SBOM

[totaam]

Just like Xpra-org/xpra#4050

[TijZwa]

@totaam fyi; I'm using OWASP Dependecy Track (https://dependencytrack.org/)
I'm using the following action to feed it the SBOM:

name: Create sbom on release
on:
  push:
      branches:
        - 'main'
jobs:
  Sbom:
    runs-on: <Agent>
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - name: Create CycloneDX sbom
        run: dotnet-CycloneDX <project> -o sbom
      - name: Upload sbom
        env:
           PROJECTGUID: ${{ vars.PROJECTGUID }}
           APIKEY: ${{ secrets.API_KEY }}      
        run: |
          $xml = Get-Content ".\sbom\bom.xml" -Raw
          $ProjectGuid = $Env:PROJECTGUID
          $ApiKey = $Env:APIKEY
          $Uri = "<DepTrack server>"

          $Body = ([PSCustomObject] @{
            project = $ProjectGuid
            bom     = ([Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($xml)))
          } | ConvertTo-Json)
          $Header = @{ 'X-API-Key' = $ApiKey }
          Invoke-RestMethod -Method Put -Uri "$Uri/api/v1/bom" -Headers $Header  -ContentType "application/json" -Body $Body                                    
        shell: powershell

[CorbinWunderlich]

To keep track of the libraries that xpra-html5 uses, maybe we could use git submodules? https://git-scm.com/book/en/v2/Git-Tools-Submodules