cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

build(dotnet): lock SDK and packages

Browse Source 
Pin the SDK feature band and commit transitive NuGet content hashes so CI fails on unreviewed dependency drift.
This commit is contained in:
cesnimda
2026-08-30 11:17:32 +02:00
parent 19c5251612
commit 16ef3b9463
10 changed files with 1246 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/verification/jt-017-dotnet-provenance.md
+25
View File
@@ -0,0 +1,25 @@
# JT-017 .NET provenance verification
## Implemented
- `global.json` requests .NET SDK `9.0.317` with patch-only roll-forward.
- CI validates and installs that exact SDK instead of accepting any .NET 9 feature band.
- API and test projects opt into NuGet lock files.
- Both direct and transitive package versions carry NuGet content hashes in committed `packages.lock.json` files.
- CI restores both projects with `--locked-mode`, so unreviewed graph drift fails before build or test.
## Proof
- Clean forced lock generation completed from the declared projects.
- A subsequent locked restore passed.
- Full backend suite: 719/719 passed.
- `dotnet list JobTrackerApi/JobTrackerApi.csproj package --vulnerable --include-transitive` reports no known vulnerable packages from the current NuGet source.
## Remaining JT-017 scope
- Pin third-party CI actions and Docker images by reviewed immutable SHA/digest.
- Hash or replace the downloaded `dotnet-install.sh` bootstrap path.
- Add policy-owned SBOM, container and tracked-secret gates.
- Resolve or formally isolate the remaining Torch/Transformers advisories under the model-loading threat path.
Those items require approved registry/action metadata or a separately reviewed scanner/update process; this increment does not invent immutable identifiers without verifying them.