🚧 Add SBOM generation to NuGet Package output using Microsoft.Sbom.Targets

[michael-hawker]

Initial attempt at adding SBOMs to our NuGet Packages.

Following https://www.meziantou.net/generating-sbom-for-nuget-packages.htm

Package Listing: https://www.nuget.org/packages/Microsoft.Sbom.Targets
Tool repo: https://github.com/microsoft/sbom-tool

Package/Tool Source: https://github.com/microsoft/sbom-tool/tree/main/src/Microsoft.Sbom.Targets

[michael-hawker]

This seemed to work:

manifest.spdx.json

It does list the dependencies, though not sure if it's supposed to find the licenses and locations? I haven't been able to find another example of a package with this same type of embedded manifest...

[Arlodotexe]

It does list the dependencies, though not sure if it's supposed to find the licenses and locations? I haven't been able to find another example of a package with this same type of embedded manifest...

@michael-hawker I'm seeing the same thing, but I'm thinking these things are meant to be handled by Source Link and the licensing tooling in NuGet. Do these need to be included in the sbom?

[michael-hawker]

Open issue about documenting the tool: microsoft/sbom-tool#909

[Arlodotexe]

Noting that GitHub makes use of SBOM already in the network/dependencies Insights tab in any repo.

[michael-hawker]

Thanks Arlo, I know GitHub and NuGet do some tracking here, so not sure if they generate their own. I think this is mostly about us including the file within the package as well. I haven't gotten a lot of clarity on the requirements and how to validate our packages.

I've filed the request before here on the tool itself: microsoft/sbom-tool#909 - and am awaiting more documentation and guidance still for us to validate compliance.

[HotCakeX]

I create SBOMs in my workflow and attach the file to the releases in this file:
https://github.com/HotCakeX/Harden-Windows-Security/blob/main/.github/workflows/Build%20AppControl%20Manager%20MSIX%20Package.yml

Maybe it can be useful for implementing it in this repository.

The main command i run is this

. "${Env:RUNNER_TEMP}\sbom-tool.exe" generate -b $MSIXBundleOutput -bc .\ -pn 'AppControl Manager' -ps 'Violet Hansen' -pv $MSIXVersion -nsb 'https://github.com/HotCakeX/Harden-Windows-Security' -V Verbose -gt true -li true -pm true -D true -lto 80

This command needs to run after the projects are built and compiled.
It doesn't scan the CsProj files to detect NuGet dependencies.