Skip to content

Update Sigstore and Tuf to 1.0.0 #19335

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mitch Denny (mitchdenny) merged 9 commits into from
Aug 20, 2026
Merged

Update Sigstore and Tuf to 1.0.0 #19335

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
baacfd1
Test Sigstore/Tuf 1.0.0-alpha packages
mitchdenny Aug 13, 2026
6c4a064
Disable NuGet audit to unblock CI on the temporary nuget.org feed
mitchdenny Aug 13, 2026
180bf46
Merge remote-tracking branch 'origin/main' into mitchdenny-redesigned…
mitchdenny Aug 13, 2026
6875698
Bump Sigstore/Tuf to 1.0.0-beta.101.1.dd7cd33
mitchdenny Aug 14, 2026
80b2022
Bump Sigstore/Tuf to stable 1.0.0
mitchdenny Aug 14, 2026
380438e
Remove temporary nuget.org feed and NuGet audit workarounds
mitchdenny Aug 20, 2026
6cee38d
Merge remote-tracking branch 'origin/main' into mitchdenny-redesigned…
mitchdenny Aug 20, 2026
61aa027
Sign BouncyCastle.Cryptography instead of NSec.Cryptography
mitchdenny Aug 20, 2026
cf88f50
Drop explanatory comment from BouncyCastle signing entry
mitchdenny Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions Directory.Build.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,13 @@
<PackageProjectUrl>https://github.com/microsoft/aspire</PackageProjectUrl>
<WarnOnPackingNonPackableProject>false</WarnOnPackingNonPackableProject>
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
<!-- TEMPORARY - DO NOT MERGE: revert together with the nuget.org source in NuGet.config.
NuGet audit is enabled by default but is a no-op against the dnceng feeds, which do not
expose a VulnerabilityInfo resource. Adding nuget.org (which does expose one) supplies a
vulnerability database for the first time, so audit begins flagging pre-existing transitive
packages, and TreatWarningsAsErrors above promotes NU1901-NU1904 to restore-breaking errors
across the whole repo. None of these advisories are related to the Sigstore/Tuf bump. -->
<NuGetAudit>false</NuGetAudit>
Comment thread
mitchdenny marked this conversation as resolved.
Resolved
<EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
<GenerateDocumentationFile>true</GenerateDocumentationFile>
<SuppressNETCoreSdkPreviewMessage>true</SuppressNETCoreSdkPreviewMessage>
Expand Down
4 changes: 2 additions & 2 deletions Directory.Packages.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,8 +148,8 @@
<PackageVersion Include="YamlDotNet" Version="16.3.0" />
<PackageVersion Include="StreamJsonRpc" Version="2.25.29" />
<PackageVersion Include="Semver" Version="3.0.0" />
<PackageVersion Include="Sigstore" Version="0.5.0" />
<PackageVersion Include="Tuf" Version="0.5.0" />
<PackageVersion Include="Sigstore" Version="1.0.0-alpha.100.1.dd7cd33" />
<PackageVersion Include="Tuf" Version="1.0.0-alpha.100.1.dd7cd33" />
<PackageVersion Include="Microsoft.DevTunnels.Connections" Version="1.3.48" />
<!-- Open Telemetry -->
<PackageVersion Include="Azure.Monitor.OpenTelemetry.Exporter" Version="$(AzureMonitorOpenTelemetryExporterVersion)" />
Expand Down
17 changes: 17 additions & 0 deletions NuGet.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,11 @@
<add key="dotnet10" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet10/nuget/v3/index.json" />
<add key="dotnet-libraries" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-libraries/nuget/v3/index.json" />
<add key="dotnet9-transport" value="https://dnceng.pkgs.visualstudio.com/public/_packaging/dotnet9-transport/nuget/v3/index.json" />
<!-- TEMPORARY - DO NOT MERGE: nuget.org is added solely to test the Sigstore/Tuf 1.0.0-alpha
packages before they are mirrored into the dnceng internal feeds. External feeds break the
internal build pipeline, so this entry and its package source mapping below must be reverted
(and the packages mirrored to dotnet-public) before this change ships. -->
<add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
Comment thread
mitchdenny marked this conversation as resolved.
Resolved
</packageSources>
<packageSourceMapping>
<packageSource key="dotnet9-transport">
Expand All @@ -44,8 +49,20 @@
<packageSource key="dotnet-eng">
<package pattern="*" />
</packageSource>
<!-- TEMPORARY - DO NOT MERGE: see the nuget.org source comment above. These exact-name patterns
are more specific than the "*" patterns on the dnceng feeds, so NuGet's longest-prefix-match
resolves only Sigstore/Tuf from nuget.org; everything else still comes from dnceng. -->
<packageSource key="nuget.org">
<package pattern="Sigstore" />
<package pattern="Tuf" />
</packageSource>
</packageSourceMapping>
<disabledPackageSources>
<!-- TEMPORARY - DO NOT MERGE: the user/machine-level NuGet.config commonly disables nuget.org,
and the <clear /> in <packageSources> above does not affect this section. This <clear />
drops inherited disable entries so the Sigstore/Tuf alpha can be restored from nuget.org.
Revert with the rest of the temporary nuget.org changes. -->
<clear />
<!--Begin: Package sources managed by Dependency Flow automation. Do not edit the sources below.-->
<!-- Begin: Package sources from dotnet-dotnet -->
<!-- End: Package sources from dotnet-dotnet -->
Expand Down
Loading