SBOM

Software Bill of Materials (SBOM)

Every ReqIFSharp and ReqIFSharp.Extensions NuGet package contains a Software Bill of Materials (SBOM). It lists the components and dependencies of the package with their versions, so you can:

• see what you ship: the open source and third-party components that come with the package
• track vulnerabilities: match the components against vulnerability databases
• meet compliance requirements: audit the dependencies, for example for the EU Cyber Resilience Act or customer requirements

The SBOM is generated during the build by Microsoft.Sbom.Targets, in the SPDX 2.2 format.

Where to find it

A .nupkg file is a zip archive. The SBOM is inside it at:

_manifest/spdx_2.2/manifest.spdx.json
_manifest/spdx_2.2/manifest.spdx.json.sha256

To extract it from a package you have restored:

# Linux / macOS
unzip -p ~/.nuget/packages/reqifsharp/10.1.2/reqifsharp.10.1.2.nupkg _manifest/spdx_2.2/manifest.spdx.json > reqifsharp.spdx.json

# Windows PowerShell
Add-Type -AssemblyName System.IO.Compression.FileSystem
$package = "$env:USERPROFILE\.nuget\packages\reqifsharp\10.1.2\reqifsharp.10.1.2.nupkg"
$zip = [System.IO.Compression.ZipFile]::OpenRead($package)
$entry = $zip.GetEntry("_manifest/spdx_2.2/manifest.spdx.json")
[System.IO.Compression.ZipFileExtensions]::ExtractToFile($entry, "reqifsharp.spdx.json", $true)
$zip.Dispose()

Replace 10.1.2 with the version you use. You can also download the .nupkg from nuget.org with the "Download package" link.

Any SPDX 2.2 compatible tool can read it, for example the SPDX online tools.