Tool fails on Dotnet 10 with System.InvalidOperationException: The JSON property name for 'Microsoft.ComponentDetection.Contracts.TypedComponent.SwiftComponent.packageUrl' collides with another property.

[rogerbriggen-securiton]

Using Microsoft.Sbom.DotNetTool 4.1.5

Creating an SBOM on dotnet 10 runtime of a dotnet 10 project fails because of the new System.Text.json feature, see https://learn.microsoft.com/en-us/dotnet/core/compatibility/serialization/10/property-name-validation

17:12:36 [DBG] ##[warning]Unknown error while running CD scan: System.InvalidOperationException: The JSON property name for 'Microsoft.ComponentDetection.Contracts.TypedComponent.SwiftComponent.packageUrl' collides with another property.
17:12:36 [DBG] at System.Text.Json.ThrowHelper.ThrowInvalidOperationException_SerializerPropertyNameConflict(Type type, String propertyName)
17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.JsonTypeInfo.JsonPropertyInfoList.AddPropertyWithConflictResolution(JsonPropertyInfo jsonPropertyInfo, PropertyHierarchyResolutionState& state)
17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.DefaultJsonTypeInfoResolver.AddMembersDeclaredBySuperType(JsonTypeInfo typeInfo, Type currentType, NullabilityInfoContext nullabilityCtx, Boolean constructorHasSetsRequiredMembersAttribute, PropertyHierarchyResolutionState& state)
17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.DefaultJsonTypeInfoResolver.PopulateProperties(JsonTypeInfo typeInfo, NullabilityInfoContext nullabilityCtx)
17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.DefaultJsonTypeInfoResolver.CreateTypeInfoCore(Type type, JsonConverter converter, JsonSerializerOptions options)
17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.DefaultJsonTypeInfoResolver.GetTypeInfo(Type type, JsonSerializerOptions options)
17:12:36 [DBG] at System.Text.Json.JsonSerializerOptions.GetTypeInfoNoCaching(Type type)
17:12:36 [DBG] at System.Text.Json.JsonSerializerOptions.CachingContext.CreateCacheEntry(Type type, CachingContext context)
17:12:36 [DBG] --- End of stack trace from previous location ---
17:12:36 [DBG] at System.Text.Json.JsonSerializerOptions.GetTypeInfoInternal(Type type, Boolean ensureConfigured, Nullable1 ensureNotNull, Boolean resolveIfMutable, Boolean fallBackToNearestAncestorType) 17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.PolymorphicTypeResolver..ctor(JsonSerializerOptions options, JsonPolymorphismOptions polymorphismOptions, Type baseType, Boolean converterCanHaveMetadata) 17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.JsonTypeInfo.Configure() 17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.JsonTypeInfo.<EnsureConfigured>g__ConfigureSynchronized|174_0() 17:12:36 [DBG] at System.Text.Json.JsonSerializerOptions.GetTypeInfoInternal(Type type, Boolean ensureConfigured, Nullable1 ensureNotNull, Boolean resolveIfMutable, Boolean fallBackToNearestAncestorType)
17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.JsonPropertyInfo.Configure()
17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.JsonTypeInfo.ConfigureProperties()
17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.JsonTypeInfo.Configure()
17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.JsonTypeInfo.g__ConfigureSynchronized|174_0()
17:12:36 [DBG] at System.Text.Json.JsonSerializerOptions.GetTypeInfoInternal(Type type, Boolean ensureConfigured, Nullable1 ensureNotNull, Boolean resolveIfMutable, Boolean fallBackToNearestAncestorType) 17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.JsonTypeInfo.Configure() 17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.JsonTypeInfo.<EnsureConfigured>g__ConfigureSynchronized|174_0() 17:12:36 [DBG] at System.Text.Json.JsonSerializerOptions.GetTypeInfoInternal(Type type, Boolean ensureConfigured, Nullable1 ensureNotNull, Boolean resolveIfMutable, Boolean fallBackToNearestAncestorType)
17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.JsonPropertyInfo.Configure()
17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.JsonTypeInfo.ConfigureProperties()
17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.JsonTypeInfo.Configure()
17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.JsonTypeInfo.g__ConfigureSynchronized|174_0()
17:12:36 [DBG] --- End of stack trace from previous location ---
17:12:36 [DBG] at System.Text.Json.Serialization.Metadata.JsonTypeInfo.g__ConfigureSynchronized|174_0()
17:12:36 [DBG] at System.Text.Json.JsonSerializer.GetTypeInfo(JsonSerializerOptions options, Type inputType)
17:12:36 [DBG] at System.Text.Json.JsonSerializer.Serialize(Object value, Type inputType, JsonSerializerOptions options)
17:12:36 [DBG] at Microsoft.ComponentDetection.Common.FileWritingService.AppendToFile[T](String relativeFilePath, T obj)
17:12:36 [DBG] at Microsoft.ComponentDetection.Orchestrator.Commands.ScanCommand.WriteComponentManifest(ScanSettings settings, ScanResult scanResult)
17:12:36 [DBG] at Microsoft.ComponentDetection.Orchestrator.Commands.ScanCommand.ExecuteScanCommandAsync(ScanSettings settings, CancellationToken cancellationToken)
17:12:36 [DBG] at Microsoft.Sbom.Api.Utils.ComponentDetector.ScanAsync(ScanSettings args) in D:\a_work\1\s\src\Microsoft.Sbom.Api\Utils\ComponentDetector.cs:line 55
17:12:36 [DBG] at Microsoft.Sbom.Api.Utils.ComponentDetectorCachedExecutor.ScanAsync(ScanSettings args) in D:\a_work\1\s\src\Microsoft.Sbom.Api\Utils\ComponentDetectorCachedExecutor.cs:line 51
17:12:36 [DBG] at Microsoft.Sbom.Api.Executors.ComponentDetectionBaseWalker.<>c__DisplayClass11_0.<g__Scan|0>d.MoveNext() in D:\a_work\1\s\src\Microsoft.Sbom.Api\Executors\ComponentDetectionBaseWalker.cs:line 116
17:12:36 [DBG] --- End of stack trace from previous location ---
17:12:36 [DBG] at Microsoft.Sbom.Api.Executors.ComponentDetectionBaseWalker.<>c__DisplayClass11_0.<b__1>d.MoveNext() in D:\a_work\1\s\src\Microsoft.Sbom.Api\Executors\ComponentDetectionBaseWalker.cs:line 201
17:12:36 [ERR] Target Publish has thrown an exception

[KalleOlaviNiemitalo]

Perhaps this issue should be cloned into https://github.com/microsoft/component-detection/issues, as the types are defined in that repository:

https://github.com/microsoft/component-detection/blob/dbff730ea5e1707d9d70de191667c9612950f62e/src/Microsoft.ComponentDetection.Contracts/TypedComponent/SwiftComponent.cs#L47-L48

https://github.com/microsoft/component-detection/blob/dbff730ea5e1707d9d70de191667c9612950f62e/src/Microsoft.ComponentDetection.Contracts/TypedComponent/TypedComponent.cs#L61-L62

TypedComponent has a public virtual PackageURL PackageUrl property but SwiftComponent has public PackageURL PackageURL ("URL" wholly upper case), and both of them have [JsonPropertyName("packageUrl")]. It looks like the SwiftComponent.PackageURL property isn't even referenced anywhere. In contrast, other classes like NuGetComponent have public override PackageURL PackageUrl.