DO NOT MERGE: Test Sigstore/Tuf 1.0.0 packages

[Mitch Denny (mitchdenny)]

Description

⚠️ DO NOT MERGE — temporary validation branch.

Bumps Sigstore and Tuf to stable 1.0.0 to validate the tightened verification implementation ahead of the packages being mirrored into the dnceng internal feeds. Opened purely to share validation results.

Validated in turn against 1.0.0-alpha.100.1.dd7cd33, then 1.0.0-beta.101.1.dd7cd33, now stable 1.0.0. All three were validated the same way and behaved identically.

Why NuGet.config changes are still needed

Stable 1.0.0 is on nuget.org, but not on the internal feeds — dnceng/dotnet-public still carries only up to 0.5.0, and it does not upstream-fetch 1.0.0 on demand:

Source	Sigstore / Tuf 1.0.0
nuget.org	Present
dnceng/dotnet-public	404, saved versions stop at 0.5.0

So this still temporarily points at nuget.org. Simply adding the source is not sufficient — three changes were required:

1. Add the nuget.org source.
2. Add a packageSourceMapping entry. Source mapping is enabled repo-wide, so an unmapped source is never consulted. The exact-name Sigstore/Tuf patterns beat the * patterns on the dnceng feeds via longest-prefix-match, so only these two packages resolve from nuget.org — everything else still comes from dnceng.
3. Add <clear /> to disabledPackageSources. User/machine-level NuGet configs commonly disable nuget.org, and the existing <clear /> in <packageSources> does not affect that section.

All three are annotated inline with TEMPORARY - DO NOT MERGE comments explaining what to revert.

Validation

Aspire.Cli builds with 0 warnings, 0 errors — no API breaks from the tightening. Full Aspire.Cli.Tests run on stable 1.0.0: 4957 passed, 0 failed (34 skipped, all Windows-only).

Worth calling out: the 85 SigstoreNpmProvenanceCheckerTests stub verification via an injected SigstoreBundleVerificationHandler, so they never execute real cryptography. Those passing is not by itself evidence the tightening works.

To get genuine coverage I ran a throwaway harness against the live npm attestation for @playwright/cli@0.1.18 (not included in this PR):

Scenario	Result
Genuine attestation	Verified, signed by .../publish.yml@refs/tags/v0.1.18
Wrong source repository	Rejected at the certificate-identity layer
Tampered SRI digest	PackageDigestMismatch — signature still valid, subject binding caught it

The tightened implementation accepts genuine provenance and correctly rejects both identity and digest tampering.

This harness was re-run against the beta and again against stable 1.0.0, producing identical results across all three scenarios each time.

CI failure root cause (not a Sigstore regression)

The first CI run failed on every job, including many with no Sigstore/Tuf reference at all (Milvus, Kafka, MongoDB, MySqlConnector, Dashboard). All failed at restore in ~40s–1m30s with NU1902/NU1903 on pre-existing transitive packages:

Microsoft.OpenApi 3.5.3, SSH.NET 2024.2.0, MessagePack 2.5.198, SharpCompress 0.30.1, Snappier 1.0.0

None are Sigstore or Tuf, none are in Directory.Packages.props, and none were touched by this diff.

Mechanism. NuGet audit is on by default but silently no-ops unless a configured source advertises a VulnerabilityInfo resource. The dnceng feeds expose none; nuget.org exposes VulnerabilityInfo/6.7.0. Adding nuget.org handed restore a vulnerability database for the first time, so audit began flagging long-standing transitive packages — and TreatWarningsAsErrors (Directory.Build.props) promoted those warnings into restore-breaking errors repo-wide.

Fix. Added <NuGetAudit>false</NuGetAudit> to Directory.Build.props, annotated as part of the same TEMPORARY - DO NOT MERGE block. Verified both directions on Aspire.Milvus.Client.Tests (a project with no Sigstore/Tuf reference):

Condition	Result
NuGetAudit=true	Reproduces CI exactly — NU1903 SSH.NET, GHSA-q939-rpr3-3284
Fix applied	Restores cleanly

Aspire.Cli builds 0 warnings / 0 errors and the full Aspire.Cli.Tests suite passes — including SdkDumpCommandTests.SdkDumpCi_ForHostingProject_DoesNotEmitWarnings, which previously tripped on Microsoft.OpenApi and now passes.

CI status after the fix

Merged latest main and re-ran. 355 checks pass (previously 0 — every job died at restore). The 4 remaining failures are pre-existing or infrastructure, none Sigstore/Tuf related:

Job	Cause	Evidence
Hosting.Sdk (windows-latest)	Pre-existing	Reverted my 3 files to main state locally and got the identical failures (ComputeRunArgumentsNormalizesRelativePathEntries, BuildFallsBackToDnxWhenPathAspireCliSetupTimesOut) — 100 ms-timeout tests from #19251
Hosting.Azure (ubuntu-latest)	Docker infra flake	All 7 failures: failed to bind host port ... 1433/tcp: address already in use
Aspire CLI Starter Validation (Windows)	Unrelated	TS starter aspire start exit 2. The aspire run path has no Sigstore involvement — the only consumers are PlaywrightCliInstaller and GitHubArtifactAttestationVerifier. Correlates with freshly-merged #15634 (TS AppHost dev cert)
VS Code extension E2E (Windows)	Timeout flake	Error: spawnSync dotnet ETIMEDOUT

Note: 1.0.0 swapped its crypto dependency

Sigstore 0.5.0 depended on NSec.Cryptography 25.4.0; 1.0.0 depends on BouncyCastle.Cryptography 2.7.0 instead. The dependency shape has been stable across alpha, beta, and stable (Sigstore → Tuf + BouncyCastle.Cryptography 2.7.0). Not implicated in any failure here, but worth being aware of for the real bump.

Before this can ship

Mirror Sigstore/Tuf 1.0.0 to dotnet-public, then revert both temporary changes — the entire NuGet.config block and <NuGetAudit>false</NuGetAudit> in Directory.Build.props — keeping only the Directory.Packages.props version bump.

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No — validation-only branch; real end-to-end verification was run out-of-band (results above).
• Did you add public API?
  • Yes
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No — this validates existing supply-chain verification behavior rather than introducing new guarantees. Note the temporary external feed must not merge.
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 19335

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 19335"

[Copilot]

Pull request overview

Temporarily validates tightened Sigstore/Tuf verification using prerelease packages.

Changes:

• Bumps Sigstore and Tuf to alpha builds.
• Temporarily enables nuget.org with restricted source mappings.
• Clears inherited disabled-package sources.

Show a summary per file

File	Description
NuGet.config	Temporarily enables and maps nuget.org.
Directory.Packages.props	Updates Sigstore and Tuf versions.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[Copilot]

Review details

Suppressed comments (2)

NuGet.config:28

• This adds an unapproved external package source, which the repository's internal build cannot consume. This block must not merge; mirror Sigstore/Tuf to an approved dnceng feed, then remove the nuget.org source, mapping, and inherited-disable override together.

    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />

Directory.Packages.props:152

• The package upgrade changes the production cryptographic verification implementation, but the existing SigstoreNpmProvenanceChecker tests inject a handler that bypasses real Sigstore verification (tests/Aspire.Cli.Tests/Agents/SigstoreNpmProvenanceCheckerTests.cs:1210-1213). Before shipping this bump, add deterministic automated coverage that invokes the real verifier for a genuine bundle and rejects identity/digest tampering; the out-of-band harness cannot catch future regressions in CI.

    <PackageVersion Include="Sigstore" Version="1.0.0-alpha.100.1.dd7cd33" />
    <PackageVersion Include="Tuf" Version="1.0.0-alpha.100.1.dd7cd33" />

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (2)

NuGet.config:28

• This external source cannot ship: repository policy permits only the dnceng feed domains because public feeds break the internal build pipeline (AGENTS.md:53-67). Mirror Sigstore/Tuf to an approved feed, then remove this source together with its mapping and inherited-disable override before approval.

    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />

Directory.Build.props:26

• This disables NuGet vulnerability auditing for every project in the repository, so restores will stop reporting NU1901-NU1904 advisories globally. It must be removed together with the temporary nuget.org source before this can be merged.

    <NuGetAudit>false</NuGetAudit>

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[Copilot]

Review details

Suppressed comments (5)

NuGet.config:28

• The root source list otherwise uses only approved dnceng feeds (NuGet.config:18-23); adding nuget.org breaks the internal build path. Before the version bump can merge, mirror these packages to dotnet-public and remove this source together with its mapping, disabled-source override, and audit suppression.

    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />

Directory.Build.props:26

• This disables NuGet vulnerability auditing for every project in the repository, so vulnerable dependencies can restore without NU1901-NU1904 diagnostics. Remove this suppression before merge and resolve the temporary feed/advisory behavior instead of globally bypassing the audit.

    <NuGetAudit>false</NuGetAudit>

NuGet.config:63

• This second temporary note also refers to the alpha even though the configured versions are beta builds.

         drops inherited disable entries so the Sigstore/Tuf alpha can be restored from nuget.org.

Directory.Packages.props:152

• This changes the security-sensitive cryptographic verification dependency, but the existing SigstoreNpmProvenanceChecker tests inject a handler that returns a prebuilt result (tests/Aspire.Cli.Tests/Agents/SigstoreNpmProvenanceCheckerTests.cs:1210-1213), so they cannot detect verifier regressions. Add checked-in coverage that exercises the real verifier with a known genuine bundle and rejection cases before shipping the bump.

    <PackageVersion Include="Sigstore" Version="1.0.0-beta.101.1.dd7cd33" />
    <PackageVersion Include="Tuf" Version="1.0.0-beta.101.1.dd7cd33" />

NuGet.config:24

• This comment still says the validation targets the alpha, but the package versions are now beta builds. Update it so the temporary configuration accurately describes what is being restored.

This issue also appears on line 63 of the same file.

    <!-- TEMPORARY - DO NOT MERGE: nuget.org is added solely to test the Sigstore/Tuf 1.0.0-alpha

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[github-actions]

Tests selector (audit mode)

The full test matrix and all jobs still run in audit mode. The tests and jobs below are what selective CI would run under enforcement.

Runs the full test matrix + all jobs (ALL) — a rule matching 'Directory.Build.props' selects ALL

---

Selection computed for commit 80b2022.

[Copilot]

Review details

Suppressed comments (4)

Directory.Build.props:26

• This disables vulnerability auditing for every package restored anywhere in the repository, hiding NU1901–NU1904 advisories unrelated to this experiment. Remove this temporary global opt-out before merge; validation-only invocations should suppress audit locally rather than weakening the repository default.

    <NuGetAudit>false</NuGetAudit>

NuGet.config:28

• This adds an unapproved external package source. Repository policy permits only dnceng feed domains because public feeds break the internal build pipeline. Before this can merge, mirror Sigstore/Tuf 1.0.0 to dotnet-public and remove this source together with its mapping and disabledPackageSources override.

    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />

NuGet.config:63

• This still describes restoring an alpha, but the changed dependency is stable 1.0.0. Keep the temporary configuration comment aligned with the version under test.

         drops inherited disable entries so the Sigstore/Tuf alpha can be restored from nuget.org.

NuGet.config:27

• This comment is stale: the package versions in Directory.Packages.props are stable 1.0.0, not 1.0.0-alpha. Update it so the temporary source's purpose matches the actual dependency being validated.

This issue also appears on line 63 of the same file.

    <!-- TEMPORARY - DO NOT MERGE: nuget.org is added solely to test the Sigstore/Tuf 1.0.0-alpha

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Balanced