pgutil: Read product name and version from file

[caterina]

Hi,

in pgscan it was possible to read the product name and version from a given file using --fileInfo (for 'identify) or --consumer-package-file (for 'publish').

I think this is missing in pgutil? Or am I missing something here?
It looks like the SbomCommand and the ScanCommand can only handle the properties --project-name and --version. But I can't see an option for a file.

Hopefully you can help me with this issue.

Thanks,
Caterina

[atripp]

Hi @caterina ,

I guess those never made it over... they were undocumented and we basically started fresh. Following in my other post, we want to really make surea ll commands fit together nicely and are documented well.

I'm almost certain know you contributed them, but can you help to document what they are?

I found the code here:
https://github.com/Inedo/pgscan/blob/master/PgScanCommon/Program.cs#L231

Does this only work with .NET?

Also... I don't think we have the identify command anymore, right?

Thanks,
Alana

[caterina]

Hi @atripp,

this feature is necessary for us because we have products where we are not able to access the version otherwise. But we want to have the according information about this project, so we implemented the possibility to read the version from a .dll or .exe.
It just extends the current functionality and I think it would also be a great addition for pgutil.

It is not limited to .NET since we were using System.Diagnostics.FileVersionInfo.GetVersionInfo() to retrieve the information in pgscan.

I think instead of 'identify' it is now 'builds scan'. It is a property which is necessary for sbom generation. So I would suggest that 'builds scan' and 'builds sbom' in pgutil should support this option.

Thanks,
Caterina