From c2b2dc93f0bfedf93e1a075f1a8f11255fa2285f Mon Sep 17 00:00:00 2001
From: Mitch Denny <mitch@mitchdeny.com>
Date: Tue, 3 Mar 2026 20:32:40 +1100
Subject: [PATCH 1/2] Remove temporary nuget.org feed from NuGet.config

Remove the temporary nuget-org package source and its package source
mapping entries (Sigstore, Tuf, NSec.Cryptography, libsodium). These
packages will be resolved from the normal internal feeds (dotnet-public,
dotnet-eng) which have wildcard pattern mappings.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 NuGet.config | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/NuGet.config b/NuGet.config
index 6ffc9600bba..2822bc5d52a 100644
--- a/NuGet.config
+++ b/NuGet.config
@@ -20,8 +20,6 @@
     <add key="dotnet10" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet10/nuget/v3/index.json" />
     <add key="dotnet-libraries" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-libraries/nuget/v3/index.json" />
     <add key="dotnet9-transport" value="https://dnceng.pkgs.visualstudio.com/public/_packaging/dotnet9-transport/nuget/v3/index.json" />
-    <!-- TEMPORARY: nuget.org for Sigstore/Tuf packages until synced to internal feed -->
-    <add key="nuget-org" value="https://api.nuget.org/v3/index.json" />
   </packageSources>
   <packageSourceMapping>
     <packageSource key="dotnet9-transport">
@@ -45,13 +43,6 @@
     <packageSource key="dotnet-eng">
       <package pattern="*" />
     </packageSource>
-    <!-- TEMPORARY: Sigstore/Tuf packages from nuget.org until synced to internal feed -->
-    <packageSource key="nuget-org">
-      <package pattern="Sigstore" />
-      <package pattern="Tuf" />
-      <package pattern="NSec.Cryptography" />
-      <package pattern="libsodium" />
-    </packageSource>
   </packageSourceMapping>
   <disabledPackageSources>
     <!--Begin: Package sources managed by Dependency Flow automation. Do not edit the sources below.-->

From 6650c07fd414b713564bc374964e05a83b1a2fb4 Mon Sep 17 00:00:00 2001
From: Mitch Denny <mitch@mitchdeny.com>
Date: Tue, 3 Mar 2026 22:50:05 +1100
Subject: [PATCH 2/2] Update Sigstore and Tuf packages to 0.3.0

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Directory.Packages.props | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index d66793059c3..56e080f9da7 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -132,8 +132,8 @@
     <PackageVersion Include="Yarp.ReverseProxy" Version="2.3.0" />
     <PackageVersion Include="StreamJsonRpc" Version="2.22.23" />
     <PackageVersion Include="Semver" Version="3.0.0" />
-    <PackageVersion Include="Sigstore" Version="0.2.0" />
-    <PackageVersion Include="Tuf" Version="0.2.0" />
+    <PackageVersion Include="Sigstore" Version="0.3.0" />
+    <PackageVersion Include="Tuf" Version="0.3.0" />
     <PackageVersion Include="Microsoft.DevTunnels.Connections" Version="1.3.12" />
     <!-- Open Telemetry -->
     <PackageVersion Include="Azure.Monitor.OpenTelemetry.Exporter" Version="$(AzureMonitorOpenTelemetryExporterVersion)" />