Conversation
We can't use nuget.org in this manner to comply with security guidance
ghost
added
the
|
Tagging subscribers to this area: @dotnet/ncl Issue DetailsWe can't use nuget.org in this manner to comply with security guidance.
|
|
Once the HttpStress tests build I'll merge this to unblock the JIT rolling builds. |
ManickaP
left a comment
ManickaP
left a comment
There was a problem hiding this comment.
I think this will break our stress pipeline. Could we run it before we merge?
| <packageSources> | ||
| <!-- Add public nuget feed. --> | ||
| <add key="nuget.org" value="https://api.nuget.org/v3/index.json" /> | ||
| <clear /> |
There was a problem hiding this comment.
Why do you clear this? We need what's in repository wide nuget.config
There was a problem hiding this comment.
If this is true, then you should not have this file at all. We don't allow nuget.org. Let me delete this and we'll see the fallout. FYI, this already broke other partners within the runtime repo.
There was a problem hiding this comment.
Let's try. BTW, /azp run runtime-libraries stress-http is the magic to run the pipeline.
There was a problem hiding this comment.
One more thing, can we import packages from nuget.org to dotnet-public if they are missing? What's the process for that?
| <!-- Add public nuget feed. --> | ||
| <add key="nuget.org" value="https://api.nuget.org/v3/index.json" /> | ||
| <clear /> | ||
| <add key="dotnet-public" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json" /> |
There was a problem hiding this comment.
Will all the packages we use be there? Could you run the stress pipeline on this PR? It's not part of inner loop.
|
/azp run runtime-libraries stress-http |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run runtime-libraries stress-http |
|
Azure Pipelines successfully started running 1 pipeline(s). |
ManickaP
left a comment
ManickaP
left a comment
There was a problem hiding this comment.
The http stress pipeline run for the last change.
I don't want to wait for it, so approving, thanks.
|
The pipeline looks good |
6 participants
We can't use nuget.org in this manner to comply with security guidance.