Clear NuGet security warnings #226
Conversation
nuget.config
Outdated
| <add key="nuget.org" value="https://www.nuget.org/api/v2/" /> | ||
| <add key="azure-appservice-staging" value="https://www.myget.org/F/azure-appservice-staging/api/v3/index.json" /> | ||
| <add key="azure-appservice" value="https://www.myget.org/F/azure-appservice/api/v3/index.json" /> |
There was a problem hiding this comment.
this will need to be removed or replaced with an ADO feed as well.
There was a problem hiding this comment.
ah, I missed there were two of these. Fixing promptly
There was a problem hiding this comment.
@jviau - fixed in next commit
There was a problem hiding this comment.
actually, I guess that if we only have nuget.org, we don't really need a nuget.config....but I think we'll eventually want to add the ADO feed so I'll keep it around
There was a problem hiding this comment.
You are expected to always have a nuget.config, because the <clear /> element is important. Otherwise you might pick up a nuget.config in a parent directory, or some other inherited sources. Which leaves this open to a potential supply-chain attack.
This is the DTFx-MSSQL version of this PR: Azure/azure-functions-durable-extension#2842
As part of the 1ES migration, we have new supply chain requirements around our repo's nuget.config files.
In particular, we're getting errors due to use MyGet. This PR removes our MyGet usage. It also addresses warnings regarding missing
<clear/>statements.