Add support for "dotnet-retire"

I’ve just found RetireNet. This tools produces massive more information and also finds some vulnerabilities.

• It scans all transitive dependencies,
• It includes .NET Framework / .NET Core version aswell
  • I think this is very important, because MSFT mostly publish vulnerabilities for a specific .netcore version

Maybe you can include dotnet-retire and create a bom.xml out of scan results from dotnet-retire. Or add parameter to add additional input from output

Regarding CycloneDX Spec, it’s also possibile to add vulnerabilities to the bom.xml

What do you think?

[stevespringett]

Ideally, RetireNet would produce a valid CycloneDX BOM, similar to what Retire.js already does. So it could be used as an alternative way to create BOMs from .NET projects and optionally generate the vulnerabilities in the BOMs as well.

But in order for their BOM to be useful, the project needs to support Package URL. Refer to https://github.com/RetireNet/dotnet-retire/issues/33, and optionally CPE.

I would recommend creating an enhancement request for that project to support the output of CycloneDX with the vulnerability info.

[stevespringett]

If RetireNet ever supports Package URL, then yes, I plan to support it as an analyzer in Dependency-Track. Their data feed is missing a few things however.

• unique (per vulnerability) identifier.
  • What do we call it?
• severity
• purl (https://github.com/RetireNet/dotnet-retire/issues/33)
• source (some vulns reference CVEs, others reference GHSAs, others don’t reference anything other than a Microsoft alert.

If their data improves, there’s a lot of potential for integration.