✨ Support Nuget Pinned Dependency with RestoreLockedMode attribute #4351

balteravishay · 2024-09-18T12:49:48Z

What kind of change does this PR introduce?

Support pinning dependency in .NET using lockfile by declaring the RestoreLockedMode attribute in csproj

PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

checking for nuget pinned dependency attributes only CLI locked mode flags (i.e. --locked-mode) and if not found the score is 0.

What is the new behavior (if this is a feature change)?**

if nuget cli command found that is not locked with the CLI flag, a post-processing method checks for csproj files in the repo and scores according to the number of them that are declaring RestoreLockedMode attribute set to true.

Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Fixes #4251

Special notes for your reviewer

This implementation for this fix, using post processing method, was discussed with @spencerschrock in the Scorecard community call.
There is an upcoming PR that will compliment the behaviour by adding support for Central Package Management that will also be performing post processing to look for another file type (Directory.Packages.props) where this feature is enabled.

Does this PR introduce a user-facing change?

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

NONE

spencerschrock

Not a full review, just wanted to tackle a question around the approach.

checks/fileparser/csproj_parser.go

checks/raw/pinned_dependencies.go

balteravishay · 2024-09-29T20:53:11Z

here are a number of repos to test this change on:

https://github.com/Mongo2Go/Mongo2Go - has 3 csproj files, only 1 is locked. according to the new logic, this maintains the unpinned dependency state of the found "hits" and updates the Remediation.
Sn0wCrack/saucybot-discord - has 1 csproj file that is locked. 2 nuget dependencies that are found as unpinned are set to pinned at the post-process stage.

Signed-off-by: balteraivshay <[email protected]> Signed-off-by: balteraivshay <[email protected]>

Signed-off-by: balteraivshay <[email protected]>

…#4317) Signed-off-by: Spencer Schrock <[email protected]> Signed-off-by: balteraivshay <[email protected]>

Signed-off-by: balteraivshay <[email protected]>

…4343) Signed-off-by: balteraivshay <[email protected]>

…sf#4356) Signed-off-by: balteraivshay <[email protected]>

Signed-off-by: balteraivshay <[email protected]>

spencerschrock · 2024-10-03T17:52:07Z

/scdiff generate Pinned-Dependencies

github-actions · 2024-10-03T17:52:21Z

Here's a link to the scdiff run

balteravishay had a problem deploying to gitlab September 18, 2024 12:50 — with GitHub Actions Failure

balteravishay had a problem deploying to integration-test September 18, 2024 12:50 — with GitHub Actions Failure

balteravishay temporarily deployed to gitlab September 18, 2024 13:23 — with GitHub Actions Inactive

balteravishay force-pushed the support-restorelockedmode branch from 7d30eeb to c50d2b8 Compare September 18, 2024 13:23

balteravishay temporarily deployed to gitlab September 18, 2024 13:24 — with GitHub Actions Inactive

balteravishay temporarily deployed to integration-test September 18, 2024 13:24 — with GitHub Actions Inactive

balteravishay temporarily deployed to gitlab September 18, 2024 13:50 — with GitHub Actions Inactive

balteravishay temporarily deployed to integration-test September 18, 2024 13:50 — with GitHub Actions Inactive

balteravishay marked this pull request as ready for review September 18, 2024 13:50

balteravishay requested a review from a team as a code owner September 18, 2024 13:50

balteravishay requested review from justaugustus and spencerschrock and removed request for a team September 18, 2024 13:50

spencerschrock reviewed Sep 18, 2024

View reviewed changes

checks/fileparser/csproj_parser.go Outdated Show resolved Hide resolved

checks/fileparser/csproj_parser.go Outdated Show resolved Hide resolved

checks/raw/pinned_dependencies.go Outdated Show resolved Hide resolved

checks/raw/pinned_dependencies.go Outdated Show resolved Hide resolved

balteravishay had a problem deploying to gitlab September 19, 2024 09:10 — with GitHub Actions Failure

balteravishay had a problem deploying to integration-test September 19, 2024 09:10 — with GitHub Actions Failure

balteravishay temporarily deployed to gitlab September 19, 2024 11:45 — with GitHub Actions Inactive

balteravishay temporarily deployed to integration-test September 19, 2024 11:45 — with GitHub Actions Inactive

spencerschrock reviewed Sep 25, 2024

View reviewed changes

checks/raw/pinned_dependencies.go Outdated Show resolved Hide resolved

checks/raw/pinned_dependencies.go Outdated Show resolved Hide resolved

balteravishay temporarily deployed to gitlab September 27, 2024 13:44 — with GitHub Actions Inactive

balteravishay temporarily deployed to integration-test September 27, 2024 13:44 — with GitHub Actions Inactive

balteravishay temporarily deployed to gitlab September 29, 2024 20:45 — with GitHub Actions Inactive

balteravishay temporarily deployed to integration-test September 29, 2024 20:45 — with GitHub Actions Inactive

balteravishay force-pushed the support-restorelockedmode branch from 1d68b81 to d1bbb7b Compare September 29, 2024 20:45

balteravishay temporarily deployed to gitlab September 29, 2024 20:59 — with GitHub Actions Inactive

balteravishay temporarily deployed to integration-test September 29, 2024 20:59 — with GitHub Actions Inactive

balteravishay temporarily deployed to gitlab September 29, 2024 20:59 — with GitHub Actions Inactive

balteravishay temporarily deployed to integration-test September 29, 2024 21:00 — with GitHub Actions Inactive

balteravishay requested a review from spencerschrock September 29, 2024 21:02

balteravishay and others added 16 commits October 3, 2024 16:08

fix using error

136c2bf

Signed-off-by: balteraivshay <[email protected]> Signed-off-by: balteraivshay <[email protected]>

PR fixes

2f7ddd7

Signed-off-by: balteraivshay <[email protected]>

fix test

de3aa58

Signed-off-by: balteraivshay <[email protected]>

🌱 Bump github.com/onsi/gomega from 1.34.1 to 1.34.2 (ossf#4332)

3a7de56

Signed-off-by: balteraivshay <[email protected]>

📖 explicitly state both check documentation files are committed (ossf…

983e978

…#4317) Signed-off-by: Spencer Schrock <[email protected]> Signed-off-by: balteraivshay <[email protected]>

🌱 Bump cloud.google.com/go/pubsub from 1.42.0 to 1.43.0 (ossf#4350)

f87657f

Signed-off-by: balteraivshay <[email protected]>

🌱 Bump github.com/google/osv-scanner from 1.8.4 to 1.8.5 (ossf#4355)

ba19c8b

Signed-off-by: balteraivshay <[email protected]>

🌱 Bump the distroless group across 6 directories with 1 update (ossf#…

379ec5f

…4343) Signed-off-by: balteraivshay <[email protected]>

🌱 Bump the github-actions group across 1 directory with 2 updates (os…

ccce3e9

…sf#4356) Signed-off-by: balteraivshay <[email protected]>

🌱 Bump github.com/rhysd/actionlint from 1.7.1 to 1.7.2 (ossf#4358)

80f126b

Signed-off-by: balteraivshay <[email protected]>

fix pr %e comment

3b709f1

Signed-off-by: balteraivshay <[email protected]>

fix PR comments

3430457

Signed-off-by: balteraivshay <[email protected]>

Co-authored-by: Ioana A <[email protected]>

32891dc

Signed-off-by: balteraivshay <[email protected]>

merge main

4c93325

Signed-off-by: balteraivshay <[email protected]>

pr comments

d368af1

Signed-off-by: balteraivshay <[email protected]>

fix last comments

c5ac83f

Signed-off-by: balteraivshay <[email protected]>

balteravishay force-pushed the support-restorelockedmode branch from d092c5e to c5ac83f Compare October 3, 2024 16:16

balteravishay temporarily deployed to gitlab October 3, 2024 16:17 — with GitHub Actions Inactive

Merge branch 'main' into support-restorelockedmode

c43dd68

balteravishay temporarily deployed to gitlab October 3, 2024 16:17 — with GitHub Actions Inactive

balteravishay temporarily deployed to integration-test October 3, 2024 16:17 — with GitHub Actions Inactive

Merge branch 'main' into support-restorelockedmode

fa2e0bc

spencerschrock temporarily deployed to gitlab October 3, 2024 19:28 — with GitHub Actions Inactive

spencerschrock temporarily deployed to integration-test October 3, 2024 19:28 — with GitHub Actions Inactive

spencerschrock enabled auto-merge (squash) October 3, 2024 19:29

spencerschrock merged commit 41f91ed into ossf:main Oct 3, 2024
36 checks passed

balteravishay mentioned this pull request Oct 6, 2024

✨ Support Nuget Central Package Management #4369

Open

2 tasks

balteravishay mentioned this pull request Oct 15, 2024

BUG Pinned Dependency checks for nuget/.Net does not consider implicit restore #4381

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ Support Nuget Pinned Dependency with RestoreLockedMode attribute #4351

✨ Support Nuget Pinned Dependency with RestoreLockedMode attribute #4351

balteravishay commented Sep 18, 2024

spencerschrock left a comment

balteravishay commented Sep 29, 2024

spencerschrock commented Oct 3, 2024

github-actions bot commented Oct 3, 2024

✨ Support Nuget Pinned Dependency with RestoreLockedMode attribute #4351

✨ Support Nuget Pinned Dependency with RestoreLockedMode attribute #4351

Conversation

balteravishay commented Sep 18, 2024

What kind of change does this PR introduce?

What is the current behavior?

What is the new behavior (if this is a feature change)?**

Which issue(s) this PR fixes

Special notes for your reviewer

Does this PR introduce a user-facing change?

spencerschrock left a comment

Choose a reason for hiding this comment

balteravishay commented Sep 29, 2024

spencerschrock commented Oct 3, 2024

github-actions bot commented Oct 3, 2024