Summary
The release artifacts contain no SBOM (CycloneDX or SPDX). Only .deps.json ships, which is .NET-specific runtime metadata and not a supply-chain SBOM. Enterprise consumers cannot programmatically verify transitive dependencies or scan bundled native code (SQLite, SQLitePCLRaw) for CVEs.
Evidence
- No
cdidx.sbom.json or *.cdx.json / *.spdx.json in the release pipeline.
dotnet pack output ships only .deps.json.
Impact
- Compliance reviews (SOC2, FedRAMP-style) cannot accept the artifact without a separately produced SBOM.
- Security scanners (Snyk, Trivy, Grype) need an SBOM for accurate vulnerability surfacing.
Proposed direction
- Add CycloneDX generation step (
dotnet CycloneDX global tool or CycloneDX.NET MSBuild task) to the release workflow.
- Ship
cdidx.sbom.cdx.json as a release asset, list every transitive package version and the bundled e_sqlite3 native asset hash.
- Document SBOM location in README under "Verifying releases."
Repro env
- Branch:
main @ 2ee912d (release v1.21.0)
Summary
The release artifacts contain no SBOM (CycloneDX or SPDX). Only
.deps.jsonships, which is .NET-specific runtime metadata and not a supply-chain SBOM. Enterprise consumers cannot programmatically verify transitive dependencies or scan bundled native code (SQLite, SQLitePCLRaw) for CVEs.Evidence
cdidx.sbom.jsonor*.cdx.json/*.spdx.jsonin the release pipeline.dotnet packoutput ships only.deps.json.Impact
Proposed direction
dotnet CycloneDXglobal tool orCycloneDX.NETMSBuild task) to the release workflow.cdidx.sbom.cdx.jsonas a release asset, list every transitive package version and the bundlede_sqlite3native asset hash.Repro env
main@ 2ee912d (release v1.21.0)