Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Microsoft.Sbom.Targets] Generate SbomGenerationPackageVersion with Nerdbank.GitVersioning #716

Open
Tracked by #693
KalleOlaviNiemitalo opened this issue Sep 19, 2024 · 1 comment
Labels
.NET Pull requests that update .net code

Comments

@KalleOlaviNiemitalo
Copy link

The version number generated by Nerdbank.GitVersioning 3.6.133 does not automatically propagate into the SBOM file generated by Microsoft.Sbom.Targets 2.2.8, which instead defaults to version 1.0.0. I put this thing in my project to fix that:

  <Target Name="SetSbomProperties" BeforeTargets="GenerateSbomTarget" DependsOnTargets="GetBuildVersion">
    <PropertyGroup>
      <SbomGenerationPackageVersion>$(NuGetPackageVersion)</SbomGenerationPackageVersion>
    </PropertyGroup>
  </Target>

but it would be nice if it worked out of the box.

Originally posted by @KalleOlaviNiemitalo in #693 (comment)

@sfoslund sfoslund added the needs triage Default status upon issue submission label Sep 20, 2024
@KalleOlaviNiemitalo
Copy link
Author

Based on #693 (comment) and #693 (comment), I think this should be fixed by moving the default values of almost all SBOM-generation properties (but not the GenerateSBOM property) from the top-level PropertyGroup to a new target SetSbomGenerationProperties, on which GenerateSbomTarget would depend; and SetSbomGenerationProperties would depend on GetBuildVersion. That way, if a custom target for non-NuGet packaging uses the GenerateSbom task, it could likewise depend on the SetSbomGenerationProperties target and share the defaulting logic. Other NuGet packages could update the properties in a target that has AfterTargets="SetSbomGenerationProperties", e.g. if they needed to add parameters for some component detectors.

@sfoslund sfoslund added .NET Pull requests that update .net code and removed needs triage Default status upon issue submission labels Sep 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
.NET Pull requests that update .net code
Projects
None yet
Development

No branches or pull requests

2 participants