From fda44ee81fc258f85338d98ac3f6064df9963a3c Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" <42748379+dotnet-maestro[bot]@users.noreply.github.com> Date: Mon, 8 Sep 2025 09:11:15 +0000 Subject: [PATCH 1/9] [vs17.8] Update dependencies from dotnet/arcade (#12497) This pull request updates the following dependencies [marker]: <> (Begin:5f9c9524-456b-43ca-a978-063daaf53c38) ## From https://github.com/dotnet/arcade - **Subscription**: [5f9c9524-456b-43ca-a978-063daaf53c38](https://maestro.dot.net/subscriptions?search=5f9c9524-456b-43ca-a978-063daaf53c38) - **Build**: [20250905.3](https://dev.azure.com/dnceng/internal/_build/results?buildId=2787027) ([282118](https://maestro.dot.net/channel/3885/github:dotnet:arcade/build/282118)) - **Date Produced**: September 5, 2025 2:36:46 PM UTC - **Commit**: [09625cb3b98ebe646a63dfea19a0c0127e88459a](https://github.com/dotnet/arcade/commit/09625cb3b98ebe646a63dfea19a0c0127e88459a) - **Branch**: [release/8.0](https://github.com/dotnet/arcade/tree/release/8.0) [DependencyUpdate]: <> (Begin) - **Updates**: - From [8.0.0-beta.25427.4 to 8.0.0-beta.25455.3][1] - Microsoft.DotNet.Arcade.Sdk - Microsoft.DotNet.XUnitExtensions [1]: https://github.com/dotnet/arcade/compare/6e78cc9faf...09625cb3b9 [DependencyUpdate]: <> (End) - **Updates to .NET SDKs:** - Updates tools.dotnet to 8.0.119 [marker]: <> (End:5f9c9524-456b-43ca-a978-063daaf53c38) --------- Co-authored-by: dotnet-maestro[bot] Co-authored-by: Gang Wang --- eng/Version.Details.xml | 8 ++++---- eng/Versions.props | 5 ++--- global.json | 2 +- 3 files changed, 7 insertions(+), 8 deletions(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 3b2a7be34df..746466c29fc 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -58,9 +58,9 @@ - + https://github.com/dotnet/arcade - 6e78cc9faf0ab29992b01007d71519655344e74c + 09625cb3b98ebe646a63dfea19a0c0127e88459a @@ -77,9 +77,9 @@ dc3d0694a4b31b8e27038431888cd4e8dd5b6cb6 - + https://github.com/dotnet/arcade - 6e78cc9faf0ab29992b01007d71519655344e74c + 09625cb3b98ebe646a63dfea19a0c0127e88459a diff --git a/eng/Versions.props b/eng/Versions.props index fdf8f2a93cc..ea3d526eebd 100644 --- a/eng/Versions.props +++ b/eng/Versions.props @@ -2,12 +2,11 @@ - 17.8.41 + 17.8.42 release 17.7.0 15.1.0.0 servicing - test @@ -52,7 +51,7 @@ Otherwise, this version of dotnet will not be installed and the build will error out. --> $([System.Text.RegularExpressions.Regex]::Match($([System.IO.File]::ReadAllText('$(MSBuildThisFileDirectory)..\global.json')), '"dotnet": "([^"]*)"').Groups.get_Item(1)) 4.2.0-1.22102.8 - 8.0.0-beta.25427.4 + 8.0.0-beta.25455.3 7.0.0 6.0.0 4.8.0-3.23465.5 diff --git a/global.json b/global.json index 6075e605e2a..f8d445476ae 100644 --- a/global.json +++ b/global.json @@ -10,6 +10,6 @@ "xcopy-msbuild": "17.8.5" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.25427.4" + "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.25455.3" } } From a5c19d0bee6a70fca29dbca37671f76f0e22a0da Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" <42748379+dotnet-maestro[bot]@users.noreply.github.com> Date: Mon, 8 Sep 2025 09:31:59 +0000 Subject: [PATCH 2/9] [vs17.11] Update dependencies from dotnet/arcade (#12499) This pull request updates the following dependencies [marker]: <> (Begin:aca86521-13b3-4d28-a005-127af3b681e5) ## From https://github.com/dotnet/arcade - **Subscription**: [aca86521-13b3-4d28-a005-127af3b681e5](https://maestro.dot.net/subscriptions?search=aca86521-13b3-4d28-a005-127af3b681e5) - **Build**: [20250905.3](https://dev.azure.com/dnceng/internal/_build/results?buildId=2787027) ([282118](https://maestro.dot.net/channel/3885/github:dotnet:arcade/build/282118)) - **Date Produced**: September 5, 2025 2:36:46 PM UTC - **Commit**: [09625cb3b98ebe646a63dfea19a0c0127e88459a](https://github.com/dotnet/arcade/commit/09625cb3b98ebe646a63dfea19a0c0127e88459a) - **Branch**: [release/8.0](https://github.com/dotnet/arcade/tree/release/8.0) [DependencyUpdate]: <> (Begin) - **Updates**: - From [8.0.0-beta.25427.4 to 8.0.0-beta.25455.3][1] - Microsoft.SourceBuild.Intermediate.arcade - Microsoft.DotNet.Arcade.Sdk - Microsoft.DotNet.XUnitExtensions [1]: https://github.com/dotnet/arcade/compare/6e78cc9faf...09625cb3b9 [DependencyUpdate]: <> (End) [marker]: <> (End:aca86521-13b3-4d28-a005-127af3b681e5) --------- Co-authored-by: dotnet-maestro[bot] Co-authored-by: Gang Wang --- eng/Version.Details.xml | 12 ++++++------ eng/Versions.props | 5 ++--- global.json | 2 +- 3 files changed, 9 insertions(+), 10 deletions(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 9a7e4580f8b..0a2c8d83d5a 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -71,14 +71,14 @@ - + https://github.com/dotnet/arcade - 6e78cc9faf0ab29992b01007d71519655344e74c + 09625cb3b98ebe646a63dfea19a0c0127e88459a - + https://github.com/dotnet/arcade - 6e78cc9faf0ab29992b01007d71519655344e74c + 09625cb3b98ebe646a63dfea19a0c0127e88459a @@ -100,9 +100,9 @@ 0b8371953e61f6179f39f1d62ebbd6a251f335e0 - + https://github.com/dotnet/arcade - 6e78cc9faf0ab29992b01007d71519655344e74c + 09625cb3b98ebe646a63dfea19a0c0127e88459a diff --git a/eng/Versions.props b/eng/Versions.props index 52ac56858e0..19e33342ea0 100644 --- a/eng/Versions.props +++ b/eng/Versions.props @@ -2,12 +2,11 @@ - 17.11.46 + 17.11.47 release 17.10.4 15.1.0.0 servicing - test @@ -55,7 +54,7 @@ Otherwise, this version of dotnet will not be installed and the build will error out. --> $([System.Text.RegularExpressions.Regex]::Match($([System.IO.File]::ReadAllText('$(MSBuildThisFileDirectory)..\global.json')), '"dotnet": "([^"]*)"').Groups.get_Item(1)) 4.2.0-1.22102.8 - 8.0.0-beta.25427.4 + 8.0.0-beta.25455.3 7.0.0 6.0.1 4.11.0-3.24313.9 diff --git a/global.json b/global.json index 1f9f85b5511..8345416cd57 100644 --- a/global.json +++ b/global.json @@ -10,6 +10,6 @@ "xcopy-msbuild": "17.8.5" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.25427.4" + "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.25455.3" } } From e71ee2d1051ea6c9c254d4be138fbb36be653fd8 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" <42748379+dotnet-maestro[bot]@users.noreply.github.com> Date: Mon, 8 Sep 2025 10:53:43 +0000 Subject: [PATCH 3/9] [vs17.10] Update dependencies from dotnet/arcade (#12501) This pull request updates the following dependencies [marker]: <> (Begin:42961865-e7dd-40be-a923-7af2e4664f80) ## From https://github.com/dotnet/arcade - **Subscription**: [42961865-e7dd-40be-a923-7af2e4664f80](https://maestro.dot.net/subscriptions?search=42961865-e7dd-40be-a923-7af2e4664f80) - **Build**: [20250905.3](https://dev.azure.com/dnceng/internal/_build/results?buildId=2787027) ([282118](https://maestro.dot.net/channel/3885/github:dotnet:arcade/build/282118)) - **Date Produced**: September 5, 2025 2:36:46 PM UTC - **Commit**: [09625cb3b98ebe646a63dfea19a0c0127e88459a](https://github.com/dotnet/arcade/commit/09625cb3b98ebe646a63dfea19a0c0127e88459a) - **Branch**: [release/8.0](https://github.com/dotnet/arcade/tree/release/8.0) [DependencyUpdate]: <> (Begin) - **Updates**: - From [8.0.0-beta.25427.4 to 8.0.0-beta.25455.3][1] - Microsoft.SourceBuild.Intermediate.arcade - Microsoft.DotNet.Arcade.Sdk - Microsoft.DotNet.XUnitExtensions [1]: https://github.com/dotnet/arcade/compare/6e78cc9faf...09625cb3b9 [DependencyUpdate]: <> (End) [marker]: <> (End:42961865-e7dd-40be-a923-7af2e4664f80) --------- Co-authored-by: dotnet-maestro[bot] Co-authored-by: Gang Wang --- eng/Version.Details.xml | 12 ++++++------ eng/Versions.props | 5 ++--- global.json | 2 +- 3 files changed, 9 insertions(+), 10 deletions(-) diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 59de96de4d5..3f69007fb84 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -67,14 +67,14 @@ - + https://github.com/dotnet/arcade - 6e78cc9faf0ab29992b01007d71519655344e74c + 09625cb3b98ebe646a63dfea19a0c0127e88459a - + https://github.com/dotnet/arcade - 6e78cc9faf0ab29992b01007d71519655344e74c + 09625cb3b98ebe646a63dfea19a0c0127e88459a @@ -96,9 +96,9 @@ 919d4dbfb0dffb35a702417e28ceea652d248bc6 - + https://github.com/dotnet/arcade - 6e78cc9faf0ab29992b01007d71519655344e74c + 09625cb3b98ebe646a63dfea19a0c0127e88459a diff --git a/eng/Versions.props b/eng/Versions.props index 4200c6015f4..5546a3e0f8d 100644 --- a/eng/Versions.props +++ b/eng/Versions.props @@ -2,12 +2,11 @@ - 17.10.44 + 17.10.45 release 17.8.3 15.1.0.0 servicing - test @@ -53,7 +52,7 @@ Otherwise, this version of dotnet will not be installed and the build will error out. --> $([System.Text.RegularExpressions.Regex]::Match($([System.IO.File]::ReadAllText('$(MSBuildThisFileDirectory)..\global.json')), '"dotnet": "([^"]*)"').Groups.get_Item(1)) 4.2.0-1.22102.8 - 8.0.0-beta.25427.4 + 8.0.0-beta.25455.3 7.0.0 6.0.0 4.10.0-3.24175.2 diff --git a/global.json b/global.json index 1f9f85b5511..8345416cd57 100644 --- a/global.json +++ b/global.json @@ -10,6 +10,6 @@ "xcopy-msbuild": "17.8.5" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.25427.4" + "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.25455.3" } } From aa888d3214e5adb503c48c3bad2bfc6c5aff638a Mon Sep 17 00:00:00 2001 From: Jan Provaznik Date: Mon, 15 Sep 2025 10:49:59 +0000 Subject: [PATCH 4/9] Merged PR 668397: [vs17.10] Recreate temp on linux using CreateTempSubdirectory on every build Recreate temp on linux using CreateTempSubdirectory on every build ---- #### AI description (iteration 1) #### PR Classification Bug fix addressing a Linux-specific temporary folder security vulnerability. #### PR Summary This pull request enhances security in MSBuild on Linux by replacing the manual temporary folder creation logic with a reliable call to CreateTempSubdirectory, ensuring a unique and correctly set up temp folder on every build. - `src/Shared/TempFileUtilities.cs`: On Linux, the temp folder is now recreated via Directory.CreateTempSubdirectory instead of custom mkdir/chmod logic. - `src/Shared/TempFileUtilities.cs`: Removed the unused `userRWX` constant, cleaning up the code. ---- #### AI description (iteration 2) #### PR Classification This pull request is a security fix that updates the temporary folder creation mechanism on Linux. #### PR Summary The PR replaces the insecure native mkdir/chmod approach with a safer Directory.CreateTempSubdirectory method for Linux, ensuring that the temporary folder is freshly created on every build and addressing the risk of malicious folder creation. - **`src/Shared/TempFileUtilities.cs`**: Replaces the complex mkdir/chmod logic with a call to Directory.CreateTempSubdirectory for Linux and removes the obsolete userRWX constant. - **`eng/Versions.props`**: Increments the version prefix to reflect the update. Related work items: #2541147 --- eng/Versions.props | 4 ++-- src/Shared/TempFileUtilities.cs | 36 ++++++++------------------------- 2 files changed, 10 insertions(+), 30 deletions(-) diff --git a/eng/Versions.props b/eng/Versions.props index 5546a3e0f8d..c20a77c8cad 100644 --- a/eng/Versions.props +++ b/eng/Versions.props @@ -2,12 +2,12 @@ - 17.10.45 + 17.10.46 release 17.8.3 15.1.0.0 servicing - test true diff --git a/src/Shared/TempFileUtilities.cs b/src/Shared/TempFileUtilities.cs index 190f0dddf2b..db69ddd3dad 100644 --- a/src/Shared/TempFileUtilities.cs +++ b/src/Shared/TempFileUtilities.cs @@ -18,7 +18,6 @@ internal static partial class FileUtilities { // For the current user, these correspond to read, write, and execute permissions. // Lower order bits correspond to the same for "group" or "other" users. - private const int userRWX = 0x100 | 0x80 | 0x40; private static string tempFileDirectory = null; private const string msbuildTempFolderPrefix = "MSBuildTemp"; @@ -38,40 +37,21 @@ internal static void ClearTempFileDirectory() // For all native calls, directly check their return values to prevent bad actors from getting in between checking if a directory exists and returning it. private static string CreateFolderUnderTemp() { - // On windows Username with Unicode chars can give issues, so we dont append username to the temp folder name. - string msbuildTempFolder = NativeMethodsShared.IsWindows ? - msbuildTempFolderPrefix : - msbuildTempFolderPrefix + Environment.UserName; + string path = null; - string basePath = Path.Combine(Path.GetTempPath(), msbuildTempFolder); - - if (NativeMethodsShared.IsLinux && NativeMethodsShared.mkdir(basePath, userRWX) != 0) + if (NativeMethodsShared.IsLinux) { - if (NativeMethodsShared.chmod(basePath, userRWX) == 0) - { - // Current user owns this file; we can read and write to it. It is reasonable here to assume it was created properly by MSBuild and can be used - // for temporary files. - } - else - { - // Another user created a folder pretending to be us! Find a folder we can actually use. - int extraBits = 0; - string pathToCheck = basePath + extraBits; - while (NativeMethodsShared.mkdir(pathToCheck, userRWX) != 0 && NativeMethodsShared.chmod(pathToCheck, userRWX) != 0) - { - extraBits++; - pathToCheck = basePath + extraBits; - } - - basePath = pathToCheck; - } +#if NET // always true, Linux implies NET + path = Directory.CreateTempSubdirectory(msbuildTempFolderPrefix).FullName; +#endif } else { - Directory.CreateDirectory(basePath); + path = Path.Combine(Path.GetTempPath(), msbuildTempFolderPrefix); + Directory.CreateDirectory(path); } - return FileUtilities.EnsureTrailingSlash(basePath); + return FileUtilities.EnsureTrailingSlash(path); } /// From f0cbb13971c30ad15a3f252a8d0171898a01ec11 Mon Sep 17 00:00:00 2001 From: Jan Provaznik Date: Mon, 15 Sep 2025 12:17:42 +0000 Subject: [PATCH 5/9] Merged PR 668395: [vs17.8] Recreate temp on linux using CreateTempSubdirectory on every build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Recreate temp on linux using CreateTempSubdirectory on every build ---- #### AI description (iteration 1) #### PR Classification This pull request implements a security bug fix by revising the temporary folder creation mechanism on Linux. #### PR Summary The changes modify the creation of the MSBuild temporary folder to use .NET’s built-in Directory.CreateTempSubdirectory method on Linux, ensuring a new subdirectory is recreated on every build. This approach removes the custom native permission logic and fallback routines, thereby mitigating the risk of malicious folder creation. - `src/Shared/TempFileUtilities.cs`: On Linux, the manual mkdir/chmod logic is replaced with Directory.CreateTempSubdirectory using a fixed prefix. - `src/Shared/TempFileUtilities.cs`: For other platforms, the temporary path is now combined with the new folder prefix with explicit directory creation. - `src/Shared/TempFileUtilities.cs`: The custom permission constant (`userRWX`) is removed in favor of secure, built-in directory handling. ---- #### AI description (iteration 2) #### PR Classification This pull request is a security fix addressing a vulnerability in the MSBuild temporary folder creation on Linux. #### PR Summary This pull request mitigates a security issue by revising the Linux temporary folder creation process to use a secure subdirectory creation method. - **`src/Shared/TempFileUtilities.cs`**: Refactored the Linux branch to create a temporary folder with `Directory.CreateTempSubdirectory` using a designated prefix, removing unsafe custom permission checks. - **`eng/Versions.props`**: Updated the version prefix from 17.8.42 to 17.8.43. Related work items: #2541147 --- eng/Versions.props | 2 +- src/Shared/TempFileUtilities.cs | 32 +++++++++----------------------- 2 files changed, 10 insertions(+), 24 deletions(-) diff --git a/eng/Versions.props b/eng/Versions.props index ea3d526eebd..ca4203c584d 100644 --- a/eng/Versions.props +++ b/eng/Versions.props @@ -2,7 +2,7 @@ - 17.8.42 + 17.8.43 release 17.7.0 15.1.0.0 diff --git a/src/Shared/TempFileUtilities.cs b/src/Shared/TempFileUtilities.cs index c73af5ba444..77def71ef0e 100644 --- a/src/Shared/TempFileUtilities.cs +++ b/src/Shared/TempFileUtilities.cs @@ -18,8 +18,8 @@ internal static partial class FileUtilities { // For the current user, these correspond to read, write, and execute permissions. // Lower order bits correspond to the same for "group" or "other" users. - private const int userRWX = 0x100 | 0x80 | 0x40; private static string tempFileDirectory = null; + private const string msbuildTempFolderPrefix = "MSBuildTemp"; internal static string TempFileDirectory { get @@ -36,35 +36,21 @@ internal static void ClearTempFileDirectory() // For all native calls, directly check their return values to prevent bad actors from getting in between checking if a directory exists and returning it. private static string CreateFolderUnderTemp() { - string basePath = Path.Combine(Path.GetTempPath(), $"MSBuildTemp{Environment.UserName}"); + string path = null; - if (NativeMethodsShared.IsLinux && NativeMethodsShared.mkdir(basePath, userRWX) != 0) + if (NativeMethodsShared.IsLinux) { - if (NativeMethodsShared.chmod(basePath, userRWX) == 0) - { - // Current user owns this file; we can read and write to it. It is reasonable here to assume it was created properly by MSBuild and can be used - // for temporary files. - } - else - { - // Another user created a folder pretending to be us! Find a folder we can actually use. - int extraBits = 0; - string pathToCheck = basePath + extraBits; - while (NativeMethodsShared.mkdir(pathToCheck, userRWX) != 0 && NativeMethodsShared.chmod(pathToCheck, userRWX) != 0) - { - extraBits++; - pathToCheck = basePath + extraBits; - } - - basePath = pathToCheck; - } +#if NET // always true, Linux implies NET + path = Directory.CreateTempSubdirectory(msbuildTempFolderPrefix).FullName; +#endif } else { - Directory.CreateDirectory(basePath); + path = Path.Combine(Path.GetTempPath(), msbuildTempFolderPrefix); + Directory.CreateDirectory(path); } - return FileUtilities.EnsureTrailingSlash(basePath); + return FileUtilities.EnsureTrailingSlash(path); } /// From 02bf66295b64ab368d12933041f7281aad186a2d Mon Sep 17 00:00:00 2001 From: Jan Provaznik Date: Mon, 15 Sep 2025 12:17:52 +0000 Subject: [PATCH 6/9] Merged PR 668398: [vs17.11] Recreate temp on linux using CreateTempSubdirectory on every build Recreate temp on linux using CreateTempSubdirectory on every build ---- #### AI description (iteration 1) #### PR Classification Security bug fix addressing the temporary folder creation issue on Linux. #### PR Summary This pull request secures the temporary directory creation in `src/Shared/TempFileUtilities.cs` by replacing the manual folder creation and permission checks with a call to `Directory.CreateTempSubdirectory` on Linux, thereby mitigating the risk of unauthorized temp folder creation. It directly addresses the linked [Security] work item by eliminating the potential for malicious actor intervention. - `src/Shared/TempFileUtilities.cs`: Uses `Directory.CreateTempSubdirectory` to create a unique, secure temp folder on Linux. - `src/Shared/TempFileUtilities.cs`: Removes outdated manual permission and folder collision handling logic. ---- #### AI description (iteration 2) #### PR Classification Security bug fix that addresses a vulnerability in temporary folder creation on Linux. #### PR Summary This pull request enhances security by reworking the Linux temporary folder creation in MSBuild to generate a fresh subdirectory on every build using `Directory.CreateTempSubdirectory`. - `src/Shared/TempFileUtilities.cs`: Replaced the custom folder creation and permission logic with a secure, native subdirectory creation method and removed the obsolete `userRWX` constant. - `eng/Versions.props`: Bumped the version prefix from 17.11.47 to 17.11.48. Related work items: #2541147 --- eng/Versions.props | 2 +- src/Shared/TempFileUtilities.cs | 36 ++++++++------------------------- 2 files changed, 9 insertions(+), 29 deletions(-) diff --git a/eng/Versions.props b/eng/Versions.props index 19e33342ea0..3a18572962e 100644 --- a/eng/Versions.props +++ b/eng/Versions.props @@ -2,7 +2,7 @@ - 17.11.47 + 17.11.48 release 17.10.4 15.1.0.0 diff --git a/src/Shared/TempFileUtilities.cs b/src/Shared/TempFileUtilities.cs index 190f0dddf2b..db69ddd3dad 100644 --- a/src/Shared/TempFileUtilities.cs +++ b/src/Shared/TempFileUtilities.cs @@ -18,7 +18,6 @@ internal static partial class FileUtilities { // For the current user, these correspond to read, write, and execute permissions. // Lower order bits correspond to the same for "group" or "other" users. - private const int userRWX = 0x100 | 0x80 | 0x40; private static string tempFileDirectory = null; private const string msbuildTempFolderPrefix = "MSBuildTemp"; @@ -38,40 +37,21 @@ internal static void ClearTempFileDirectory() // For all native calls, directly check their return values to prevent bad actors from getting in between checking if a directory exists and returning it. private static string CreateFolderUnderTemp() { - // On windows Username with Unicode chars can give issues, so we dont append username to the temp folder name. - string msbuildTempFolder = NativeMethodsShared.IsWindows ? - msbuildTempFolderPrefix : - msbuildTempFolderPrefix + Environment.UserName; + string path = null; - string basePath = Path.Combine(Path.GetTempPath(), msbuildTempFolder); - - if (NativeMethodsShared.IsLinux && NativeMethodsShared.mkdir(basePath, userRWX) != 0) + if (NativeMethodsShared.IsLinux) { - if (NativeMethodsShared.chmod(basePath, userRWX) == 0) - { - // Current user owns this file; we can read and write to it. It is reasonable here to assume it was created properly by MSBuild and can be used - // for temporary files. - } - else - { - // Another user created a folder pretending to be us! Find a folder we can actually use. - int extraBits = 0; - string pathToCheck = basePath + extraBits; - while (NativeMethodsShared.mkdir(pathToCheck, userRWX) != 0 && NativeMethodsShared.chmod(pathToCheck, userRWX) != 0) - { - extraBits++; - pathToCheck = basePath + extraBits; - } - - basePath = pathToCheck; - } +#if NET // always true, Linux implies NET + path = Directory.CreateTempSubdirectory(msbuildTempFolderPrefix).FullName; +#endif } else { - Directory.CreateDirectory(basePath); + path = Path.Combine(Path.GetTempPath(), msbuildTempFolderPrefix); + Directory.CreateDirectory(path); } - return FileUtilities.EnsureTrailingSlash(basePath); + return FileUtilities.EnsureTrailingSlash(path); } /// From 8e9a4badfd2b44ff989326a69fce12b489edd8b9 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" <42748379+dotnet-maestro[bot]@users.noreply.github.com> Date: Mon, 20 Oct 2025 08:39:32 +0000 Subject: [PATCH 7/9] [vs17.8] Update dependencies from dotnet/arcade (#12523) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: dotnet-maestro[bot] Co-authored-by: Gang Wang Co-authored-by: Jan Provazník --- eng/Version.Details.xml | 8 +- eng/Versions.props | 6 +- eng/common/post-build/nuget-validation.ps1 | 11 +- eng/common/post-build/nuget-verification.ps1 | 121 ++++++++++++++++++ .../job/publish-build-assets.yml | 9 +- eng/common/templates-official/jobs/jobs.yml | 2 + .../post-build/post-build.yml | 3 +- .../templates/job/publish-build-assets.yml | 9 +- eng/common/templates/jobs/jobs.yml | 2 + .../templates/post-build/post-build.yml | 1 - global.json | 4 +- 11 files changed, 153 insertions(+), 23 deletions(-) create mode 100644 eng/common/post-build/nuget-verification.ps1 diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 746466c29fc..646d3d548de 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -58,9 +58,9 @@ - + https://github.com/dotnet/arcade - 09625cb3b98ebe646a63dfea19a0c0127e88459a + 6544413e02741855b701468aa8afc6cf8ca62c72 @@ -77,9 +77,9 @@ dc3d0694a4b31b8e27038431888cd4e8dd5b6cb6 - + https://github.com/dotnet/arcade - 09625cb3b98ebe646a63dfea19a0c0127e88459a + 6544413e02741855b701468aa8afc6cf8ca62c72 diff --git a/eng/Versions.props b/eng/Versions.props index ca4203c584d..c548a86bd98 100644 --- a/eng/Versions.props +++ b/eng/Versions.props @@ -2,12 +2,12 @@ - 17.8.43 + 17.8.44 release 17.7.0 15.1.0.0 servicing - test true @@ -51,7 +51,7 @@ Otherwise, this version of dotnet will not be installed and the build will error out. --> $([System.Text.RegularExpressions.Regex]::Match($([System.IO.File]::ReadAllText('$(MSBuildThisFileDirectory)..\global.json')), '"dotnet": "([^"]*)"').Groups.get_Item(1)) 4.2.0-1.22102.8 - 8.0.0-beta.25455.3 + 8.0.0-beta.25515.1 7.0.0 6.0.0 4.8.0-3.23465.5 diff --git a/eng/common/post-build/nuget-validation.ps1 b/eng/common/post-build/nuget-validation.ps1 index dab3534ab53..22b1c4dfe4a 100644 --- a/eng/common/post-build/nuget-validation.ps1 +++ b/eng/common/post-build/nuget-validation.ps1 @@ -2,20 +2,13 @@ # tool: https://github.com/NuGet/NuGetGallery/tree/jver-verify/src/VerifyMicrosoftPackage param( - [Parameter(Mandatory=$true)][string] $PackagesPath, # Path to where the packages to be validated are - [Parameter(Mandatory=$true)][string] $ToolDestinationPath # Where the validation tool should be downloaded to + [Parameter(Mandatory=$true)][string] $PackagesPath # Path to where the packages to be validated are ) try { . $PSScriptRoot\post-build-utils.ps1 - $url = 'https://raw.githubusercontent.com/NuGet/NuGetGallery/3e25ad135146676bcab0050a516939d9958bfa5d/src/VerifyMicrosoftPackage/verify.ps1' - - New-Item -ItemType 'directory' -Path ${ToolDestinationPath} -Force - - Invoke-WebRequest $url -OutFile ${ToolDestinationPath}\verify.ps1 - - & ${ToolDestinationPath}\verify.ps1 ${PackagesPath}\*.nupkg + & $PSScriptRoot\nuget-verification.ps1 ${PackagesPath}\*.nupkg } catch { Write-Host $_.ScriptStackTrace diff --git a/eng/common/post-build/nuget-verification.ps1 b/eng/common/post-build/nuget-verification.ps1 new file mode 100644 index 00000000000..8467dbf8e7c --- /dev/null +++ b/eng/common/post-build/nuget-verification.ps1 @@ -0,0 +1,121 @@ +<# +.SYNOPSIS + Verifies that Microsoft NuGet packages have proper metadata. +.DESCRIPTION + Downloads a verification tool and runs metadata validation on the provided NuGet packages. This script writes an + error if any of the provided packages fail validation. All arguments provided to this PowerShell script that do not + match PowerShell parameters are passed on to the verification tool downloaded during the execution of this script. +.PARAMETER NuGetExePath + The path to the nuget.exe binary to use. If not provided, nuget.exe will be downloaded into the -DownloadPath + directory. +.PARAMETER PackageSource + The package source to use to download the verification tool. If not provided, nuget.org will be used. +.PARAMETER DownloadPath + The directory path to download the verification tool and nuget.exe to. If not provided, + %TEMP%\NuGet.VerifyNuGetPackage will be used. +.PARAMETER args + Arguments that will be passed to the verification tool. +.EXAMPLE + PS> .\verify.ps1 *.nupkg + Verifies the metadata of all .nupkg files in the currect working directory. +.EXAMPLE + PS> .\verify.ps1 --help + Displays the help text of the downloaded verifiction tool. +.LINK + https://github.com/NuGet/NuGetGallery/blob/master/src/VerifyMicrosoftPackage/README.md +#> + +# This script was copied from https://github.com/NuGet/NuGetGallery/blob/3e25ad135146676bcab0050a516939d9958bfa5d/src/VerifyMicrosoftPackage/verify.ps1 + +[CmdletBinding(PositionalBinding = $false)] +param( + [string]$NuGetExePath, + [string]$PackageSource = "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json", + [string]$DownloadPath, + [Parameter(ValueFromRemainingArguments = $true)] + [string[]]$args +) + +# The URL to download nuget.exe. +$nugetExeUrl = "https://dist.nuget.org/win-x86-commandline/v4.9.4/nuget.exe" + +# The package ID of the verification tool. +$packageId = "NuGet.VerifyMicrosoftPackage" + +# The location that nuget.exe and the verification tool will be downloaded to. +if (!$DownloadPath) { + $DownloadPath = (Join-Path $env:TEMP "NuGet.VerifyMicrosoftPackage") +} + +$fence = New-Object -TypeName string -ArgumentList '=', 80 + +# Create the download directory, if it doesn't already exist. +if (!(Test-Path $DownloadPath)) { + New-Item -ItemType Directory $DownloadPath | Out-Null +} +Write-Host "Using download path: $DownloadPath" + +if ($NuGetExePath) { + $nuget = $NuGetExePath +} else { + $downloadedNuGetExe = Join-Path $DownloadPath "nuget.exe" + + # Download nuget.exe, if it doesn't already exist. + if (!(Test-Path $downloadedNuGetExe)) { + Write-Host "Downloading nuget.exe from $nugetExeUrl..." + $ProgressPreference = 'SilentlyContinue' + try { + Invoke-WebRequest $nugetExeUrl -OutFile $downloadedNuGetExe + $ProgressPreference = 'Continue' + } catch { + $ProgressPreference = 'Continue' + Write-Error $_ + Write-Error "nuget.exe failed to download." + exit + } + } + + $nuget = $downloadedNuGetExe +} + +Write-Host "Using nuget.exe path: $nuget" +Write-Host " " + +# Download the latest version of the verification tool. +Write-Host "Downloading the latest version of $packageId from $packageSource..." +Write-Host $fence +& $nuget install $packageId ` + -Prerelease ` + -OutputDirectory $DownloadPath ` + -Source $PackageSource +Write-Host $fence +Write-Host " " + +if ($LASTEXITCODE -ne 0) { + Write-Error "nuget.exe failed to fetch the verify tool." + exit +} + +# Find the most recently downloaded tool +Write-Host "Finding the most recently downloaded verification tool." +$verifyProbePath = Join-Path $DownloadPath "$packageId.*" +$verifyPath = Get-ChildItem -Path $verifyProbePath -Directory ` + | Sort-Object -Property LastWriteTime -Descending ` + | Select-Object -First 1 +$verify = Join-Path $verifyPath "tools\NuGet.VerifyMicrosoftPackage.exe" +Write-Host "Using verification tool: $verify" +Write-Host " " + +# Execute the verification tool. +Write-Host "Executing the verify tool..." +Write-Host $fence +& $verify $args +Write-Host $fence +Write-Host " " + +# Respond to the exit code. +if ($LASTEXITCODE -ne 0) { + Write-Error "The verify tool found some problems." +} else { + Write-Output "The verify tool succeeded." +} \ No newline at end of file diff --git a/eng/common/templates-official/job/publish-build-assets.yml b/eng/common/templates-official/job/publish-build-assets.yml index 7a320e9bab2..a99d79df863 100644 --- a/eng/common/templates-official/job/publish-build-assets.yml +++ b/eng/common/templates-official/job/publish-build-assets.yml @@ -32,6 +32,8 @@ parameters: repositoryAlias: self + officialBuildId: '' + jobs: - job: Asset_Registry_Publish @@ -52,6 +54,11 @@ jobs: value: false - ${{ if eq(parameters.publishAssetsImmediately, 'true') }}: - template: /eng/common/templates-official/post-build/common-variables.yml + - name: OfficialBuildId + ${{ if ne(parameters.officialBuildId, '') }}: + value: ${{ parameters.officialBuildId }} + ${{ else }}: + value: $(Build.BuildNumber) pool: # We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) @@ -93,7 +100,7 @@ jobs: /p:ManifestsPath='$(Build.StagingDirectory)/Download/AssetManifests' /p:MaestroApiEndpoint=https://maestro.dot.net /p:PublishUsingPipelines=${{ parameters.publishUsingPipelines }} - /p:OfficialBuildId=$(Build.BuildNumber) + /p:OfficialBuildId=$(OfficialBuildId) condition: ${{ parameters.condition }} continueOnError: ${{ parameters.continueOnError }} diff --git a/eng/common/templates-official/jobs/jobs.yml b/eng/common/templates-official/jobs/jobs.yml index 803a95aacf4..03aa64e1741 100644 --- a/eng/common/templates-official/jobs/jobs.yml +++ b/eng/common/templates-official/jobs/jobs.yml @@ -41,6 +41,7 @@ parameters: enableSourceIndex: false sourceIndexParams: {} repositoryAlias: self + officialBuildId: '' # Internal resources (telemetry, microbuild) can only be accessed from non-public projects, # and some (Microbuild) should only be applied to non-PR cases for internal builds. @@ -97,3 +98,4 @@ jobs: artifactsPublishingAdditionalParameters: ${{ parameters.artifactsPublishingAdditionalParameters }} signingValidationAdditionalParameters: ${{ parameters.signingValidationAdditionalParameters }} repositoryAlias: ${{ parameters.repositoryAlias }} + officialBuildId: ${{ parameters.officialBuildId }} diff --git a/eng/common/templates-official/post-build/post-build.yml b/eng/common/templates-official/post-build/post-build.yml index 9fef8103991..817e2d80dea 100644 --- a/eng/common/templates-official/post-build/post-build.yml +++ b/eng/common/templates-official/post-build/post-build.yml @@ -134,8 +134,7 @@ stages: displayName: Validate inputs: filePath: $(System.DefaultWorkingDirectory)/eng/common/post-build/nuget-validation.ps1 - arguments: -PackagesPath $(Build.ArtifactStagingDirectory)/PackageArtifacts/ - -ToolDestinationPath $(Agent.BuildDirectory)/Extract/ + arguments: -PackagesPath $(Build.ArtifactStagingDirectory)/PackageArtifacts/ - job: displayName: Signing Validation diff --git a/eng/common/templates/job/publish-build-assets.yml b/eng/common/templates/job/publish-build-assets.yml index 2956d8117f7..1fcdcc9adc3 100644 --- a/eng/common/templates/job/publish-build-assets.yml +++ b/eng/common/templates/job/publish-build-assets.yml @@ -32,6 +32,8 @@ parameters: repositoryAlias: self + officialBuildId: '' + jobs: - job: Asset_Registry_Publish @@ -52,6 +54,11 @@ jobs: value: false - ${{ if eq(parameters.publishAssetsImmediately, 'true') }}: - template: /eng/common/templates/post-build/common-variables.yml + - name: OfficialBuildId + ${{ if ne(parameters.officialBuildId, '') }}: + value: ${{ parameters.officialBuildId }} + ${{ else }}: + value: $(Build.BuildNumber) pool: # We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) @@ -91,7 +98,7 @@ jobs: /p:ManifestsPath='$(Build.StagingDirectory)/Download/AssetManifests' /p:MaestroApiEndpoint=https://maestro.dot.net /p:PublishUsingPipelines=${{ parameters.publishUsingPipelines }} - /p:OfficialBuildId=$(Build.BuildNumber) + /p:OfficialBuildId=$(OfficialBuildId) condition: ${{ parameters.condition }} continueOnError: ${{ parameters.continueOnError }} diff --git a/eng/common/templates/jobs/jobs.yml b/eng/common/templates/jobs/jobs.yml index 34387a8c7ac..7eafc256758 100644 --- a/eng/common/templates/jobs/jobs.yml +++ b/eng/common/templates/jobs/jobs.yml @@ -41,6 +41,7 @@ parameters: enableSourceIndex: false sourceIndexParams: {} repositoryAlias: self + officialBuildId: '' # Internal resources (telemetry, microbuild) can only be accessed from non-public projects, # and some (Microbuild) should only be applied to non-PR cases for internal builds. @@ -97,3 +98,4 @@ jobs: artifactsPublishingAdditionalParameters: ${{ parameters.artifactsPublishingAdditionalParameters }} signingValidationAdditionalParameters: ${{ parameters.signingValidationAdditionalParameters }} repositoryAlias: ${{ parameters.repositoryAlias }} + officialBuildId: ${{ parameters.officialBuildId }} diff --git a/eng/common/templates/post-build/post-build.yml b/eng/common/templates/post-build/post-build.yml index 6e5722dc2e1..ea1785a8aa2 100644 --- a/eng/common/templates/post-build/post-build.yml +++ b/eng/common/templates/post-build/post-build.yml @@ -132,7 +132,6 @@ stages: inputs: filePath: $(System.DefaultWorkingDirectory)/eng/common/post-build/nuget-validation.ps1 arguments: -PackagesPath $(Build.ArtifactStagingDirectory)/PackageArtifacts/ - -ToolDestinationPath $(Agent.BuildDirectory)/Extract/ - job: displayName: Signing Validation diff --git a/global.json b/global.json index f8d445476ae..dfb534b30ee 100644 --- a/global.json +++ b/global.json @@ -3,13 +3,13 @@ "allowPrerelease": true }, "tools": { - "dotnet": "8.0.119", + "dotnet": "8.0.121", "vs": { "version": "17.8.0" }, "xcopy-msbuild": "17.8.5" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.25455.3" + "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.25515.1" } } From fa28caccebee5ad920ad82c73c79c5f5b9d0f01c Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" <42748379+dotnet-maestro[bot]@users.noreply.github.com> Date: Mon, 20 Oct 2025 09:01:48 +0000 Subject: [PATCH 8/9] [vs17.10] Update dependencies from dotnet/arcade (#12525) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: dotnet-maestro[bot] Co-authored-by: Gang Wang Co-authored-by: Jan Provazník --- eng/Version.Details.xml | 12 +- eng/Versions.props | 4 +- eng/common/post-build/nuget-validation.ps1 | 11 +- eng/common/post-build/nuget-verification.ps1 | 121 ++++++++++++++++++ .../job/publish-build-assets.yml | 9 +- eng/common/templates-official/jobs/jobs.yml | 2 + .../post-build/post-build.yml | 3 +- .../templates/job/publish-build-assets.yml | 9 +- eng/common/templates/jobs/jobs.yml | 2 + .../templates/post-build/post-build.yml | 1 - global.json | 2 +- 11 files changed, 153 insertions(+), 23 deletions(-) create mode 100644 eng/common/post-build/nuget-verification.ps1 diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 3f69007fb84..cb7feefe306 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -67,14 +67,14 @@ - + https://github.com/dotnet/arcade - 09625cb3b98ebe646a63dfea19a0c0127e88459a + 6544413e02741855b701468aa8afc6cf8ca62c72 - + https://github.com/dotnet/arcade - 09625cb3b98ebe646a63dfea19a0c0127e88459a + 6544413e02741855b701468aa8afc6cf8ca62c72 @@ -96,9 +96,9 @@ 919d4dbfb0dffb35a702417e28ceea652d248bc6 - + https://github.com/dotnet/arcade - 09625cb3b98ebe646a63dfea19a0c0127e88459a + 6544413e02741855b701468aa8afc6cf8ca62c72 diff --git a/eng/Versions.props b/eng/Versions.props index c20a77c8cad..5044a3bc9e9 100644 --- a/eng/Versions.props +++ b/eng/Versions.props @@ -2,7 +2,7 @@ - 17.10.46 + 17.10.47 release 17.8.3 15.1.0.0 @@ -52,7 +52,7 @@ Otherwise, this version of dotnet will not be installed and the build will error out. --> $([System.Text.RegularExpressions.Regex]::Match($([System.IO.File]::ReadAllText('$(MSBuildThisFileDirectory)..\global.json')), '"dotnet": "([^"]*)"').Groups.get_Item(1)) 4.2.0-1.22102.8 - 8.0.0-beta.25455.3 + 8.0.0-beta.25515.1 7.0.0 6.0.0 4.10.0-3.24175.2 diff --git a/eng/common/post-build/nuget-validation.ps1 b/eng/common/post-build/nuget-validation.ps1 index dab3534ab53..22b1c4dfe4a 100644 --- a/eng/common/post-build/nuget-validation.ps1 +++ b/eng/common/post-build/nuget-validation.ps1 @@ -2,20 +2,13 @@ # tool: https://github.com/NuGet/NuGetGallery/tree/jver-verify/src/VerifyMicrosoftPackage param( - [Parameter(Mandatory=$true)][string] $PackagesPath, # Path to where the packages to be validated are - [Parameter(Mandatory=$true)][string] $ToolDestinationPath # Where the validation tool should be downloaded to + [Parameter(Mandatory=$true)][string] $PackagesPath # Path to where the packages to be validated are ) try { . $PSScriptRoot\post-build-utils.ps1 - $url = 'https://raw.githubusercontent.com/NuGet/NuGetGallery/3e25ad135146676bcab0050a516939d9958bfa5d/src/VerifyMicrosoftPackage/verify.ps1' - - New-Item -ItemType 'directory' -Path ${ToolDestinationPath} -Force - - Invoke-WebRequest $url -OutFile ${ToolDestinationPath}\verify.ps1 - - & ${ToolDestinationPath}\verify.ps1 ${PackagesPath}\*.nupkg + & $PSScriptRoot\nuget-verification.ps1 ${PackagesPath}\*.nupkg } catch { Write-Host $_.ScriptStackTrace diff --git a/eng/common/post-build/nuget-verification.ps1 b/eng/common/post-build/nuget-verification.ps1 new file mode 100644 index 00000000000..8467dbf8e7c --- /dev/null +++ b/eng/common/post-build/nuget-verification.ps1 @@ -0,0 +1,121 @@ +<# +.SYNOPSIS + Verifies that Microsoft NuGet packages have proper metadata. +.DESCRIPTION + Downloads a verification tool and runs metadata validation on the provided NuGet packages. This script writes an + error if any of the provided packages fail validation. All arguments provided to this PowerShell script that do not + match PowerShell parameters are passed on to the verification tool downloaded during the execution of this script. +.PARAMETER NuGetExePath + The path to the nuget.exe binary to use. If not provided, nuget.exe will be downloaded into the -DownloadPath + directory. +.PARAMETER PackageSource + The package source to use to download the verification tool. If not provided, nuget.org will be used. +.PARAMETER DownloadPath + The directory path to download the verification tool and nuget.exe to. If not provided, + %TEMP%\NuGet.VerifyNuGetPackage will be used. +.PARAMETER args + Arguments that will be passed to the verification tool. +.EXAMPLE + PS> .\verify.ps1 *.nupkg + Verifies the metadata of all .nupkg files in the currect working directory. +.EXAMPLE + PS> .\verify.ps1 --help + Displays the help text of the downloaded verifiction tool. +.LINK + https://github.com/NuGet/NuGetGallery/blob/master/src/VerifyMicrosoftPackage/README.md +#> + +# This script was copied from https://github.com/NuGet/NuGetGallery/blob/3e25ad135146676bcab0050a516939d9958bfa5d/src/VerifyMicrosoftPackage/verify.ps1 + +[CmdletBinding(PositionalBinding = $false)] +param( + [string]$NuGetExePath, + [string]$PackageSource = "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json", + [string]$DownloadPath, + [Parameter(ValueFromRemainingArguments = $true)] + [string[]]$args +) + +# The URL to download nuget.exe. +$nugetExeUrl = "https://dist.nuget.org/win-x86-commandline/v4.9.4/nuget.exe" + +# The package ID of the verification tool. +$packageId = "NuGet.VerifyMicrosoftPackage" + +# The location that nuget.exe and the verification tool will be downloaded to. +if (!$DownloadPath) { + $DownloadPath = (Join-Path $env:TEMP "NuGet.VerifyMicrosoftPackage") +} + +$fence = New-Object -TypeName string -ArgumentList '=', 80 + +# Create the download directory, if it doesn't already exist. +if (!(Test-Path $DownloadPath)) { + New-Item -ItemType Directory $DownloadPath | Out-Null +} +Write-Host "Using download path: $DownloadPath" + +if ($NuGetExePath) { + $nuget = $NuGetExePath +} else { + $downloadedNuGetExe = Join-Path $DownloadPath "nuget.exe" + + # Download nuget.exe, if it doesn't already exist. + if (!(Test-Path $downloadedNuGetExe)) { + Write-Host "Downloading nuget.exe from $nugetExeUrl..." + $ProgressPreference = 'SilentlyContinue' + try { + Invoke-WebRequest $nugetExeUrl -OutFile $downloadedNuGetExe + $ProgressPreference = 'Continue' + } catch { + $ProgressPreference = 'Continue' + Write-Error $_ + Write-Error "nuget.exe failed to download." + exit + } + } + + $nuget = $downloadedNuGetExe +} + +Write-Host "Using nuget.exe path: $nuget" +Write-Host " " + +# Download the latest version of the verification tool. +Write-Host "Downloading the latest version of $packageId from $packageSource..." +Write-Host $fence +& $nuget install $packageId ` + -Prerelease ` + -OutputDirectory $DownloadPath ` + -Source $PackageSource +Write-Host $fence +Write-Host " " + +if ($LASTEXITCODE -ne 0) { + Write-Error "nuget.exe failed to fetch the verify tool." + exit +} + +# Find the most recently downloaded tool +Write-Host "Finding the most recently downloaded verification tool." +$verifyProbePath = Join-Path $DownloadPath "$packageId.*" +$verifyPath = Get-ChildItem -Path $verifyProbePath -Directory ` + | Sort-Object -Property LastWriteTime -Descending ` + | Select-Object -First 1 +$verify = Join-Path $verifyPath "tools\NuGet.VerifyMicrosoftPackage.exe" +Write-Host "Using verification tool: $verify" +Write-Host " " + +# Execute the verification tool. +Write-Host "Executing the verify tool..." +Write-Host $fence +& $verify $args +Write-Host $fence +Write-Host " " + +# Respond to the exit code. +if ($LASTEXITCODE -ne 0) { + Write-Error "The verify tool found some problems." +} else { + Write-Output "The verify tool succeeded." +} \ No newline at end of file diff --git a/eng/common/templates-official/job/publish-build-assets.yml b/eng/common/templates-official/job/publish-build-assets.yml index 7a320e9bab2..a99d79df863 100644 --- a/eng/common/templates-official/job/publish-build-assets.yml +++ b/eng/common/templates-official/job/publish-build-assets.yml @@ -32,6 +32,8 @@ parameters: repositoryAlias: self + officialBuildId: '' + jobs: - job: Asset_Registry_Publish @@ -52,6 +54,11 @@ jobs: value: false - ${{ if eq(parameters.publishAssetsImmediately, 'true') }}: - template: /eng/common/templates-official/post-build/common-variables.yml + - name: OfficialBuildId + ${{ if ne(parameters.officialBuildId, '') }}: + value: ${{ parameters.officialBuildId }} + ${{ else }}: + value: $(Build.BuildNumber) pool: # We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) @@ -93,7 +100,7 @@ jobs: /p:ManifestsPath='$(Build.StagingDirectory)/Download/AssetManifests' /p:MaestroApiEndpoint=https://maestro.dot.net /p:PublishUsingPipelines=${{ parameters.publishUsingPipelines }} - /p:OfficialBuildId=$(Build.BuildNumber) + /p:OfficialBuildId=$(OfficialBuildId) condition: ${{ parameters.condition }} continueOnError: ${{ parameters.continueOnError }} diff --git a/eng/common/templates-official/jobs/jobs.yml b/eng/common/templates-official/jobs/jobs.yml index 803a95aacf4..03aa64e1741 100644 --- a/eng/common/templates-official/jobs/jobs.yml +++ b/eng/common/templates-official/jobs/jobs.yml @@ -41,6 +41,7 @@ parameters: enableSourceIndex: false sourceIndexParams: {} repositoryAlias: self + officialBuildId: '' # Internal resources (telemetry, microbuild) can only be accessed from non-public projects, # and some (Microbuild) should only be applied to non-PR cases for internal builds. @@ -97,3 +98,4 @@ jobs: artifactsPublishingAdditionalParameters: ${{ parameters.artifactsPublishingAdditionalParameters }} signingValidationAdditionalParameters: ${{ parameters.signingValidationAdditionalParameters }} repositoryAlias: ${{ parameters.repositoryAlias }} + officialBuildId: ${{ parameters.officialBuildId }} diff --git a/eng/common/templates-official/post-build/post-build.yml b/eng/common/templates-official/post-build/post-build.yml index 9fef8103991..817e2d80dea 100644 --- a/eng/common/templates-official/post-build/post-build.yml +++ b/eng/common/templates-official/post-build/post-build.yml @@ -134,8 +134,7 @@ stages: displayName: Validate inputs: filePath: $(System.DefaultWorkingDirectory)/eng/common/post-build/nuget-validation.ps1 - arguments: -PackagesPath $(Build.ArtifactStagingDirectory)/PackageArtifacts/ - -ToolDestinationPath $(Agent.BuildDirectory)/Extract/ + arguments: -PackagesPath $(Build.ArtifactStagingDirectory)/PackageArtifacts/ - job: displayName: Signing Validation diff --git a/eng/common/templates/job/publish-build-assets.yml b/eng/common/templates/job/publish-build-assets.yml index 2956d8117f7..1fcdcc9adc3 100644 --- a/eng/common/templates/job/publish-build-assets.yml +++ b/eng/common/templates/job/publish-build-assets.yml @@ -32,6 +32,8 @@ parameters: repositoryAlias: self + officialBuildId: '' + jobs: - job: Asset_Registry_Publish @@ -52,6 +54,11 @@ jobs: value: false - ${{ if eq(parameters.publishAssetsImmediately, 'true') }}: - template: /eng/common/templates/post-build/common-variables.yml + - name: OfficialBuildId + ${{ if ne(parameters.officialBuildId, '') }}: + value: ${{ parameters.officialBuildId }} + ${{ else }}: + value: $(Build.BuildNumber) pool: # We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) @@ -91,7 +98,7 @@ jobs: /p:ManifestsPath='$(Build.StagingDirectory)/Download/AssetManifests' /p:MaestroApiEndpoint=https://maestro.dot.net /p:PublishUsingPipelines=${{ parameters.publishUsingPipelines }} - /p:OfficialBuildId=$(Build.BuildNumber) + /p:OfficialBuildId=$(OfficialBuildId) condition: ${{ parameters.condition }} continueOnError: ${{ parameters.continueOnError }} diff --git a/eng/common/templates/jobs/jobs.yml b/eng/common/templates/jobs/jobs.yml index 34387a8c7ac..7eafc256758 100644 --- a/eng/common/templates/jobs/jobs.yml +++ b/eng/common/templates/jobs/jobs.yml @@ -41,6 +41,7 @@ parameters: enableSourceIndex: false sourceIndexParams: {} repositoryAlias: self + officialBuildId: '' # Internal resources (telemetry, microbuild) can only be accessed from non-public projects, # and some (Microbuild) should only be applied to non-PR cases for internal builds. @@ -97,3 +98,4 @@ jobs: artifactsPublishingAdditionalParameters: ${{ parameters.artifactsPublishingAdditionalParameters }} signingValidationAdditionalParameters: ${{ parameters.signingValidationAdditionalParameters }} repositoryAlias: ${{ parameters.repositoryAlias }} + officialBuildId: ${{ parameters.officialBuildId }} diff --git a/eng/common/templates/post-build/post-build.yml b/eng/common/templates/post-build/post-build.yml index 6e5722dc2e1..ea1785a8aa2 100644 --- a/eng/common/templates/post-build/post-build.yml +++ b/eng/common/templates/post-build/post-build.yml @@ -132,7 +132,6 @@ stages: inputs: filePath: $(System.DefaultWorkingDirectory)/eng/common/post-build/nuget-validation.ps1 arguments: -PackagesPath $(Build.ArtifactStagingDirectory)/PackageArtifacts/ - -ToolDestinationPath $(Agent.BuildDirectory)/Extract/ - job: displayName: Signing Validation diff --git a/global.json b/global.json index 8345416cd57..fbb709c3deb 100644 --- a/global.json +++ b/global.json @@ -10,6 +10,6 @@ "xcopy-msbuild": "17.8.5" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.25455.3" + "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.25515.1" } } From c3bf5aa1e3421510188dd5b4640afa93eacf1881 Mon Sep 17 00:00:00 2001 From: "dotnet-maestro[bot]" <42748379+dotnet-maestro[bot]@users.noreply.github.com> Date: Mon, 20 Oct 2025 09:08:09 +0000 Subject: [PATCH 9/9] [vs17.11] Update dependencies from dotnet/arcade (#12524) --- eng/Version.Details.xml | 12 +- eng/Versions.props | 6 +- eng/common/post-build/nuget-validation.ps1 | 11 +- eng/common/post-build/nuget-verification.ps1 | 121 ++++++++++++++++++ .../job/publish-build-assets.yml | 9 +- eng/common/templates-official/jobs/jobs.yml | 2 + .../post-build/post-build.yml | 3 +- .../templates/job/publish-build-assets.yml | 9 +- eng/common/templates/jobs/jobs.yml | 2 + .../templates/post-build/post-build.yml | 1 - global.json | 2 +- 11 files changed, 154 insertions(+), 24 deletions(-) create mode 100644 eng/common/post-build/nuget-verification.ps1 diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 0a2c8d83d5a..0f6ad80fbcc 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -71,14 +71,14 @@ - + https://github.com/dotnet/arcade - 09625cb3b98ebe646a63dfea19a0c0127e88459a + 6544413e02741855b701468aa8afc6cf8ca62c72 - + https://github.com/dotnet/arcade - 09625cb3b98ebe646a63dfea19a0c0127e88459a + 6544413e02741855b701468aa8afc6cf8ca62c72 @@ -100,9 +100,9 @@ 0b8371953e61f6179f39f1d62ebbd6a251f335e0 - + https://github.com/dotnet/arcade - 09625cb3b98ebe646a63dfea19a0c0127e88459a + 6544413e02741855b701468aa8afc6cf8ca62c72 diff --git a/eng/Versions.props b/eng/Versions.props index 3a18572962e..35da55a09b6 100644 --- a/eng/Versions.props +++ b/eng/Versions.props @@ -2,12 +2,12 @@ - 17.11.48 + 17.11.49 release 17.10.4 15.1.0.0 servicing - test true @@ -54,7 +54,7 @@ Otherwise, this version of dotnet will not be installed and the build will error out. --> $([System.Text.RegularExpressions.Regex]::Match($([System.IO.File]::ReadAllText('$(MSBuildThisFileDirectory)..\global.json')), '"dotnet": "([^"]*)"').Groups.get_Item(1)) 4.2.0-1.22102.8 - 8.0.0-beta.25455.3 + 8.0.0-beta.25515.1 7.0.0 6.0.1 4.11.0-3.24313.9 diff --git a/eng/common/post-build/nuget-validation.ps1 b/eng/common/post-build/nuget-validation.ps1 index dab3534ab53..22b1c4dfe4a 100644 --- a/eng/common/post-build/nuget-validation.ps1 +++ b/eng/common/post-build/nuget-validation.ps1 @@ -2,20 +2,13 @@ # tool: https://github.com/NuGet/NuGetGallery/tree/jver-verify/src/VerifyMicrosoftPackage param( - [Parameter(Mandatory=$true)][string] $PackagesPath, # Path to where the packages to be validated are - [Parameter(Mandatory=$true)][string] $ToolDestinationPath # Where the validation tool should be downloaded to + [Parameter(Mandatory=$true)][string] $PackagesPath # Path to where the packages to be validated are ) try { . $PSScriptRoot\post-build-utils.ps1 - $url = 'https://raw.githubusercontent.com/NuGet/NuGetGallery/3e25ad135146676bcab0050a516939d9958bfa5d/src/VerifyMicrosoftPackage/verify.ps1' - - New-Item -ItemType 'directory' -Path ${ToolDestinationPath} -Force - - Invoke-WebRequest $url -OutFile ${ToolDestinationPath}\verify.ps1 - - & ${ToolDestinationPath}\verify.ps1 ${PackagesPath}\*.nupkg + & $PSScriptRoot\nuget-verification.ps1 ${PackagesPath}\*.nupkg } catch { Write-Host $_.ScriptStackTrace diff --git a/eng/common/post-build/nuget-verification.ps1 b/eng/common/post-build/nuget-verification.ps1 new file mode 100644 index 00000000000..8467dbf8e7c --- /dev/null +++ b/eng/common/post-build/nuget-verification.ps1 @@ -0,0 +1,121 @@ +<# +.SYNOPSIS + Verifies that Microsoft NuGet packages have proper metadata. +.DESCRIPTION + Downloads a verification tool and runs metadata validation on the provided NuGet packages. This script writes an + error if any of the provided packages fail validation. All arguments provided to this PowerShell script that do not + match PowerShell parameters are passed on to the verification tool downloaded during the execution of this script. +.PARAMETER NuGetExePath + The path to the nuget.exe binary to use. If not provided, nuget.exe will be downloaded into the -DownloadPath + directory. +.PARAMETER PackageSource + The package source to use to download the verification tool. If not provided, nuget.org will be used. +.PARAMETER DownloadPath + The directory path to download the verification tool and nuget.exe to. If not provided, + %TEMP%\NuGet.VerifyNuGetPackage will be used. +.PARAMETER args + Arguments that will be passed to the verification tool. +.EXAMPLE + PS> .\verify.ps1 *.nupkg + Verifies the metadata of all .nupkg files in the currect working directory. +.EXAMPLE + PS> .\verify.ps1 --help + Displays the help text of the downloaded verifiction tool. +.LINK + https://github.com/NuGet/NuGetGallery/blob/master/src/VerifyMicrosoftPackage/README.md +#> + +# This script was copied from https://github.com/NuGet/NuGetGallery/blob/3e25ad135146676bcab0050a516939d9958bfa5d/src/VerifyMicrosoftPackage/verify.ps1 + +[CmdletBinding(PositionalBinding = $false)] +param( + [string]$NuGetExePath, + [string]$PackageSource = "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json", + [string]$DownloadPath, + [Parameter(ValueFromRemainingArguments = $true)] + [string[]]$args +) + +# The URL to download nuget.exe. +$nugetExeUrl = "https://dist.nuget.org/win-x86-commandline/v4.9.4/nuget.exe" + +# The package ID of the verification tool. +$packageId = "NuGet.VerifyMicrosoftPackage" + +# The location that nuget.exe and the verification tool will be downloaded to. +if (!$DownloadPath) { + $DownloadPath = (Join-Path $env:TEMP "NuGet.VerifyMicrosoftPackage") +} + +$fence = New-Object -TypeName string -ArgumentList '=', 80 + +# Create the download directory, if it doesn't already exist. +if (!(Test-Path $DownloadPath)) { + New-Item -ItemType Directory $DownloadPath | Out-Null +} +Write-Host "Using download path: $DownloadPath" + +if ($NuGetExePath) { + $nuget = $NuGetExePath +} else { + $downloadedNuGetExe = Join-Path $DownloadPath "nuget.exe" + + # Download nuget.exe, if it doesn't already exist. + if (!(Test-Path $downloadedNuGetExe)) { + Write-Host "Downloading nuget.exe from $nugetExeUrl..." + $ProgressPreference = 'SilentlyContinue' + try { + Invoke-WebRequest $nugetExeUrl -OutFile $downloadedNuGetExe + $ProgressPreference = 'Continue' + } catch { + $ProgressPreference = 'Continue' + Write-Error $_ + Write-Error "nuget.exe failed to download." + exit + } + } + + $nuget = $downloadedNuGetExe +} + +Write-Host "Using nuget.exe path: $nuget" +Write-Host " " + +# Download the latest version of the verification tool. +Write-Host "Downloading the latest version of $packageId from $packageSource..." +Write-Host $fence +& $nuget install $packageId ` + -Prerelease ` + -OutputDirectory $DownloadPath ` + -Source $PackageSource +Write-Host $fence +Write-Host " " + +if ($LASTEXITCODE -ne 0) { + Write-Error "nuget.exe failed to fetch the verify tool." + exit +} + +# Find the most recently downloaded tool +Write-Host "Finding the most recently downloaded verification tool." +$verifyProbePath = Join-Path $DownloadPath "$packageId.*" +$verifyPath = Get-ChildItem -Path $verifyProbePath -Directory ` + | Sort-Object -Property LastWriteTime -Descending ` + | Select-Object -First 1 +$verify = Join-Path $verifyPath "tools\NuGet.VerifyMicrosoftPackage.exe" +Write-Host "Using verification tool: $verify" +Write-Host " " + +# Execute the verification tool. +Write-Host "Executing the verify tool..." +Write-Host $fence +& $verify $args +Write-Host $fence +Write-Host " " + +# Respond to the exit code. +if ($LASTEXITCODE -ne 0) { + Write-Error "The verify tool found some problems." +} else { + Write-Output "The verify tool succeeded." +} \ No newline at end of file diff --git a/eng/common/templates-official/job/publish-build-assets.yml b/eng/common/templates-official/job/publish-build-assets.yml index 7a320e9bab2..a99d79df863 100644 --- a/eng/common/templates-official/job/publish-build-assets.yml +++ b/eng/common/templates-official/job/publish-build-assets.yml @@ -32,6 +32,8 @@ parameters: repositoryAlias: self + officialBuildId: '' + jobs: - job: Asset_Registry_Publish @@ -52,6 +54,11 @@ jobs: value: false - ${{ if eq(parameters.publishAssetsImmediately, 'true') }}: - template: /eng/common/templates-official/post-build/common-variables.yml + - name: OfficialBuildId + ${{ if ne(parameters.officialBuildId, '') }}: + value: ${{ parameters.officialBuildId }} + ${{ else }}: + value: $(Build.BuildNumber) pool: # We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) @@ -93,7 +100,7 @@ jobs: /p:ManifestsPath='$(Build.StagingDirectory)/Download/AssetManifests' /p:MaestroApiEndpoint=https://maestro.dot.net /p:PublishUsingPipelines=${{ parameters.publishUsingPipelines }} - /p:OfficialBuildId=$(Build.BuildNumber) + /p:OfficialBuildId=$(OfficialBuildId) condition: ${{ parameters.condition }} continueOnError: ${{ parameters.continueOnError }} diff --git a/eng/common/templates-official/jobs/jobs.yml b/eng/common/templates-official/jobs/jobs.yml index 803a95aacf4..03aa64e1741 100644 --- a/eng/common/templates-official/jobs/jobs.yml +++ b/eng/common/templates-official/jobs/jobs.yml @@ -41,6 +41,7 @@ parameters: enableSourceIndex: false sourceIndexParams: {} repositoryAlias: self + officialBuildId: '' # Internal resources (telemetry, microbuild) can only be accessed from non-public projects, # and some (Microbuild) should only be applied to non-PR cases for internal builds. @@ -97,3 +98,4 @@ jobs: artifactsPublishingAdditionalParameters: ${{ parameters.artifactsPublishingAdditionalParameters }} signingValidationAdditionalParameters: ${{ parameters.signingValidationAdditionalParameters }} repositoryAlias: ${{ parameters.repositoryAlias }} + officialBuildId: ${{ parameters.officialBuildId }} diff --git a/eng/common/templates-official/post-build/post-build.yml b/eng/common/templates-official/post-build/post-build.yml index 9fef8103991..817e2d80dea 100644 --- a/eng/common/templates-official/post-build/post-build.yml +++ b/eng/common/templates-official/post-build/post-build.yml @@ -134,8 +134,7 @@ stages: displayName: Validate inputs: filePath: $(System.DefaultWorkingDirectory)/eng/common/post-build/nuget-validation.ps1 - arguments: -PackagesPath $(Build.ArtifactStagingDirectory)/PackageArtifacts/ - -ToolDestinationPath $(Agent.BuildDirectory)/Extract/ + arguments: -PackagesPath $(Build.ArtifactStagingDirectory)/PackageArtifacts/ - job: displayName: Signing Validation diff --git a/eng/common/templates/job/publish-build-assets.yml b/eng/common/templates/job/publish-build-assets.yml index 2956d8117f7..1fcdcc9adc3 100644 --- a/eng/common/templates/job/publish-build-assets.yml +++ b/eng/common/templates/job/publish-build-assets.yml @@ -32,6 +32,8 @@ parameters: repositoryAlias: self + officialBuildId: '' + jobs: - job: Asset_Registry_Publish @@ -52,6 +54,11 @@ jobs: value: false - ${{ if eq(parameters.publishAssetsImmediately, 'true') }}: - template: /eng/common/templates/post-build/common-variables.yml + - name: OfficialBuildId + ${{ if ne(parameters.officialBuildId, '') }}: + value: ${{ parameters.officialBuildId }} + ${{ else }}: + value: $(Build.BuildNumber) pool: # We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com) @@ -91,7 +98,7 @@ jobs: /p:ManifestsPath='$(Build.StagingDirectory)/Download/AssetManifests' /p:MaestroApiEndpoint=https://maestro.dot.net /p:PublishUsingPipelines=${{ parameters.publishUsingPipelines }} - /p:OfficialBuildId=$(Build.BuildNumber) + /p:OfficialBuildId=$(OfficialBuildId) condition: ${{ parameters.condition }} continueOnError: ${{ parameters.continueOnError }} diff --git a/eng/common/templates/jobs/jobs.yml b/eng/common/templates/jobs/jobs.yml index 34387a8c7ac..7eafc256758 100644 --- a/eng/common/templates/jobs/jobs.yml +++ b/eng/common/templates/jobs/jobs.yml @@ -41,6 +41,7 @@ parameters: enableSourceIndex: false sourceIndexParams: {} repositoryAlias: self + officialBuildId: '' # Internal resources (telemetry, microbuild) can only be accessed from non-public projects, # and some (Microbuild) should only be applied to non-PR cases for internal builds. @@ -97,3 +98,4 @@ jobs: artifactsPublishingAdditionalParameters: ${{ parameters.artifactsPublishingAdditionalParameters }} signingValidationAdditionalParameters: ${{ parameters.signingValidationAdditionalParameters }} repositoryAlias: ${{ parameters.repositoryAlias }} + officialBuildId: ${{ parameters.officialBuildId }} diff --git a/eng/common/templates/post-build/post-build.yml b/eng/common/templates/post-build/post-build.yml index 6e5722dc2e1..ea1785a8aa2 100644 --- a/eng/common/templates/post-build/post-build.yml +++ b/eng/common/templates/post-build/post-build.yml @@ -132,7 +132,6 @@ stages: inputs: filePath: $(System.DefaultWorkingDirectory)/eng/common/post-build/nuget-validation.ps1 arguments: -PackagesPath $(Build.ArtifactStagingDirectory)/PackageArtifacts/ - -ToolDestinationPath $(Agent.BuildDirectory)/Extract/ - job: displayName: Signing Validation diff --git a/global.json b/global.json index 8345416cd57..fbb709c3deb 100644 --- a/global.json +++ b/global.json @@ -10,6 +10,6 @@ "xcopy-msbuild": "17.8.5" }, "msbuild-sdks": { - "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.25455.3" + "Microsoft.DotNet.Arcade.Sdk": "8.0.0-beta.25515.1" } }