Morning,
Has anyone successfully generated a SBOM for a Unity Project ?
I have been researching a how to or a starting guide that specifically talks about how a SBOM can be generated. No luck.
I know I can look at the packages-lock.json but is that sufficient.
Would appreciate any help here.
It looks like that file only includes built-in editor modules and packages installed in the package manager. Looks like it doesn’t include anything from the Asset Store and it won’t include any third-party libraries that you add yourself.
Yeah , you are not wrong on that. Trying to figure out this SBOM for a game engine is a bit of a cumbersome process.
The Package Manager does show you installed packages but by modifying assets you can surely cause it to loose track of them.
Fear that is manual work the dev or reviewer has to do. One can surely make it easier with internal policies like saying that all imported assets need to be placed in a specific directory so it’s immediately obvious.
That is true. However, in my case this is an already existing project. So its a game of catch up. Outside of the items listed in the .json do we have any idea what other dependencies Unity would have ? Hard to tell since it all gets packaged up.
UPM packages and custom UPM packages are okay, you can get the list and the dependencies from the packages-lock.json, the problem is with any (if you have any) Asset Store packages, because those are not registered packages prior to 2023.3 alpha. So you have no way of reliably knowing if any AS package is needed for your project without preexisting documentation or a human with that knowledge.
You have the downloaded packages in a folder on your computer (asset store cache), but that only shows what asset store packages were downloaded on the given computer, regardless of your project.