Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clear NuGet security warnings #226

Merged
merged 2 commits into from
May 31, 2024
Merged

Clear NuGet security warnings #226

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f78bcd5
pass nuget security checks by removing MyGet
davidmrdavid May 31, 2024
f2b99e5
remove 2nd myget link
davidmrdavid May 31, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion nuget.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@

<configuration>
<packageSources>
<clear/>
<add key="nuget.org" value="https://www.nuget.org/api/v2/" />
<add key="azure-appservice-staging" value="https://www.myget.org/F/azure-appservice-staging/api/v3/index.json" />
<add key="azure-appservice" value="https://www.myget.org/F/azure-appservice/api/v3/index.json" />
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this will need to be removed or replaced with an ADO feed as well.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ah, I missed there were two of these. Fixing promptly

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jviau - fixed in next commit

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actually, I guess that if we only have nuget.org, we don't really need a nuget.config....but I think we'll eventually want to add the ADO feed so I'll keep it around

Copy link
Member

@jviau jviau May 31, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are expected to always have a nuget.config, because the <clear /> element is important. Otherwise you might pick up a nuget.config in a parent directory, or some other inherited sources. Which leaves this open to a potential supply-chain attack.

</packageSources>
</configuration>
Loading