[Microsoft.Sbom.Targets] Add target for publish

[DelphinRP]

Hello everyone,

we are currently using Microsoft.Sbom.Targets to generate SBOMs for our applications. However, we have encountered a limitation where Microsoft.Sbom.Targets only provides a target for dotnet pack.

To better support our workflow, we would like to request the addition of a target for dotnet publish. This would enable us to generate SBOMs for non-NuGet packages as well and simplify our pipelines.

The output should be the same as using the SBOM tool directly.

[KalleOlaviNiemitalo]

If you implement this, please make it easy for projects to opt out by setting some MSBuild property.

I am using Microsoft.Sbom.Targets in a project that publishes both

• binaries targeting .NET 8, in a .NET tool NuGet package that includes a SBOM; and
• binaries targeting .NET Framework, in a zip package that likewise includes a SBOM even though Microsoft.Sbom.Targets does not directly support that.

If I upgrade the Microsoft.Sbom.Targets reference in the future and the new version alters what dotnet publish does, I may have to make complex changes to this build system. I'd rather just keep this working like it does now, and opt out of any dotnet publish hooking.

[sfoslund]

Hi all, thanks for the request. We don't have bandwidth to take this on at the moment but tagging @baronfel so the .NET team is aware of this.

[baronfel]

The .NET SDK team is tracking publish support for SBOMs in this epic: dotnet/sdk#46274

Part of that will be a Publish target hook, which will adhere to the existing GenerateSBOM MSBuild property for determining if it should run. Like other scenarios where the SDK includes external capability, we'll support 'pinning' the dependency by specifying a custom property for the package version, etc.

[baronfel]

separately @DelphinRP - are you looking for specific content in your app SBOMs other than packages? Right now that's all sbom-tool supports, so if you have more needs we'll need to log, track, and prioritize that work.

[DelphinRP]

separately @DelphinRP - are you looking for specific content in your app SBOMs other than packages? Right now that's all sbom-tool supports, so if you have more needs we'll need to log, track, and prioritize that work.

Hi all,

thank you for the fast replies.

Our only dependencies and components are NuGet packages. It's just that we want to create SBOM for projects that do not generate NuGet packages themselves.

[rmannibucau]

Hi, any hope this project helps with being able to be "all green" on docker hub using plain dotnet publish? (https://docs.docker.com/scout/policy/#supply-chain-attestations / https://docs.docker.com/build/metadata/attestations/ is the target)