录并放入自定义检测器插件。
• 还原项目依赖：SBOM-Tool基于.NET开发，直接解压源码未还原依赖会导致检测器无法识别。进入源码目录执行dotnet restore（Windows/Linux环境通用），完成依赖包下载后再重新生成SBOM。
• 指定目标检测器类型：添加-dt DotNet参数强制工具使用NuGet相关检测器扫描.NET项目，调整后的命令示例：
  Linux：

  ./sbom-tool generate -b <output path> -bc <source path> -pn TestProject -pv 1.0.0 -ps MyCompany -nsb http://mycompany.com -dt DotNet
  

  Windows：

  sbom-tool-win-x64.exe generate -b <output path> -bc <source path> -pn TestProject -pv 1.0.0 -ps MyCompany -nsb http://mycompany.com -dt DotNet
  

• 校验源码路径：确保-bc参数指定的路径包含项目核心配置文件（如.csproj），工具依赖这些文件识别依赖包，若路径错误需调整为正确的项目目录。
• 升级工具版本：v0.3.1版本可能存在兼容性问题，升级到最新稳定版可修复部分检测器的识别逻辑，提升检测成功率。

内容的提问来源于stack exchange，提问作者mamu