From c037c2964172142e30972427be52e84e402a290a Mon Sep 17 00:00:00 2001 From: charlie4284 Date: Fri, 16 Oct 2026 04:16:11 +0000 Subject: [PATCH] fix(ci): bump NuGet packages with patched advisories before building Rebuilding a frozen upstream revision breaks as soon as an advisory for one of its pinned packages reaches NuGet's vulnerability feed, because upstream turns audit advisories into build errors (src/Directory.Build.props: NuGetAudit, NuGetAuditMode=all, NuGetAuditLevel=moderate, TreatWarningsAsErrors). The v2.338.0 linux-arm rebuild hit exactly that (Runner CI run 38847871799): src/Sdk/Sdk.csproj : error NU1902: Warning As Error: Package 'System.Security.Cryptography.Pkcs' 10.0.12 has a known moderate severity vulnerability, https://github.com/advisories/GHSA-2fmv-rv2c-59x7 src/Sdk/Sdk.csproj : error NU1903: ... known high severity vulnerability, https://github.com/advisories/GHSA-846f-f764-76mx Both advisories were published on 2026-10-13 (CVE-2026-70162, CVE-2026-84008) and are patched in System.Security.Cryptography.Pkcs 8.0.2 / 9.0.21 / 10.0.13. Upstream moved its pins in actions/runner#4777, which reached main via the patch sync (#242), but revisions cut before that keep the vulnerable pins: v2.338.0 pins 10.0.12, v2.337.0 10.0.11, v2.335.x/v2.336.0 10.0.7, v2.334.0 10.0.6, v2.332.0/v2.333.1 10.0.2 and v2.330.0/v2.331.0 8.0.0 - all affected, so all of them now fail to build (and the pins cannot be fixed in src/, which mirrors upstream). Runner CI and Runner CD now move the affected pins to the patched versions before building. The seds match only versions inside the affected ranges, so the step is a no-op on main (already 10.0.13) and on any revision that already pins a patched version. Packages that are not handled here still fail the build, so the NuGet audit keeps its signal. Verified on a v2.338.0 worktree with the linux-s390x patch applied: dotnet restore fails with the NU1902/NU1903 errors above before the step runs, and ./dev.sh layout Release linux-s390x completes with exit 0 and no NU19x diagnostics after it. --- .github/workflows/build.yml | 24 ++++++++++++++++++++++++ .github/workflows/release.yml | 24 ++++++++++++++++++++++++ 2 files changed, 48 insertions(+) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 41a357425a8..fd5274ed9c9 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -64,6 +64,30 @@ jobs: sed -i "s/${current_version}/8.0/" src/global.json fi + # Frozen upstream revisions (release branches, and rebuild branches such as + # arm-tarball-fix-2.338.0) keep the NuGet package versions that upstream pinned when + # the revision was cut. Upstream turns audit advisories into build errors + # (src/Directory.Build.props: NuGetAudit, NuGetAuditMode=all, + # NuGetAuditLevel=moderate, TreatWarningsAsErrors), so as soon as an advisory for one + # of those pins reaches NuGet's vulnerability feed, `dotnet restore` fails with + # NU1902/NU1903 and the revision can no longer be built at all. That is what broke + # Runner CI run 38847871799. Move the affected pins to the versions upstream already + # patched for those advisories (actions/runner#4777). Pins that are not listed here + # still fail the build, so the audit keeps its signal. + - name: Bump NuGet packages with patched advisories + run: | + # CVE-2026-84008 (high, GHSA-846f-f764-76mx) and CVE-2026-70162 (moderate, + # GHSA-2fmv-rv2c-59x7) in System.Security.Cryptography.Pkcs affect 8.0.0-8.0.1, + # 9.0.0-9.0.20 and 10.0.0-10.0.12, patched in 8.0.2, 9.0.21 and 10.0.13. + # Each sed matches only an affected version, so the step is a no-op on revisions + # that already pin a patched version (current main pins 10.0.13). + sed -i -E 's#System\.Security\.Cryptography\.Pkcs" Version="8\.0\.[01]"#System.Security.Cryptography.Pkcs" Version="8.0.2"#' src/Sdk/Sdk.csproj + sed -i -E 's#System\.Security\.Cryptography\.Pkcs" Version="9\.0\.([0-9]|1[0-9]|20)"#System.Security.Cryptography.Pkcs" Version="9.0.21"#' src/Sdk/Sdk.csproj + sed -i -E 's#System\.Security\.Cryptography\.Pkcs" Version="10\.0\.([0-9]|1[0-2])"#System.Security.Cryptography.Pkcs" Version="10.0.13"#' src/Sdk/Sdk.csproj + # Upstream bumps Formats.Asn1 in lockstep with Pkcs. + sed -i -E 's#System\.Formats\.Asn1" Version="10\.0\.([0-9]|1[0-2])"#System.Formats.Asn1" Version="10.0.13"#' src/Sdk/Sdk.csproj + grep -n -E 'System\.(Security\.Cryptography\.Pkcs|Formats\.Asn1)" Version=' src/Sdk/Sdk.csproj || true + # Build runner layout - name: Build & Layout Release run: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6f8293d56fb..c3a45a8bd99 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -102,6 +102,30 @@ jobs: sed -i "s/${current_version}/8.0/" src/global.json fi + # Frozen upstream revisions (release branches, and rebuild branches such as + # arm-tarball-fix-2.338.0) keep the NuGet package versions that upstream pinned when + # the revision was cut. Upstream turns audit advisories into build errors + # (src/Directory.Build.props: NuGetAudit, NuGetAuditMode=all, + # NuGetAuditLevel=moderate, TreatWarningsAsErrors), so as soon as an advisory for one + # of those pins reaches NuGet's vulnerability feed, `dotnet restore` fails with + # NU1902/NU1903 and the revision can no longer be built at all. That is what broke + # Runner CI run 38847871799. Move the affected pins to the versions upstream already + # patched for those advisories (actions/runner#4777). Pins that are not listed here + # still fail the build, so the audit keeps its signal. + - name: Bump NuGet packages with patched advisories + run: | + # CVE-2026-84008 (high, GHSA-846f-f764-76mx) and CVE-2026-70162 (moderate, + # GHSA-2fmv-rv2c-59x7) in System.Security.Cryptography.Pkcs affect 8.0.0-8.0.1, + # 9.0.0-9.0.20 and 10.0.0-10.0.12, patched in 8.0.2, 9.0.21 and 10.0.13. + # Each sed matches only an affected version, so the step is a no-op on revisions + # that already pin a patched version (current main pins 10.0.13). + sed -i -E 's#System\.Security\.Cryptography\.Pkcs" Version="8\.0\.[01]"#System.Security.Cryptography.Pkcs" Version="8.0.2"#' src/Sdk/Sdk.csproj + sed -i -E 's#System\.Security\.Cryptography\.Pkcs" Version="9\.0\.([0-9]|1[0-9]|20)"#System.Security.Cryptography.Pkcs" Version="9.0.21"#' src/Sdk/Sdk.csproj + sed -i -E 's#System\.Security\.Cryptography\.Pkcs" Version="10\.0\.([0-9]|1[0-2])"#System.Security.Cryptography.Pkcs" Version="10.0.13"#' src/Sdk/Sdk.csproj + # Upstream bumps Formats.Asn1 in lockstep with Pkcs. + sed -i -E 's#System\.Formats\.Asn1" Version="10\.0\.([0-9]|1[0-2])"#System.Formats.Asn1" Version="10.0.13"#' src/Sdk/Sdk.csproj + grep -n -E 'System\.(Security\.Cryptography\.Pkcs|Formats\.Asn1)" Version=' src/Sdk/Sdk.csproj || true + # Build runner layout - name: Build & Layout Release run: |