Extension ID

com.castsoftware.dmtdotnetnugetresourcesextractor

What's new?

Please see NuGet Resources Extractor - 1.0 - Release Notes.

Description

The NuGet Resources Extractor provides the means to configure an automatic extraction of NuGet package dependencies from a NuGet repository for use during a .NET analysis. In other words, NuGet package based source code that resides in a simple local or nuget.org location. This extractor should be used when you want to extract packages (.nupkg) based source code that is stored in a NuGet repository. For example, when your .NET application contains .csproj files which have package references defined, you can use this extractor to extract those NuGet packages from the NuGet repository. Example package references in a .csproj are shown below:

<ItemGroup>
    <!-- ... -->
    <PackageReference Include="Contoso.Utility.UsefulStuff" Version="3.6.0" />
    <!-- ... -->
</ItemGroup>

packages.config

The content of the packages.config file (if this file is delivered and referenced via the .csproj file) is handled differently depending on the release of AIP Core you are using on your AIP Node to perform the analysis:

AIP Core ≥ 8.3.37

The Nuget Resources Extractor will identify the packages.config file and any packages defined in it will be identified and extracted. For example:

<?xml version="1.0" encoding="utf-8"?>
<packages>
  <package id="jQuery" version="3.1.1" targetFramework="net46" />
  <package id="NLog" version="4.3.10" targetFramework="net46" />
</packages>


AIP Core ≤ 8.3.36The NuGet Resources Extractor will identify the packages.config file but any packages defined in it will be ignored.

CAST AIP compatibility

AIP Console≥ 1.18.x
CAST AIP≥ 8.3.27

Microsoft Windows Win32 long paths requirement

CAST highly recommends that Win32 long paths is enabled on the AIP Node on which the .NET analysis will be run: the extracted package dependencies are stored inside a folder called "nugetPck" which is located in the Deployment folder. Depending on where the Deployment folder is located, the path to the extracted package dependencies may exceed the default 260 character length, which would cause the analyzer to fail to access the dependencies during an analysis. To enable long paths, use the Local Group Policy Editor (gpedit) on the AIP Node and drill down to:

Computer Configuration > Administrative Templates > System > Filesystem

Click to enlarge

Then double click the Enable Win32 long paths option to enable the setting:

Click to enlarge

Using the extractor with AIP Console

Download and installation

The extractor will be automatically downloaded and installed in AIP Console when at least one .csproj file is delivered for analysis. You can also manually install the extension using the Application - Extensions interface.

The current extension is released in beta mode, therefore, to allow the extension to be automatically downloaded and installed when at least one .csproj file is delivered for analysis you will need to set the extension strategy version slider to include beta releases as shown below:

Usage

In AIP console this extractor is driven by the %PROGRAMDATA%\CAST\AipConsole\AipNode\aip-node-app.properties file attribute scanner.nuget.repository:

# HTTP V3 Nuget repository to download package dependencies https://api.nuget.org/v3/index.json or file system like file://C:/Users/johndoe/.nuget/packages
scanner.nuget.repository=https://api.nuget.org/v3/index.json

By default this attribute is present and will accept two values:

If a .csproj file is detected in the delivered source code, the extension will be downloaded and installed as part of the analysis process. If the .csproj file contains package dependency references, these references will automatically be accessed and extracted to a dedicated folder called nugetPck in the Application's Deployment folder:

These references will then be used during the .NET analysis.

Using the extractor with the legacy CAST Delivery Manager Tool

The extractor can be accessed as follows:

Click to enlarge

Click to enlarge

Click to enlarge

Enter the path to your NuGet repository, for example:

Click to enlarge

When packaging is complete, the package dependencies identified and to be extracted will be displayed under Package Reference with name, version and framework:

Extraction messages

The following messages emitted by the extractor may appear during the source code extraction process

Format

Message Id

Message

Remediation

Errorcom.castsoftware.dmt.extractor.dotnet.nuget.EmptyURLEmpty UrlProvide a valid repository URL.
Errorcom.castsoftware.dmt.extractor.dotnet.nuget.UnexpectedRepositoryUnexpected URL %URL%Check the repository URL. It should be valid.
Errorcom.castsoftware.dmt.extractor.dotnet.nuget.InstallationErrorNuGet Not Installed falseInstall the NuGet client tool. Follow https://docs.microsoft.com/en-us/nuget/install-nuget-client-tools.
Warningcom.castsoftware.dmt.extractor.dotnet.nuget.invalid URLInvalid URL: %URL%Provide a valid repository URL, either nuget.org (https://api.nuget.org/v3/index.json) or file system (file://C://Users/johndoe/.nuget/packages).
Warningcom.castsoftware.dmt.extractor.dotnet.nuget.extractPackagesNo package artifact found!!!Check the source discovery: packages should be identified as resource profile references in the format [packageName.dll][frameworkVersion] for each module.
Warningcom.castsoftware.dmt.extractor.dotnet.nuget.NugetCommandUtilityOutput: %commandoutput% ERROR in setting source command: %Command%Check the %commandoutput%.