[Epic] Support SBOMs for NuGet packages

[JonDouglas]

A SBOM is a nested inventory; a list of ingredients that make up software components.

This epic tracks the work to support providing a SPDX formatted and NTIA compliant SBOM inside of a NuGet package based on the SBOM Everywhere initiative to bring a seamless interoperability end-to-end for security use cases at five major levels of software development:

1. Clients and SDKs
2. Package management plugins
3. Native package manager integration
4. Containerization integration
5. Application/solution integration/deployment

We will most likely utilize sbom-tool to accomplish this task.

• Add a SBOM Generation Task microsoft/sbom-tool#674
• [Feature] Provide the ability to pack a compliant SBOM #13142
• Add a pre-compress target/hook #13690
• Test the top X packages w/ sbom-tool support #13755
• .NET integration follow-up considerations microsoft/sbom-tool#693

Please 👍 or 👎 this comment to help us with the direction of this epic & leave as much feedback/questions/concerns as you'd like on this issue itself and we will get back to you shortly.

Further tracking issues will be created shortly as requirements are gathered and planned.

[TiberiusDRAIG]

Is the intention to support only the SPDX format or is there scope for supporting others like CycloneDX?

[JonDouglas]

@TiberiusDRAIG The intention would be to support what sbom-tool supports at this point.

[Malcolmnixon]

With this being removed from the 6.8 milestone:

• Is there a new planned delivery for this?
• Is there any information on where the SBOMs would/should be located in NuGet packages so we can manually construct compliant packages using sbom-tool today?

[JonDouglas]

Don't read into our backlog tagging too much. It just means that we finished our 6.8 release recently.