Skip to content

Enable NuGet Audit and fix issues #107639

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 21 commits into from
Sep 25, 2024
Merged

Enable NuGet Audit and fix issues #107639

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
ef0df64
Enable NuGet Audit and fix issues
ericstj Sep 10, 2024
8bdf2f3
Fix package path on linux
ericstj Sep 10, 2024
8c96173
Only use live JSON from HostModel
ericstj Sep 10, 2024
69e424c
Add a couple missing assembly references
ericstj Sep 10, 2024
6408e8b
Refactor tasks dependencies
ericstj Sep 11, 2024
294f280
Fix audit warnings in tests
ericstj Sep 11, 2024
4453c4f
Remove MetadataLoadContext from WasmAppBuilder package
ericstj Sep 12, 2024
5a22046
Update Analyzer.Testing packages
ericstj Sep 12, 2024
fe775ec
Reduce exposure of Microsoft.Build.Tasks.Core
ericstj Sep 13, 2024
b84f010
Fix audit warnings that only occur on browser
ericstj Sep 13, 2024
c1d3d09
Update Asn1 used by linker analyzer tests
ericstj Sep 17, 2024
c87cdf6
Merge branch 'enableNuGetAudit' of https://github.com/ericstj/runtime…
ericstj Sep 17, 2024
a501794
React to breaking change in analyzer test SDK
ericstj Sep 17, 2024
36a7b29
Enable working DryIoc tests
ericstj Sep 17, 2024
da23192
Fix double-write when LibrariesConfiguration differs from Configuration
ericstj Sep 19, 2024
b365311
Merge branch 'main' of https://github.com/dotnet/runtime into enableN…
ericstj Sep 19, 2024
04ffd0e
Fix LibrariesConfiguration update target
ericstj Sep 20, 2024
72cedfe
Clean up references and add comments.
ericstj Sep 23, 2024
3772ac9
Make HostModel references private
ericstj Sep 23, 2024
d93f35c
Use ProjectReferenceExclusion to avoid framework project references
ericstj Sep 23, 2024
3da813d
Update src/libraries/System.Runtime.InteropServices.JavaScript/tests/…
ericstj Sep 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions NuGet.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,10 @@
<add key="dotnet10" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet10/nuget/v3/index.json" />
<add key="dotnet10-transport" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet10-transport/nuget/v3/index.json" />
</packageSources>
<auditSources>
<clear />
<add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
</auditSources>
<disabledPackageSources>
<clear />
</disabledPackageSources>
Expand Down
17 changes: 17 additions & 0 deletions eng/PackageDownloadAndReference.targets
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
<Project>

<ItemDefinitionGroup>
<PackageDownloadAndReference>
<Folder>lib/$(TargetFramework)</Folder>
<AssemblyName>%(Identity)</AssemblyName>
<Private>false</Private>
</PackageDownloadAndReference>
</ItemDefinitionGroup>

<ItemGroup>
<PackageDownload Include="@(PackageDownloadAndReference)" />
<PackageDownload Update="@(PackageDownloadAndReference)" Version="[%(Version)]"/>
<Reference Include="@(PackageDownloadAndReference->'$(NuGetPackageRoot)%(Identity)/%(Version)/%(Folder)/%(AssemblyName).dll')" />
</ItemGroup>

</Project>
12 changes: 12 additions & 0 deletions eng/Version.Details.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -402,10 +402,22 @@
</Dependency>
<!-- Necessary for source-build. This allows the package to be retrieved from previously-source-built artifacts
and flow in as dependencies of the packages produced by runtime. -->
<Dependency Name="Nuget.Frameworks" Version="6.2.4">
<Uri>https://github.com/NuGet/NuGet.Client</Uri>
<Sha>8fef55f5a55a3b4f2c96cd1a9b5ddc51d4b927f8</Sha>
</Dependency>
<Dependency Name="Nuget.Packaging" Version="6.2.4">
<Uri>https://github.com/NuGet/NuGet.Client</Uri>
<Sha>8fef55f5a55a3b4f2c96cd1a9b5ddc51d4b927f8</Sha>
</Dependency>
<Dependency Name="Nuget.ProjectModel" Version="6.2.4">
<Uri>https://github.com/NuGet/NuGet.Client</Uri>
<Sha>8fef55f5a55a3b4f2c96cd1a9b5ddc51d4b927f8</Sha>
</Dependency>
<Dependency Name="Nuget.Versioning" Version="6.2.4">
<Uri>https://github.com/NuGet/NuGet.Client</Uri>
<Sha>8fef55f5a55a3b4f2c96cd1a9b5ddc51d4b927f8</Sha>
</Dependency>
<Dependency Name="runtime.linux-arm64.Microsoft.NETCore.Runtime.Wasm.Node.Transport" Version="9.0.0-alpha.1.24175.1">
<Uri>https://github.com/dotnet/node</Uri>
<Sha>308c7d0f1fa19bd1e7b768ad13646f5206133cdb</Sha>
Expand Down
2 changes: 2 additions & 0 deletions eng/Versions.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,8 +173,10 @@
<MicrosoftBuildTasksCoreVersion>$(MicrosoftBuildVersion)</MicrosoftBuildTasksCoreVersion>
<MicrosoftBuildFrameworkVersion>$(MicrosoftBuildVersion)</MicrosoftBuildFrameworkVersion>
<MicrosoftBuildUtilitiesCoreVersion>$(MicrosoftBuildVersion)</MicrosoftBuildUtilitiesCoreVersion>
<NugetFrameworksVersion>6.2.4</NugetFrameworksVersion>
<NugetProjectModelVersion>6.2.4</NugetProjectModelVersion>
<NugetPackagingVersion>6.2.4</NugetPackagingVersion>
<NugetVersioningVersion>6.2.4</NugetVersioningVersion>
<DotnetSosVersion>7.0.412701</DotnetSosVersion>
<DotnetSosTargetFrameworkVersion>6.0</DotnetSosTargetFrameworkVersion>
<!-- Testing -->
Expand Down
4 changes: 2 additions & 2 deletions src/installer/managed/Microsoft.NET.HostModel/Microsoft.NET.HostModel.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,8 +19,8 @@
</PropertyGroup>

<ItemGroup>
<PackageReference Include="System.Reflection.Metadata" Version="$(SystemReflectionMetadataToolsetVersion)" />
<PackageReference Include="System.Text.Json" Version="$(SystemTextJsonToolsetVersion)" />
<ProjectReference Include="$(LibrariesProjectRoot)System.Reflection.Metadata\src\System.Reflection.Metadata.csproj" />
<ProjectReference Include="$(LibrariesProjectRoot)System.Text.Json\src\System.Text.Json.csproj" />
Copy link
Member

@jkoritzinsky jkoritzinsky Sep 10, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These references need to not move newer than MSBuild as this library is consumed by MSBuild tasks in the SDK (including for the .NET Framework build of the SDK targets). We can't reference live builds as a result.

Copy link
Member Author

@ericstj ericstj Sep 10, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The SDK is already on the live version of System.Text.Json for its tasks, but it seems it is not on the live version of System.Reflection.Metadata. We have another library (Microsoft.Extensions.DependencyModel) that SDK consumes with live JSON as well. I only needed to update to live STJ to fix the audit warning so I could undo the SRM change, but it feels wrong.

I'll file a follow up issue in the SDK for that. dotnet/sdk#43325

Copy link
Member

@ViktorHofer ViktorHofer Sep 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The SDK is already on the live version of System.Text.Json for its tasks

Would you mind elaborating? Last time I looked, NETFramework tasks in the SDK were using an 8.0.x version of STJ because MSBuild's binding redirects required that.

Copy link
Member Author

@ericstj ericstj Sep 18, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The SDK tasks themselves ('Microsoft.NET.Build.Tasks.dll`) reference the latest. Because it's an exact match they don't need the redirects. Other assemblies loaded by the SDK (NuGet, for example) do reference lower versions, and they rely on MSBuild's redirects, but they don't exchange types with the SDK tasks. The SDK also ships the latest STJ along side its tasks.
For example:

"C:\Program Files\dotnet\sdk\9.0.100-preview.7.24407.12\Sdks\Microsoft.NET.Sdk\tools\net472\System.Text.Json.dll" => 9.0.0.0
"C:\Program Files\dotnet\sdk\8.0.400\Sdks\Microsoft.NET.Sdk\tools\net472\System.Text.Json.dll" => 8.0.0.4

The SDK's MSBuild SDK resolver does need to stay on the VS copy of STJ because it doesn't carry a copy next to itself.
CC @marcpopMSFT

</ItemGroup>

<ItemGroup>
Expand Down
8 changes: 7 additions & 1 deletion ...rosoft.DotNet.CoreSetup.Packaging.Tests/Microsoft.DotNet.CoreSetup.Packaging.Tests.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,14 @@
</PropertyGroup>

<ItemGroup>
<PackageReference Include="NuGet.Packaging" Version="$(NugetPackagingVersion)" />
<!-- reference nuget binaries directly to avoid restoring it's package dependency closure -->
<PackageDownloadAndReference Include="NuGet.Frameworks" Version="$(NugetFrameworksVersion)" Folder="lib/netstandard2.0" Private="true" />
<PackageDownloadAndReference Include="NuGet.Packaging" Version="$(NugetPackagingVersion)" Folder="lib/netstandard2.0" Private="true" />
<PackageDownloadAndReference Include="NuGet.ProjectModel" Version="$(NugetProjectModelVersion)" Folder="lib/netstandard2.0" Private="true" />
<PackageDownloadAndReference Include="NuGet.Versioning" Version="$(NugetVersioningVersion)" Folder="lib/netstandard2.0" Private="true" />
</ItemGroup>

<Import Project="$(RepositoryEngineeringDir)PackageDownloadAndReference.targets" />

<ItemGroup>
<ProjectReference Include="..\TestUtils\TestUtils.csproj" />
Expand Down
7 changes: 5 additions & 2 deletions src/libraries/Microsoft.NETCore.Platforms/src/Microsoft.NETCore.Platforms.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,10 +41,13 @@
</ItemGroup>

<ItemGroup>
<PackageReference Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)" />
<PackageReference Include="Newtonsoft.Json" Version="$(NewtonsoftJsonVersion)" />
<PackageDownloadAndReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" Folder="ref/net472" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net472'))" />
<PackageDownloadAndReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" Folder="ref/net8.0" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net8.0'))" />
<PackageDownloadAndReference Include="Newtonsoft.Json" Version="$(NewtonsoftJsonVersion)" Folder="lib/netstandard2.0" />
</ItemGroup>

<Import Project="$(RepositoryEngineeringDir)PackageDownloadAndReference.targets" />

<UsingTask TaskName="UpdateRuntimeIdentifierGraph" AssemblyFile="$(_generateRuntimeGraphTask)"/>
<Target Name="UpdateRuntimeIdentifierGraph"
AfterTargets="Build"
Expand Down
14 changes: 11 additions & 3 deletions src/tasks/Crossgen2Tasks/Crossgen2Tasks.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,17 @@
<NoWarn>$(NoWarn),CA1050</NoWarn>
</PropertyGroup>
<ItemGroup>
<PackageReference Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)" />
<PackageReference Include="NuGet.ProjectModel" Version="$(NugetProjectModelVersion)" />
</ItemGroup>
<PackageDownloadAndReference Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildFrameworkVersion)" Folder="ref/net472" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net472'))" />
<PackageDownloadAndReference Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildFrameworkVersion)" Folder="ref/net8.0" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net8.0'))" />
<PackageDownloadAndReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" Folder="ref/net472" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net472'))" />
<PackageDownloadAndReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" Folder="ref/net8.0" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net8.0'))" />
<PackageDownloadAndReference Include="Newtonsoft.Json" Version="$(NewtonsoftJsonVersion)" Folder="lib/netstandard2.0" />
<PackageDownloadAndReference Include="NuGet.Frameworks" Version="$(NugetFrameworksVersion)" Folder="lib/netstandard2.0" />
<PackageDownloadAndReference Include="NuGet.Packaging" Version="$(NugetPackagingVersion)" Folder="lib/netstandard2.0" />
<PackageDownloadAndReference Include="NuGet.ProjectModel" Version="$(NugetProjectModelVersion)" Folder="lib/netstandard2.0" />
<PackageDownloadAndReference Include="NuGet.Versioning" Version="$(NugetVersioningVersion)" Folder="lib/netstandard2.0" />
</ItemGroup>
<Import Project="$(RepositoryEngineeringDir)PackageDownloadAndReference.targets" />
<ItemGroup>
<Content Include="Microsoft.NET.CrossGen.targets">
<CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
Expand Down
25 changes: 14 additions & 11 deletions src/tasks/installer.tasks/installer.tasks.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,19 +6,22 @@
</PropertyGroup>

<ItemGroup>
<PackageReference Include="Microsoft.Extensions.DependencyModel" Version="$(MicrosoftExtensionsDependencyModelVersion)" />
<PackageReference Include="NuGet.ProjectModel" Version="$(NugetProjectModelVersion)" />
</ItemGroup>

<ItemGroup Condition="'$(TargetFrameworkIdentifier)' == '.NETCoreApp'">
<PackageReference Include="Microsoft.Build" Version="$(MicrosoftBuildVersion)" />
<PackageReference Include="Microsoft.Build.Tasks.Core" Version="$(MicrosoftBuildTasksCoreVersion)" />
<PackageDownloadAndReference Include="Microsoft.Build" Version="$(MicrosoftBuildVersion)" Folder="ref/net472" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net472'))" />
<PackageDownloadAndReference Include="Microsoft.Build" Version="$(MicrosoftBuildVersion)" Folder="ref/net8.0" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net8.0'))" />
<PackageDownloadAndReference Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildFrameworkVersion)" Folder="ref/net472" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net472'))" />
<PackageDownloadAndReference Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildFrameworkVersion)" Folder="ref/net8.0" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net8.0'))" />
<PackageDownloadAndReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" Folder="ref/net472" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net472'))" />
<PackageDownloadAndReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" Folder="ref/net8.0" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net8.0'))" />
<PackageDownloadAndReference Include="Microsoft.Extensions.DependencyModel" Version="$(MicrosoftExtensionsDependencyModelVersion)" Folder="lib/netstandard2.0" />
<PackageDownloadAndReference Include="NuGet.Packaging" Version="$(NugetPackagingVersion)" Folder="lib/netstandard2.0" />
<PackageDownloadAndReference Include="Newtonsoft.Json" Version="$(NewtonsoftJsonVersion)" Folder="lib/netstandard2.0" />
</ItemGroup>

<ItemGroup Condition="'$(TargetFrameworkIdentifier)' == '.NETFramework'">
<PackageReference Include="System.Reflection.Metadata" Version="$(SystemReflectionMetadataToolsetVersion)" />
<Reference Include="Microsoft.Build.Framework" />
<Reference Include="Microsoft.Build.Utilities.v4.0" />
<Reference Include="Microsoft.Build" />
<PackageDownloadAndReference Include="System.Reflection.Metadata" Version="$(SystemReflectionMetadataToolsetVersion)" Folder="lib/net462" />
<PackageDownloadAndReference Include="System.Collections.Immutable" Version="$(SystemCollectionsImmutableToolsetVersion)" Folder="lib/net462" />
<Reference Include="System.Net.Http" />
</ItemGroup>

<Import Project="$(RepositoryEngineeringDir)PackageDownloadAndReference.targets" />
</Project>
10 changes: 7 additions & 3 deletions src/tools/illink/src/ILLink.Tasks/ILLink.Tasks.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,12 +50,16 @@
<ProjectReference Include="..\ILLink.RoslynAnalyzer\ILLink.RoslynAnalyzer.csproj" ReferenceOutputAssembly="false" PackAsAnalyzer="true" />
<ProjectReference Include="..\linker\Mono.Linker.csproj" Condition="'$(TargetFrameworkIdentifier)' == '.NETCoreApp'" />

<PackageReference Include="Microsoft.DotNet.Cecil" Version="$(MicrosoftDotNetCecilVersion)" />
<PackageReference Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildFrameworkVersion)" ExcludeAssets="runtime" />
<PackageReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" ExcludeAssets="runtime" />
<PackageReference Include="Microsoft.DotNet.Cecil" Version="$(MicrosoftDotNetCecilVersion)" />
<PackageDownloadAndReference Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildFrameworkVersion)" Folder="ref/net472" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net472'))" />
<PackageDownloadAndReference Include="Microsoft.Build.Framework" Version="$(MicrosoftBuildFrameworkVersion)" Folder="ref/net8.0" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net8.0'))" />
<PackageDownloadAndReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" Folder="ref/net472" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net472'))" />
<PackageDownloadAndReference Include="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" Folder="ref/net8.0" Condition="$([MSBuild]::IsTargetFrameworkCompatible('$(TargetFramework)', 'net8.0'))" />
<PackageReference Include="System.Reflection.Metadata" Version="$(SystemReflectionMetadataToolsetVersion)" Condition="'$(TargetFrameworkIdentifier)' == '.NETFramework'" />
</ItemGroup>

<Import Project="$(RepositoryEngineeringDir)PackageDownloadAndReference.targets" />

<ItemGroup>
<!--
Update all PackageReference and ProjectReference Items to have
Expand Down