[Internal to External Port] Templating Nuget Config Changes, MSBuild #28548
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Confirming file permissions are using 700: The first image shows the temp path created by file utilities in the biggest exploit (Nuget Packages under sudo). The second image shows the permissions on the file to be drwx-----  
…914.20 Microsoft.CodeAnalysis , Microsoft.CodeAnalysis.CSharp , Microsoft.CodeAnalysis.CSharp.CodeStyle , Microsoft.CodeAnalysis.CSharp.Features , Microsoft.CodeAnalysis.CSharp.Workspaces , Microsoft.CodeAnalysis.Workspaces.MSBuild , Microsoft.Net.Compilers.Toolset From Version 4.4.0-2.22463.8 -> To Version 4.4.0-2.22464.20
…914.7 Microsoft.SourceBuild.Intermediate.fsharp , Microsoft.FSharp.Compiler From Version 7.0.0-beta.22464.1 -> To Version 7.0.0-beta.22464.7
…50ebf938-3840-487f-87f2-49e9f2c9a073 [release/7.0.1xx-rc2] Update dependencies from dotnet/roslyn
…8e75157a-8778-42b3-bb7a-a1222f2e08e9 [release/7.0.1xx-rc2] Update dependencies from dotnet/fsharp
…0915.2 Microsoft.Build , Microsoft.Build.Localization From Version 17.4.0-preview-22464-02 -> To Version 17.4.0-preview-22465-02
…ld 20220922.10 Microsoft.WindowsDesktop.App.Ref , Microsoft.WindowsDesktop.App.Runtime.win-x64 , VS.Redist.Common.WindowsDesktop.SharedFramework.x64.7.0 , VS.Redist.Common.WindowsDesktop.TargetingPack.x64.7.0 From Version 7.0.0-rc.2.22471.7 -> To Version 7.0.0-rc.2.22472.10 Dependency coherency updates Microsoft.NET.Sdk.WindowsDesktop From Version 7.0.0-rc.2.22471.7 -> To Version 7.0.0-rc.2.22472.8 (parent: Microsoft.WindowsDesktop.App.Ref
…ld 20220922.13 Microsoft.WindowsDesktop.App.Ref , Microsoft.WindowsDesktop.App.Runtime.win-x64 , VS.Redist.Common.WindowsDesktop.SharedFramework.x64.7.0 , VS.Redist.Common.WindowsDesktop.TargetingPack.x64.7.0 From Version 7.0.0-rc.2.22471.7 -> To Version 7.0.0-rc.2.22472.13 Dependency coherency updates Microsoft.NET.Sdk.WindowsDesktop From Version 7.0.0-rc.2.22471.7 -> To Version 7.0.0-rc.2.22472.9 (parent: Microsoft.WindowsDesktop.App.Ref
…0220923.1 Microsoft.TemplateEngine.Abstractions From Version 7.0.100-rc.2.22471.7 -> To Version 7.0.100-rc.2.22473.1
…923.1 Microsoft.SourceBuild.Intermediate.fsharp , Microsoft.FSharp.Compiler From Version 7.0.0-beta.22471.6 -> To Version 7.0.0-beta.22473.1
…dc52891a-0940-4626-a007-33088aae0937 [release/7.0.1xx-rc2] Update dependencies from dotnet/runtime
…bdb2f65c-9244-4bd7-bce7-e7a507ae8c5d [release/7.0.1xx-rc2] Update dependencies from dotnet/templating
…db4b9cf3-30ed-4341-8933-e239e9f421a4 [release/7.0.1xx-rc2] Update dependencies from dotnet/windowsdesktop
…0686be38-9efd-4469-bf0c-e6f11cb30d4e [release/7.0.1xx-rc2] Update dependencies from dotnet/fsharp
…rom dnceng/internal/dotnet-aspnetcore This pull request updates the following dependencies [marker]: <> (Begin:fbc41143-1c57-423d-b8c7-08da91234a73) ## From https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore - **Subscription**: fbc41143-1c57-423d-b8c7-08da91234a73 - **Build**: 20220926.2 - **Date Produced**: September 26, 2022 5:00:54 PM UTC - **Commit**: b12b77b241f0a093d53508c3cb2084860bd5339d - **Branch**: refs/heads/internal/release/7.0-rc2 [DependencyUpdate]: <> (Begin) - **Updates**: - **dotnet-dev-certs**: [from 7.0.0-rc.2.22471.5 to 7.0.0-rc.2.22476.2][4] - **dotnet-user-jwts**: [from 7.0.0-rc.2.22471.5 to 7.0.0-rc.2.22476.2][4] - **dotnet-user-secrets**: [from 7.0.0-rc.2.22471.5 to 7.0.0-rc.2.22476.2][4] - **Microsoft.AspNetCore.Analyzers**: [from 7.0.0-rc.2.22471.5 to 7.0.0-rc.2.22476.2][4] - **Microsoft.AspNetCore.App.Ref**: [from 7.0.0-rc.2.22471.5 to 7.0.0-rc.2.22476.2][4] - **Microsoft.AspNetCore.App.Ref.Internal**: [from 7.0.0-rc.2.22471.5 to 7.0.0-rc.2.22476.2][4] - **Microsoft.AspNetCore.App.Runtime.win-x64**: [from 7.0.0-rc.2.22471.5 to 7.0.0-rc.2.22476.2][4] - **Microsoft.AspNetCore.Authorization**: [from 7.0.0-rc.2.22471.5 to 7.0.0-rc.2.22476.2][4] - **Microsoft.AspNetCore.Components.SdkAnalyzers**: [from 7.0.0-rc.2.22471.5 to 7.0.0-rc.2.22476.2][4] - **Microsoft.AspNetCore.Components.Web**: [from 7.0.0-rc.2.22471.5 to 7.0.0-rc.2.22476.2][4] - **Microsoft.AspNetCore.DeveloperCertificates.XPlat**: [from 7.0.0-rc.2.22471.5 to 7.0.0-rc.2.22476.2][4] - **Microsoft.AspNetCore.Mvc.Analyzers**: [from 7.0.0-rc.2.22471.5 to 7.0.0-rc.2.22476.2][4] - **Microsoft.AspNetCore.Mvc.Api.Analyzers**: [from 7.0.0-rc.2.22471.5 to 7.0.0-rc.2.22476.2][4] - **Microsoft.AspNetCore.TestHost**: [from 7.0.0-rc.2.22471.5 to 7.0.0-rc.2.22476.2][4] - **Microsoft.Extensions.FileProviders.Embedded**: [from 7.0.0-rc.2.22471.5 to 7.0.0-rc.2.22476.2][4] - **Microsoft.JSInterop**: [from 7.0.0-rc.2.22471.5 to 7.0.0-rc.2.22476.2][4] - **VS.Redist.Common.AspNetCore.SharedFramework.x64.7.0**: [from 7.0.0-rc.2.22471.5 to 7.0.0-rc.2.22476.2][4] [4]: https://dev.azure.com/dnceng/internal/_git/dotnet-aspnetcore/branches?baseVersion=GC697875c&targetVersion=GCb12b77b&_a=files [DependencyUpdate]: <> (End) [marker]: <> (End:fbc41143-1c57-423d-b8c7-08da91234a73)
The commit linked above overwrites other commits because the current version in |
Makes sense, that's what I figured. Thank you for confirming 😄 |
I'm a bit surprised by this, since it looks like the changes (at least the one I looked at) went in 17 hours ago, so you'd think it'd be up-to-date by now. I noticed there are conflicts, so maybe it has something to do with that?
Sorry, what am I confirming? |
Basically if there are any missing components from MSBuild side or if it looks good to you, as well as with the insertions. I think it doesn't matter if public MSBuild is updated? |
…internal-msrc-mirror
|
And the merge conflicts did not exist until a few minutes ago when some code flow from 7.0.1xx went in, though it's a good hypothesis, fixing the merge conflicts updated GH to realize that the files weren't changed! |
|
It looks like release/7.0.1xx is currently on 0a4ea3, which corresponds to the latest commit in vs17.4 MSBuild, which is correct, so I think this looks good from my side 👍 |
JanKrivanek
approved these changes
Oct 13, 2022
|
@marcpopMSFT we have confirmation now from all relevant parties |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This ports more of the security changes we did internally for the now public MSRC
Not sure if we need to preserve the change to nuget-client trusted. @kartheekp-ms is getting back on that * 59fa9ca --> We're OK here.
Why is the diff showing changes to eng\versions when they actually reflect what is currently in the release/7.0.1xx branch? Might be a GH bug ? --> Yes it's a github bug.
We may want to have template engine confirm that we don't need to downgrade ubuntu and any of their dependency changes have gone in related to the changes here @dotnet/templating-engine-maintainers --> This is due to changes internally and should be fine, OK
Getting confirmation from MSBuild side @Forgind --> OK