Workaround for generating a SBOM manifest at the root level of the Nuget Package

[gustavoaca1997]

Issue

Ideally, we want a SBOM manifest that would include all the content of the Nuget Package, however it was concluded that the best way of doing this is by waiting for the .NET Team to implement a pre-compress event that we can hook in. In the meantime, it was decided to at least generate smaller SBOMs that include the binaries that are produced during build.

Unfortunately, we have encountered multiple issues, including dealing with file extensions that are not included by default in the Nuget Packages (such as .exe or .deps.json) but that were included in the SBOM manifest. This makes the SBOM not able to be validated.

Workaround

Having said that, we propose a workaround for generating a SBOM at the root level, that is able to be validated, while we wait for the pre-compress hook. The proposal consists of unzipping the Nuget Package, generating the SBOM, and zipping again.

Performance

.NET Standard project

In average, the workaround has a better performance than the original solution. I ran some performance tests using a .NET Standard project we use in production:

	Generate SBOM per framework	Generate SBOM per package (with workaround)
Avg. Time	2.95	2.85

However, in one of the performance tests, there was one outlier of 3.767 seconds for the workaround, probably due to a cold-start.

Multi-framework project

I also ran some performance tests using a dummy multi-framework project:

	Generate SBOM per framework	Generate SBOM per package (with workaround)
Avg. Time	3.15	3.16

However, there were two cold-start runs that gave outlier results:

	Generate SBOM per framework	Generate SBOM per package (with workaround)
Cold-Start Time	4.98	4.22

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 69.69%. Comparing base (d2c4dc6) to head (d41d997).

Additional details and impacted files

@@                    Coverage Diff                     @@
##           feature/sbom-targets-task     #656   +/-   ##
==========================================================
  Coverage                      69.69%   69.69%           
==========================================================
  Files                            277      277           
  Lines                           8653     8653           
  Branches                        1009     1009           
==========================================================
  Hits                            6031     6031           
  Misses                          2105     2105           
  Partials                         517      517           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[gustavoaca1997]

I've created this issue to the Nuget team: NuGet/Home#13690