dotnet / dotnet/sdk

Integrate SBOM generation into application publishing

Open
#46,274 0 comments 5 reactions 0 assignees View on GitHub
Area-NetSDK Area-SBOM
Dominant language
C#
Stars
3.2k
Forks
1.3k
PR merge metrics
PR metrics pending

Description

### Is your feature request related to a problem? Please describe.

The .NET SDK should generate SBOMs for published applications. As part of publishing, we should trigger SBOM generation from Microsoft.SBOM.Targets. The SBOMs should contain information about the NuGet packages consumed by the application, as well as relevant data about the SDK, Workloads, and Toolchain used to build the application.

Today, the NuGet package detection is handled well, but the build-time information is not currently represented in microsoft/sbom-tool. We may need additional integration points to provide that information to the tool.

### Additional context

A quick version of what this integration might look like is available at https://github.com/baronfel/dotnet-app-sbom-sample.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.