🚧 Add SBOM generation to NuGet Package output using Microsoft.Sbom.Targets

[michael-hawker]

Initial attempt at adding SBOMs to our NuGet Packages.

Following https://www.meziantou.net/generating-sbom-for-nuget-packages.htm

Package Listing: https://www.nuget.org/packages/Microsoft.Sbom.Targets
Tool repo: https://github.com/microsoft/sbom-tool

Package/Tool Source: https://github.com/microsoft/sbom-tool/tree/main/src/Microsoft.Sbom.Targets

[michael-hawker]

This seemed to work:

manifest.spdx.json

It does list the dependencies, though not sure if it's supposed to find the licenses and locations? I haven't been able to find another example of a package with this same type of embedded manifest...

[Arlodotexe]

It does list the dependencies, though not sure if it's supposed to find the licenses and locations? I haven't been able to find another example of a package with this same type of embedded manifest...

@michael-hawker I'm seeing the same thing, but I'm thinking these things are meant to be handled by Source Link and the licensing tooling in NuGet. Do these need to be included in the sbom?

[michael-hawker]

Open issue about documenting the tool: microsoft/sbom-tool#909

[Arlodotexe]

Noting that GitHub makes use of SBOM already in the network/dependencies Insights tab in any repo.