dotnet / dotnet/arcade

Enable SBOM generation for .NET optional workloads in Visual Studio

Open
#11,706 2 comments 0 reactions 1 assignee Claimed by @joeloff View on GitHub
Dominant language
C#
Stars
729
Forks
397
Avg merge
3d 15m
Merged PRs (30d)
149

Description

Visual Studio (.vsman) files need to include SBOM information as part of the VSDROP.

We likely need to look at using the updated SWIX compiler to get this support. It will likely end up in the publishing pipelines since the manifests are only generated during staging because we require all the final signed installers and VS manifests. SBOM will eventually become a required check when merging .NET insertions into VS

Alternatively we'd generate the SBOM using the .NET workload tasks, but both options need to be investigated.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.