Sbom Management

SBOM Formats

CycloneDX (Recommended)

Basic Structure

{
  "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "version": 1,
  "serialNumber": "urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79",
  "metadata": {
    "timestamp": "2025-01-15T10:30:00Z",
    "tools": [
      {
        "vendor": "CycloneDX",
        "name": "cyclonedx-dotnet",
        "version": "3.0.0"
      }
    ],
    "component": {
      "type": "application",
      "name": "MyApplication",
      "version": "1.0.0"
    }
  },
  "components": [
    {
      "type": "library",
      "bom-ref": "pkg:nuget/[email protected]",
      "name": "Newtonsoft.Json",
      "version": "13.0.3",
      "purl": "pkg:nuget/[email protected]",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "hashes": [
        {
          "alg": "SHA-256",
          "content": "a5c9a4e..."
        }
      ]
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:nuget/[email protected]",
      "dependsOn": [
        "pkg:nuget/[email protected]"
      ]
    }
  ]
}

Component Types

application    - Standalone application
framework      - Software framework
library        - Software library
container      - Container image
operating-system
device         - Hardware device
firmware       - Device firmware
file           - Arbitrary file
machine-learning-model
data           - Data assets

.NET SBOM Generation

Using CycloneDX Tool

# Install the tool
dotnet tool install --global CycloneDX

# Generate SBOM for solution
dotnet CycloneDX MyApp.sln -o sbom.json -j

# Include dev dependencies
dotnet CycloneDX MyApp.sln -o sbom.json -j --include-dev

# Recursive for all projects
dotnet CycloneDX . -o sbom.json -j -r

Integration with Build

<!-- Add to Directory.Build.props -->
<PropertyGroup>
  <GenerateSBOM>true</GenerateSBOM>
  <SBOMFormat>CycloneDX</SBOMFormat>
</PropertyGroup>

<!-- MSBuild target -->
<Target Name="GenerateSBOM" AfterTargets="Build" Condition="'$(GenerateSBOM)'=='true'">
  <Exec Command="dotnet CycloneDX $(MSBuildProjectFullPath) -o $(OutputPath)sbom.json -j" />
</Target>

Programmatic Generation

using CycloneDX.Models;

public class SbomGenerator
{
    public Bom GenerateSbom(Project project, IEnumerable<PackageReference> packages)
    {
        var bom = new Bom
        {
            Version = 1,
            SerialNumber = $"urn:uuid:{Guid.NewGuid()}",
            Metadata = new Metadata
            {
                Timestamp = DateTime.UtcNow,
                Component = new Component
                {
                    Type = Component.Classification.Application,
                    Name = project.Name,
                    Version = project.Version
                }
            },
            Components = new List<Component>()
        };

        foreach (var pkg in packages)
        {
            bom.Components.Add(new Component
            {
                Type = Component.Classification.Library,
                BomRef = $"pkg:nuget/{pkg.Id}@{pkg.Version}",
                Name = pkg.Id,
                Version = pkg.Version,
                Purl = $"pkg:nuget/{pkg.Id}@{pkg.Version}",
                Licenses = pkg.Licenses?.Select(l => new LicenseChoice
                {
                    License = new License { Id = l }
                }).ToList()
            });
        }

        return bom;
    }
}

Vulnerability Management

VEX (Vulnerability Exploitability eXchange)

VEX documents state whether vulnerabilities apply to your product:

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "vulnerabilities": [
    {
      "id": "CVE-2023-12345",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-12345"
      },
      "ratings": [
        {
          "severity": "high",
          "score": 7.5,
          "method": "CVSSv3"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "detail": "Vulnerable code path not used in our implementation"
      },
      "affects": [
        {
          "ref": "pkg:nuget/[email protected]"
        }
      ]
    }
  ]
}

VEX States

Vulnerability Tracking Service

public class VulnerabilityTracker
{
    private readonly IVulnerabilityDatabase _vulnDb;
    private readonly ISbomRepository _sbomRepo;

    public async Task<VulnerabilityReport> ScanSbom(
        string sbomPath,
        CancellationToken ct)
    {
        var sbom = await _sbomRepo.Load(sbomPath, ct);
        var report = new VulnerabilityReport
        {
            SbomSerialNumber = sbom.SerialNumber,
            ScanTimestamp = DateTimeOffset.UtcNow
        };

        foreach (var component in sbom.Components)
        {
            var vulns = await _vulnDb.GetVulnerabilities(
                component.Purl,
                ct);

            foreach (var vuln in vulns)
            {
                report.Vulnerabilities.Add(new VulnerabilityFinding
                {
                    ComponentRef = component.BomRef,
                    ComponentName = component.Name,
                    ComponentVersion = component.Version,
                    CveId = vuln.Id,
                    Severity = vuln.Severity,
                    CvssScore = vuln.CvssScore,
                    Description = vuln.Description,
                    FixedInVersion = vuln.FixedInVersion,
                    VexStatus = DetermineVexStatus(component, vuln)
                });
            }
        }

        return report;
    }

    private VexStatus DetermineVexStatus(Component component, Vulnerability vuln)
    {
        // Check if we have an existing VEX determination
        // Otherwise mark as in_triage
        return VexStatus.InTriage;
    }
}

Supply Chain Security

SLSA (Supply-chain Levels for Software Artifacts)

Package Verification

public class PackageIntegrityVerifier
{
    public async Task<VerificationResult> VerifyPackage(
        PackageReference package,
        CancellationToken ct)
    {
        var result = new VerificationResult { Package = package };

        // Check package signature
        var signature = await GetPackageSignature(package, ct);
        if (signature != null)
        {
            result.IsSigned = true;
            result.SignatureValid = await VerifySignature(signature, ct);
            result.SignerCertificate = signature.Certificate;
        }

        // Verify hash against known-good sources
        var packageHash = await ComputePackageHash(package, ct);
        var expectedHash = await GetExpectedHash(package, ct);
        result.HashMatch = packageHash == expectedHash;

        // Check for known vulnerabilities
        result.Vulnerabilities = await ScanForVulnerabilities(package, ct);

        // Check package age and maintenance status
        result.LastUpdated = await GetLastUpdateDate(package, ct);
        result.IsDeprecated = await CheckDeprecationStatus(package, ct);

        return result;
    }
}

Dependency Pinning

<!-- Enable package lock file for reproducible builds -->
<PropertyGroup>
  <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
  <RestoreLockedMode Condition="'$(CI)' == 'true'">true</RestoreLockedMode>
</PropertyGroup>

CI/CD Integration

GitHub Actions SBOM Generation