cesnimda
16ef3b9463
Pin the SDK feature band and commit transitive NuGet content hashes so CI fails on unreviewed dependency drift.
1.3 KiB
1.3 KiB
JT-017 .NET provenance verification
Implemented
global.jsonrequests .NET SDK9.0.317with patch-only roll-forward.- CI validates and installs that exact SDK instead of accepting any .NET 9 feature band.
- API and test projects opt into NuGet lock files.
- Both direct and transitive package versions carry NuGet content hashes in committed
packages.lock.jsonfiles. - CI restores both projects with
--locked-mode, so unreviewed graph drift fails before build or test.
Proof
- Clean forced lock generation completed from the declared projects.
- A subsequent locked restore passed.
- Full backend suite: 719/719 passed.
dotnet list JobTrackerApi/JobTrackerApi.csproj package --vulnerable --include-transitivereports no known vulnerable packages from the current NuGet source.
Remaining JT-017 scope
- Pin third-party CI actions and Docker images by reviewed immutable SHA/digest.
- Hash or replace the downloaded
dotnet-install.shbootstrap path. - Add policy-owned SBOM, container and tracked-secret gates.
- Resolve or formally isolate the remaining Torch/Transformers advisories under the model-loading threat path.
Those items require approved registry/action metadata or a separately reviewed scanner/update process; this increment does not invent immutable identifiers without verifying them.