From 4c9354c99470703808028e416e02a373d35e2e1c Mon Sep 17 00:00:00 2001
From: Gustavo Castellanos Alfonzo <gustavoaca1997@gmail.com>
Date: Thu, 8 Aug 2024 19:45:30 -0700
Subject: [PATCH] Workaround for generating a SBOM manifest at the root level
 of the Nuget Package (#656)

* Add buildMultiTargeting folder to the Nuget package

* Unzip and Zip again for including the SBOM into the Nuget package.

* Append GUID to the temporary unzipped folder.
---
 .../Microsoft.Sbom.Targets.csproj             |  1 +
 .../Microsoft.Sbom.Targets.targets            | 44 +++++++++----------
 2 files changed, 21 insertions(+), 24 deletions(-)

diff --git a/src/Microsoft.Sbom.Targets/Microsoft.Sbom.Targets.csproj b/src/Microsoft.Sbom.Targets/Microsoft.Sbom.Targets.csproj
index be7eabbc..c7202f9b 100644
--- a/src/Microsoft.Sbom.Targets/Microsoft.Sbom.Targets.csproj
+++ b/src/Microsoft.Sbom.Targets/Microsoft.Sbom.Targets.csproj
@@ -60,6 +60,7 @@
         by convention, the .NET SDK will look for build\<Package Id>.props and build\<Package Id>.targets
         for automatic inclusion in the build. -->
     <Content Include="Microsoft.Sbom.Targets.targets" PackagePath="\build" />
+    <Content Include="Microsoft.Sbom.Targets.targets" PackagePath="\buildMultiTargeting" />
   </ItemGroup>
 
   <ItemGroup>
diff --git a/src/Microsoft.Sbom.Targets/Microsoft.Sbom.Targets.targets b/src/Microsoft.Sbom.Targets/Microsoft.Sbom.Targets.targets
index c6700e7f..2caffb5f 100644
--- a/src/Microsoft.Sbom.Targets/Microsoft.Sbom.Targets.targets
+++ b/src/Microsoft.Sbom.Targets/Microsoft.Sbom.Targets.targets
@@ -20,20 +20,12 @@
     <ManifestFolderName>_manifest</ManifestFolderName>
     <SbomSpecification>spdx_2.2</SbomSpecification>
   </PropertyGroup>
-
-  <!-- Copy the SBOM files to each respective target framework folder within the .nupkg -->
-  <PropertyGroup>
-    <TargetsForTfmSpecificContentInPackage>
-      $(TargetsForTfmSpecificContentInPackage);CopySbomOutput
-    </TargetsForTfmSpecificContentInPackage>
-  </PropertyGroup>
   
   <!--Based on the MSBuild runtime, GenerateSbom will either pull the GenerateSbomTask or SbomCLIToolTask logic-->
   <UsingTask TaskName="Microsoft.Sbom.Targets.GenerateSbom" AssemblyFile="$(AssemblyFilePath)" />
 
   <PropertyGroup>
     <GenerateSBOM Condition=" '$(GenerateSBOM)' == '' ">false</GenerateSBOM>
-    <SbomGenerationBuildDropPath Condition=" '$(SbomGenerationBuildDropPath)' == '' ">$(OutDir)</SbomGenerationBuildDropPath>
     <SbomGenerationBuildComponentPath Condition=" '$(SbomGenerationBuildComponentPath)' == '' ">$(MSBuildProjectDirectory)</SbomGenerationBuildComponentPath>
     <SbomGenerationPackageSupplier Condition=" '$(SbomGenerationPackageSupplier)' == '' And $(Authors) != '' ">$(Authors)</SbomGenerationPackageSupplier>
     <SbomGenerationPackageSupplier Condition=" '$(SbomGenerationPackageSupplier)' == '' And $(Authors) == '' ">$(AssemblyName)</SbomGenerationPackageSupplier>
@@ -47,12 +39,27 @@
     <SbomGenerationVerbosity Condition=" '$(SbomGenerationVerbosity)' == '' ">information</SbomGenerationVerbosity>
     <SbomGenerationManifestInfo Condition=" '$(SbomGenerationManifestInfo)' == '' ">SPDX:2.2</SbomGenerationManifestInfo>
     <SbomGenerationDeleteManifestDirIfPresent Condition=" '$(SbomGenerationDeleteManifestDirIfPresent)' == '' ">true</SbomGenerationDeleteManifestDirIfPresent>
+    <UnzipGuid>$([System.Guid]::NewGuid())</UnzipGuid>
   </PropertyGroup>
 
-  <Target Name="GenerateSbomTarget" AfterTargets="Build" Condition=" '$(GenerateSBOM)' ==  'true'">
+  <!-- After the Nuget Package is generated, we will unzip, scan, generate the SBOM and zip again. -->
+  <Target Name="GenerateSbomTarget" AfterTargets="Pack" Condition=" '$(GenerateSBOM)' ==  'true'" >
     <Error Condition="'$(BuildOutputTargetFolder)' == ''" Text="The GenerationSbomTarget requires the BuildOutputTargetFolder property to be non-null. Please set a folder name."/>
+
+    <!-- Unzip Nuget package, so it can be scanned by the SBOM Task. -->
+    <PropertyGroup>
+      <NugetPackage>
+        $(PackageOutputPath)\$(PackageId).$(PackageVersion).nupkg
+      </NugetPackage>
+      <NugetPackageUnzip>
+        $(PackageOutputPath)\$(PackageId).$(PackageVersion).$(UnzipGuid).temp
+      </NugetPackageUnzip>
+    </PropertyGroup>
+    <Unzip DestinationFolder="$(NugetPackageUnzip)" SourceFiles="$(NugetPackage)" OverwriteReadOnlyFiles="true" />
+
+    <!-- Call the SBOM Task to generate a SBOM. -->
     <GenerateSbom
-        BuildDropPath="$(SbomGenerationBuildDropPath)"
+        BuildDropPath="$(NugetPackageUnzip)"
         BuildComponentPath="$(SbomGenerationBuildComponentPath)"
         PackageSupplier="$(SbomGenerationPackageSupplier)"
         PackageName="$(SbomGenerationPackageName)"
@@ -70,20 +77,9 @@
       <Output TaskParameter="SbomPath" PropertyName="SbomPathResult" />
     </GenerateSbom>
     <Message Importance="High" Text="Task result: $(SbomPathResult)" />
-  </Target>
 
-  <!-- Specify the SBOM files to copy into the nuget package -->
-  <Target Name="CopySbomOutput" DependsOnTargets="GenerateSbomTarget">
-    <PropertyGroup>
-      <!--When building frameworks such as net8.0-windows, the platform version is appended to the framework in the NuGet package-->
-      <TargetFrameworkWithPlatformVersion Condition="$(TargetPlatformVersion) != ''">$(TargetFramework)$(TargetPlatformVersion)</TargetFrameworkWithPlatformVersion>
-      <TargetFrameworkWithPlatformVersion Condition="$(TargetPlatformVersion) == ''">$(TargetFramework)</TargetFrameworkWithPlatformVersion>
-    </PropertyGroup>
-    <ItemGroup>
-      <!--Add manifest and SHA file from the GenerateSbom target execution-->
-      <TfmSpecificPackageFile Include="$([System.IO.Path]::Combine($(SbomPathResult),$(SbomSpecification)))\**">
-        <PackagePath>$([System.IO.Path]::Combine($(BuildOutputTargetFolder),$(TargetFrameworkWithPlatformVersion),$(ManifestFolderName),$(SbomSpecification)))</PackagePath>
-      </TfmSpecificPackageFile>
-    </ItemGroup>
+    <!-- Zip the Nuget package back up and delete the temporary unzipped package. -->
+    <ZipDirectory SourceDirectory="$(NugetPackageUnzip)" DestinationFile="$(NugetPackage)" Overwrite="true" />
+    <RemoveDir Directories="$(NugetPackageUnzip)" ContinueOnError="true" />
   </Target>
 </Project>