.NET Core-Support

[ckotzbauer]

What would you like to be added:
Hi Syft-Team,
are there any plans to support generating SBOMs for .NET Core projects?

Why is this needed:
.NET Core is a widely used ecosystem.

Additional context:

[luhring]

Hi @ckotzbauer, I'd love to see this! I don't have much experience with .NET Core personally. It'd be good for us to capture the details of what we'd need to scan here in the issue.

[ckotzbauer]

@luhring
I have a couple of questions in mind for that:

• Should the cataloguing happen only in compiled state or from source too? (When source is relevant too, this would be better to handle with Support cataloging NuGet packages #373)
• What information is needed to generate a spec-compliant SBOM? Dependencies, Versions, Licenses, ...

When the project is compiled, I think the most important thing would be the .deps.json file which is generated from dotnet and placed at the compilation-target dir.

This is a very basic example from the microsoft docs (e.g. Package licenses are not covered there):

{
  "runtimeTarget": {
    "name": ".NETCoreApp,Version=v3.0",
    "signature": ""
  },
  "compilationOptions": {},
  "targets": {
    ".NETCoreApp,Version=v3.0": {
      "store.manifest/1.0.0": {
        "dependencies": {
          "StartupDiagnostics": "1.0.0"
        },
        "runtime": {
          "store.manifest.dll": {}
        }
      },
      "StartupDiagnostics/1.0.0": {
        "runtime": {
          "lib/netcoreapp3.0/StartupDiagnostics.dll": {
            "assemblyVersion": "1.0.0.0",
            "fileVersion": "1.0.0.0"
          }
        }
      }
    }
  },
  "libraries": {
    "store.manifest/1.0.0": {
      "type": "project",
      "serviceable": false,
      "sha512": ""
    },
    "StartupDiagnostics/1.0.0": {
      "type": "package",
      "serviceable": true,
      "sha512": "sha512-xrhzuNSyM5/f4ZswhooJ9dmIYLP64wMnqUJSyTKVDKDVj5T+qtzypl8JmM/aFJLLpYrf0FYpVWvGujd7/FfMEw==",
      "path": "startupdiagnostics/1.0.0",
      "hashPath": "startupdiagnostics.1.0.0.nupkg.sha512"
    }
  }
}

[ckotzbauer]

@luhring Opened a PR #951 with initial support