feat: add .NET 9 Support

[nathan-mittelette]

Add support for .NET 9 based on this PR : #777

[nil4]

Adding a new net9.0 target to this tool would work, but I would argue that doing so would be inefficient and ultimately, unnecessary.

The tool currently targets .NET 6, 7, and 8. Adding a new .NET target would be inefficient because it would increase the package size by ~33% without providing new APIs or features.

It is not necessary because there is a relatively obscure, but straightforward, way for end-users to install and use the tool as-is with .NET 9.

Consider the scenario where only .NET 9 SDK is installed (and [...] denotes elided output to keep this brief):

> dotnet --version
9.0.100

> dotnet tool install --global CycloneDX
You can invoke the tool using the following command: dotnet-CycloneDX
Tool 'cyclonedx' (version '4.0.0') was successfully installed.

> dotnet cyclonedx --version
You must install or update .NET to run this application.

App: C:\Users\nil4\.dotnet\tools\dotnet-CycloneDX.exe
Architecture: x64
Framework: 'Microsoft.NETCore.App', version '8.0.0' (x64)
.NET location: C:\Program Files\dotnet\

The following frameworks were found:
  9.0.0 at [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]

[...]
To install missing framework, download:
https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=8.0.0&arch=x64&rid=win-x64&os=win10

ref. https://youtu.be/4iEqqPZKDC0?t=2081 end-users can explicitly add --allow-roll-forward when installing the tool to work around this issue:

> dotnet tool uninstall --global CycloneDX
Tool 'cyclonedx' (version '4.0.0') was successfully uninstalled.

> dotnet tool install --global --allow-roll-forward CycloneDX
You can invoke the tool using the following command: dotnet-CycloneDX
Tool 'cyclonedx' (version '4.0.0') was successfully installed.

> dotnet cyclonedx --version
4.0.0+3d71d1f1a7609ea5c8108ca11ea07d5ad2f0222b

With this, CycloneDX can be installed and used as-is on .NET 9 and future versions.

Additionally, end-users could be spared the inconvenience of having to add --allow-roll-forward when installing (and contributors/maintainers rushing to add new netX.0 targets yearly) by adding <RollForward>Major</RollForward> to the tool's project file.

This is what #909 suggests -- that change would allow the straightforward dotnet tool install --global CycloneDX to work with any future .NET SDK.

[mtsfoni]

I agree with nil, additionally, for the next major version, we can remove dotnet 6 and 7 to reduce package size.

[maarten-kieft]

Any news on this? We facing issues that the docker file doesn't support .net 9. We could ofcourse create our own docker image, but we rather stay in sync. Is this PR going to be closed or adjusted @nil4 ?

[nil4]

The rollForward=major policy was merged in #909 and the subsequent release 4.1.0 includes it: https://github.com/CycloneDX/cyclonedx-dotnet/releases/tag/v4.1.0

My testing showed that installing and using version 4.1.0 worked on .NET 9 SDK. Should you face any problems, may I suggest opening a new issue to add the relevant details (e.g. stacktraces, etc.) @maarten-kieft ?

[maarten-kieft]

@nil4 Yeah we have since that version, however the dockerfile in version 4.1.0 is still using .net 8 and therefore complaining about code which is build in .net 9. If you prefer I can setup a separate issue for it, but the changes here would fix it though.

[nil4]

I suppose you're referring to this line here:

cyclonedx-dotnet/Dockerfile

Line 1 in 3ad0483

FROM mcr.microsoft.com/dotnet/sdk:8.0.101

If so, I can see how updating that base image version to a 9.0 SDK would be helpful.

I would suggest requesting the project maintainers' feedback about this topic -- I'm not familiar with how the Docker image is created and published, nor using it myself. My feeling is that many other changes in this PR may be too broad, if this is the only update needed.

[mtsfoni]

I built a new version 4.2 with sdk:9.0 as base image - everything else should work with the rollForward option.

Image needs to need to have the newest version because so it can nuget restore the projects it is supposed to scan.

@maarten-kieft please give me feedback if this resolves your issues.

[maarten-kieft]

@mtsfoni , I will try it Monday and let you know. And yes @nil4 that was it indeed. Thank you both, much appreciated!

[maarten-kieft]

@mtsfoni The issue is resolved! Thank you very much!