Update Sigstore and Tuf to 1.0.0

[Mitch Denny (mitchdenny)]

Description

Updates the Sigstore and Tuf package references from 0.5.0 to 1.0.0 — the first stable releases of both libraries.

Sigstore is consumed by Aspire.Cli for npm provenance verification (SigstoreNpmProvenanceChecker, used by PlaywrightCliInstaller) and for GitHub artifact attestation verification (GitHubArtifactAttestationVerifier).

Two files change: the version bump in Directory.Packages.props, and a corresponding third-party signing entry in eng/Signing.props (see below).

Why now

1.0.0 was published to nuget.org on 2026-08-14 and has since cleared CFS quarantine, so both packages are now served from the dotnet-public dnceng feed. No NuGet.config changes are required.

Earlier revisions of this PR temporarily added nuget.org as a package source in order to test the pre-release builds before they were mirrored. All of that scaffolding has been reverted — NuGet.config and Directory.Build.props are now byte-identical to main.

Third-party signing

Sigstore 1.0.0 swapped its cryptographic backend from NSec.Cryptography to BouncyCastle.Cryptography, so the transitive third-party binary flowing into Aspire.Cli changed. eng/Signing.props is updated to match.

This matters because a missing entry does not fail quietly: the Arcade SDK would attempt to sign the third-party assembly with the Microsoft certificate and the internal build would fail with SIGN004. This is the same failure #14915 fixed when Sigstore/Tuf were first introduced, which is why NSec.Cryptography had an entry at all.

Worth noting that BouncyCastle.Cryptography was already present in the repository's dependency graph, but only via test-only packages (Npgsql, MongoDB, RabbitMQ and others), which are never signed. Aspire.Cli is the first shipping project to take it, which is what makes the signing entry newly necessary.

The NSec.Cryptography.dll entry is removed rather than left in place, having verified that no project resolves NSec any more across all 432 restored project.assets.json files.

Validation

Verified that both packages resolve from the internal feed, after purging 1.0.0 from the global packages folder and deleting the stale nuget.org entries from the NuGet HTTP cache, so the restore could not pass on a previously downloaded copy:

$ cat ~/.nuget/packages/sigstore/1.0.0/.nupkg.metadata
  "source": "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json"
$ cat ~/.nuget/packages/tuf/1.0.0/.nupkg.metadata
  "source": "https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json"

• Full repo restore (./restore.sh): 0 warnings, 0 errors, no NU190x audit diagnostics.
• Aspire.Cli build: 0 warnings, 0 errors.
• Aspire.Cli.Tests: 5293 passed, 0 failed, 35 Windows-only skips.
• eng/Signing.props evaluated through MSBuild to confirm the manifest resolves as intended:

SIGN: BouncyCastle.Cryptography.dll => 3PartySHA2
SIGN: Sigstore.dll => 3PartySHA2
SIGN: Tuf.dll => 3PartySHA2

Real cryptographic verification

The existing SigstoreNpmProvenanceCheckerTests inject a stub bundle-verification handler via an internal constructor, so they do not exercise real cryptography — passing unit tests alone would not demonstrate that verification still works.

To confirm the tightened 1.0.0 implementation behaves correctly, a temporary harness (not included in this PR) drove the real SigstoreVerifier through the public constructor against the live npm attestation for @playwright/cli, using the production constants from PlaywrightCliInstaller:

Scenario	Expected	Result
Genuine attestation	Verified	✅ Verified
Mismatched source repository	Rejected	✅ Rejected at certificate-identity check
Tampered package digest	Rejected	✅ PackageDigestMismatch

Notes

• Merged with main as of 6cee38d. The only conflict was an adjacent Microsoft.DevTunnels.Connections bump, resolved in favour of main's 1.3.51.

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No — dependency version bump; covered by the existing Aspire.Cli.Tests suite plus the out-of-band real-cryptography validation described above.
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes — flagging for reviewer awareness. This does not introduce new assumptions, but it does update the library implementing existing supply-chain verification guarantees, and 1.0.0 tightens that verification.
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No — the threat model is unchanged, and the behavioural change is strictly stricter rather than more permissive, as evidenced by the rejection cases in the table above.
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 19335

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 19335"

[Copilot]

Pull request overview

Temporarily validates tightened Sigstore/Tuf verification using prerelease packages.

Changes:

• Bumps Sigstore and Tuf to alpha builds.
• Temporarily enables nuget.org with restricted source mappings.
• Clears inherited disabled-package sources.

Show a summary per file

File	Description
NuGet.config	Temporarily enables and maps nuget.org.
Directory.Packages.props	Updates Sigstore and Tuf versions.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[Copilot]

Review details

Suppressed comments (2)

NuGet.config:28

• This adds an unapproved external package source, which the repository's internal build cannot consume. This block must not merge; mirror Sigstore/Tuf to an approved dnceng feed, then remove the nuget.org source, mapping, and inherited-disable override together.

    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />

Directory.Packages.props:152

• The package upgrade changes the production cryptographic verification implementation, but the existing SigstoreNpmProvenanceChecker tests inject a handler that bypasses real Sigstore verification (tests/Aspire.Cli.Tests/Agents/SigstoreNpmProvenanceCheckerTests.cs:1210-1213). Before shipping this bump, add deterministic automated coverage that invokes the real verifier for a genuine bundle and rejects identity/digest tampering; the out-of-band harness cannot catch future regressions in CI.

    <PackageVersion Include="Sigstore" Version="1.0.0-alpha.100.1.dd7cd33" />
    <PackageVersion Include="Tuf" Version="1.0.0-alpha.100.1.dd7cd33" />

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (2)

NuGet.config:28

• This external source cannot ship: repository policy permits only the dnceng feed domains because public feeds break the internal build pipeline (AGENTS.md:53-67). Mirror Sigstore/Tuf to an approved feed, then remove this source together with its mapping and inherited-disable override before approval.

    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />

Directory.Build.props:26

• This disables NuGet vulnerability auditing for every project in the repository, so restores will stop reporting NU1901-NU1904 advisories globally. It must be removed together with the temporary nuget.org source before this can be merged.

    <NuGetAudit>false</NuGetAudit>

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[Copilot]

Review details

Suppressed comments (4)

Directory.Build.props:26

• This disables vulnerability auditing for every package restored anywhere in the repository, hiding NU1901–NU1904 advisories unrelated to this experiment. Remove this temporary global opt-out before merge; validation-only invocations should suppress audit locally rather than weakening the repository default.

    <NuGetAudit>false</NuGetAudit>

NuGet.config:28

• This adds an unapproved external package source. Repository policy permits only dnceng feed domains because public feeds break the internal build pipeline. Before this can merge, mirror Sigstore/Tuf 1.0.0 to dotnet-public and remove this source together with its mapping and disabledPackageSources override.

    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />

NuGet.config:63

• This still describes restoring an alpha, but the changed dependency is stable 1.0.0. Keep the temporary configuration comment aligned with the version under test.

         drops inherited disable entries so the Sigstore/Tuf alpha can be restored from nuget.org.

NuGet.config:27

• This comment is stale: the package versions in Directory.Packages.props are stable 1.0.0, not 1.0.0-alpha. Update it so the temporary source's purpose matches the actual dependency being validated.

This issue also appears on line 63 of the same file.

    <!-- TEMPORARY - DO NOT MERGE: nuget.org is added solely to test the Sigstore/Tuf 1.0.0-alpha

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[github-actions]

Tests selector (audit mode)

The full test matrix and all jobs still run in audit mode. The tests and jobs below are what selective CI would run under enforcement.

Runs the full test matrix + all jobs (ALL) — a rule matching 'Directory.Packages.props' selects ALL

---

Selection computed for commit cf88f50.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[James Newton-King (JamesNK)]

No issues found. Verified the repository restore completes without warnings or NU190x diagnostics, the focused Sigstore provenance suite passes (85/85), and the resolved Aspire.Cli graph contains Sigstore/Tuf 1.0.0 with BouncyCastle.Cryptography 2.7.0 and no NSec.Cryptography. Current CI has no failing or pending checks.

[aspire-repo-bot]

✅ No documentation update needed.

Step 5 branch taken: docs_optional -> build_or_ci_only (also fits dependency_bump).

Triggered signals: none (signal_count == 0, triggered_signals: []). only_test_or_build_changes is true (advisory only).

Changed-file globs justifying the category: both changed files match build/dependency config: Directory.Packages.props (NuGet central package version bump for Sigstore/Tuf 0.5.0 -> 1.0.0) and eng/Signing.props (third-party signing entry update for the new BouncyCastle.Cryptography transitive dependency, replacing NSec.Cryptography). No NuGet.config changes, no new/changed public APIs, CLI options, resource strings, or user-facing behavior - this is purely an internal dependency version bump plus corresponding internal build-signing metadata. No documentation update is required.

[github-actions]

⚠️ CI Failure Analysis: Possible Flaky Test(s)

The CI build failed due to test failure(s) that appear unrelated to the PR changes. These may be flaky tests.

Suspected flaky test(s):

• Aspire.Hosting.Python.Tests.AddPythonAppTests.PythonResourceSupportsWithReference in job Tests / Hosting.Python / Hosting.Python (windows-latest)
  • Error: System.InvalidOperationException : Failed to create virtual environment.
  • Stack Trace (first frames):

    at Aspire.Hosting.Python.Tests.AddPythonAppTests.PreparePythonProject(ITestOutputHelper outputHelper, String projectDirectory, String scriptContent, String requirementsContent) in D:\a\aspire\aspire\tests\Aspire.Hosting.Python.Tests\AddPythonAppTests.cs:line 327
       at Aspire.Hosting.Python.Tests.AddPythonAppTests.CreateTempPythonProject(...) line 275
       at Aspire.Hosting.Python.Tests.AddPythonAppTests.PythonResourceSupportsWithReference() line 126
    

  • Why likely flaky: Failure to create a Python venv is an environment/tooling issue on the Windows runner; the PR only touches Directory.Packages.props and eng/Signing.props, unrelated to Python hosting tests.
• Aspire.Dashboard.Tests.Model.DashboardClientTests.SubscribeResources_ReplicaStartedAtChanged_EmitsParentChange in job Tests / Dashboard / Dashboard (ubuntu-latest)
  • Error: Assert.Single() Failure: The collection contained 2 matching items
    Expected: (predicate expression)
    Collection: [ResourceViewModelChange { ChangeType = Upsert, ... }, ...]
    Match indices: 0, 3
  • Stack Trace (first frames):

    at Aspire.Dashboard.Tests.Model.DashboardClientTests.SubscribeResources_ReplicaStartedAtChanged_EmitsParentChange() in /_/tests/Aspire.Dashboard.Tests/Model/DashboardClientTests.cs:line 567
    

  • Why likely flaky: Known recurring race condition duplicating resource change events; matches prior cause dashboard-subscriberesources-replicastartedatchanged-flaky. Unrelated to PR's package version bump changes.

Suggested actions:

• Re-run the failed CI jobs to confirm if the failure is intermittent
• If the test continues to fail, consider quarantining it using /quarantine-test <test name> <issue URL>
• Search existing issues to see if this test is already known to be flaky

You can re-run the failed jobs from the workflow run page.