News

Microsoft Pumps Out Weekly VS 2022 Previews, Open Sources SBOM Tool

• By David Ramel
• 07/29/2022

As July winded down, Microsoft started pumping out weekly previews of Visual Studio 2022 v17.3, along with open sourcing a tool to generate a software bill of materials (SBOM), instrumental to government cybersecurity best practices guidance.

Since the dev team gave the Microsoft Teams Development Tools (Teams Toolkit) an overhaul in v17.3 Preview 3 on July 12, the pace has quickened with weekly updates that just tweak and fix things. In fact, after the first three previews shipped two or three weeks apart, Microsoft has since pushed out three previews in 14 days as things get polished up for an expected August GA debut.

The release notes for this week's Preview 5 included these items:

• Fixed a crash in the dialog that prompts users to sign in on first launch and when an upgrade requires an account to be reauthenticated.
• Updated the side by side Dev 16.11 C++ Toolset to version 14.29.30145.00. The latest version of the Dev 16.11 C++ Toolset contains important bug fixes, including fixing all remaining C++20 defect reports. For information about bug fixes, including C++20 defect reports in Dev 16.11, please see https://docs.microsoft.com/en-us/visualstudio/releases/2019/release-notes#16.11.14

The update also fixed four items reported by users on the Developer Community feedback site.

Preview 4 featured some .NET MAUI servicing updates and several fixes:

• Fix for an issue causing WinForms designer launch to fail for .NET projects on ARM64 machines.
• Fixes the contrast between the background color and a hyperlink in a dialog.
• Improve translation of text in first launch sign in dialog.
• Fixed a bug where Top Insights in the CPU Usage tool were not being localized

As versions 17.0 through 17.2 shipped roughly three months apart, with the latter landing May 10, v17.3 will probably arrive within the next few weeks.

SBOM Generation Tool
Meanwhile, July saw Microsoft open source its software bill of materials (SBOM) generation tool. The U.S. government defines an SBOM as a list of ingredients that make up software components.

It figures prominently in President Joe Biden's Executive Order on Improving the Nation's Cybersecurity that was issued last year, directing agencies to take security measures such as advancing the move to Zero Trust.

The order dictated that the government produce best practices guidance including standards, procedures or criteria regarding "providing a purchaser a Software Bill of Materials (SBOM) for each product directly or by publishing it on a public website," along with many other actions.

"Our SBOM tool is a general purpose, enterprise-proven, build-time SBOM generator," Microsoft said earlier this month in an engineering blog post. "It works across platforms including Windows, Linux, and Mac, and uses the standard Software Package Data Exchange (SPDX) format."

That SPDX specification provides the foundation for the four main SBOM sections of the open source tool:

• Document creation information: General information about the SBOM document, such as software name, SPDX license, SPDX version, who created the document, when it was created, etc.
• Files section: A list of files that compose the piece of software. Each file has some properties including the hashes of its content (SHA-1, SHA-256).
• Packages section: A list of packages used when building the software. Each package has additional properties such as name, version, supplier, hashes (SHA-1, SHA-256) and a Package URL (purl) software identifier.
• Relationships section: A list of relationships between the different elements of the SBOM, such as files and packages.

"Open sourcing our SBOM tool is an important step towards fostering collaboration and innovation within our community, and we believe this will enable more organizations to generate SBOMs as well as contribute to its development," Microsoft said.