[ci] Include build components in SBOM

[pjcollins]

Context: https://github.com/xamarin/yaml-templates/pull/263

Updates the main SBOM file we produce to include build component info
from both the macOS and Linux builds. These two builds will now produce
build component SBOMs which are downloaded and referenced in our main
SBOM afer all building and signing is complete.

[pjcollins]

Testing this with https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=8036618&view=results.

In a future PR, we can try to add build dependencies to the SBOM as well via the referencing-other-sboms-inside-the-current-sbom docs.

[pjcollins]

New test run: https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=8037829&view=results

[jonathanpeppers]

Will this fix the SBOM check on VS insertions? Like this one:

https://devdiv.visualstudio.com/DevDiv/_workitems/edit/1848417/

[jonpryor]

@pjcollins: the "big picture" question: what should we be doing, vs. what we are doing?

My (wrong?) understanding is that a Software Bill of Materials should include e.g.:

• Source: SBOM created directly from the development environment, source files, and included dependencies used to build an product artifact.
• Build: SBOM generated as part of the process of building the software to create a releasable artifact (e.g., executable or package) from data such as source files, dependencies, built components, build process ephemeral data, and other SBOMs.

I thus infer that the SBOM should list every NuGet package that we build against and/or redistribute. This would include Newtonsoft.Json.dll and Irony.dll, among (many!) others.

Compare to what we actually produce, even from your latest build, and I don't see any such NuGet inputs. (I'm checking in the wrong place?) For example, the sbom/_manifest/manifest.json file mentions multiple .msi (ae1796c1a80f210c3d79965ad4a89a40-x86.msi) and .nupkg files (Microsoft.Android.Runtime.34.android-arm.34.0.0-ci.dev-pjc-sbom-content.369.nupkg), but neither "Newtonsoft" nor "Irony" is present in the file.

Is my meta-understanding wrong? Should Newtonsoft & Irony be mentioned in the SBOM? Should they not be mentioned (insert reason why)?

[pjcollins]

Will this fix the SBOM check on VS insertions? Like this one:

https://devdiv.visualstudio.com/DevDiv/_workitems/edit/1848417/

Unfortunately no. As far I as know there is arcade work planned to support this for all .NET workloads, though it has been pending for quite a while... We should check with the .NET SDK and/or .NET Eng teams on the status of this.

---

@pjcollins: the "big picture" question: what should we be doing, vs. what we are doing?

My (wrong?) understanding is that a Software Bill of Materials should include e.g.:

• Source: SBOM created directly from the development environment, source files, and included dependencies used to build an product artifact.
• Build: SBOM generated as part of the process of building the software to create a releasable artifact (e.g., executable or package) from data such as source files, dependencies, built components, build process ephemeral data, and other SBOMs.

I thus infer that the SBOM should list every NuGet package that we build against and/or redistribute. This would include Newtonsoft.Json.dll and Irony.dll, among (many!) others.

Compare to what we actually produce, even from your latest build, and I don't see any such NuGet inputs. (I'm checking in the wrong place?) For example, the sbom/_manifest/manifest.json file mentions multiple .msi (ae1796c1a80f210c3d79965ad4a89a40-x86.msi) and .nupkg files (Microsoft.Android.Runtime.34.android-arm.34.0.0-ci.dev-pjc-sbom-content.369.nupkg), but neither "Newtonsoft" nor "Irony" is present in the file.

Is my meta-understanding wrong? Should Newtonsoft & Irony be mentioned in the SBOM? Should they not be mentioned (insert reason why)?

I forgot to convert this to draft earlier, as the SBOM task is still not behaving as I would expect. By my understanding our SBOM needs to contain metadata about the following:

Build Outputs

• Packages that are distributed (e.g. NUPKG, MSI)
• Contents of the packages that are distributed (e.g. Xamarin.Android.Build.Tasks.dll)

Build Inputs

• List of dependencies required to produce the outputs above (sources, NuGets, etc)

This PR aims to address inclusion of all Build Outputs information. We currently include packages in our SBOM, but not the contents of those packages. That's where this PR comes in.

I plan on addressing the Build Inputs portion of the requirements in a future PR, hopefully by producing a different SBOM during the build job that can be referenced by the "Outputs" SBOM produced by this PR.

@mjbond-msft @mrward do the requirements I've mentioned above match your expectations? Feel free to continue this conversation offline if that will be easier.

[pjcollins]

I haven't received a clear response on whether or not we need to include both shipping packages and the contents of the shipping packages in the SBOM, so I'll remove those changes for now.

The PR will now produce "build components" SBOMs during the mac and linux builds, and download and reference them when creating the main sbom file.

[pjcollins]

Latest test: https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=8070372&view=results