Joseph Doherty
5e9cbd3ecf
Packing Secrets 0.1.3 surfaced NU1903: Microsoft.Data.Sqlite 10.0.7 pulls SQLitePCLRaw.lib.e_sqlite3 2.1.11, which carries high-severity advisory GHSA-2m69-gcr7-jv3q. Auth.ApiKeys had the same exposure and was already shipped at 0.1.4 to three consumers, so both libs are fixed rather than only the one being published. Fixed the way ZB.MOM.WW.LocalDb already had it: CentralPackageTransitivePinningEnabled plus a pin to the patched 2.1.12. Bumping Microsoft.Data.Sqlite does not help -- even 10.0.10 still resolves 2.1.11 -- so the pin is the actual fix. The pin reaches consumers: both nuspecs now declare SQLitePCLRaw.lib.e_sqlite3 >= 2.1.12 as a direct dependency, verified by restoring the published packages into a scratch project, which resolves 2.1.12 and scans clean. Auth goes 0.1.4 -> 0.1.5 with no API change (0.1.4 plus the pin). Suites re-run after the native-lib swap with identical counts, so no behavioral regression: Secrets 97 pass/1 skip, Auth 215 pass/1 skip (both skips are Windows-only DPAPI and opt-in LDAP). Consumers are NOT yet bumped and remain on vulnerable versions: mxaccessgw 0.1.4, HistorianGateway 0.1.4, ScadaBridge 0.1.3. Secrets consumers all sit at 0.1.2 and also lack KEK rotation. Claude-Session: https://claude.ai/code/session_01BL2Vu1ESDQ9SCN4gVKkdts
25 lines
893 B
Bash
Executable File
25 lines
893 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# push.sh — pack and push the ZB.MOM.WW.Secrets NuGet packages to the Gitea feed.
|
|
#
|
|
# Required environment variables:
|
|
# GITEA_NUGET_SOURCE — full URL of the Gitea NuGet feed
|
|
# e.g. https://gitea.dohertylan.com/api/packages/dohertj2/nuget/index.json
|
|
# GITEA_NUGET_KEY — Gitea access token with package:write permission
|
|
#
|
|
# Usage:
|
|
# export GITEA_NUGET_SOURCE="https://gitea.dohertylan.com/api/packages/dohertj2/nuget/index.json"
|
|
# export GITEA_NUGET_KEY="your-gitea-token"
|
|
# ./build/push.sh
|
|
|
|
set -euo pipefail
|
|
|
|
: "${GITEA_NUGET_SOURCE:?set GITEA_NUGET_SOURCE to your Gitea NuGet feed URL}"
|
|
: "${GITEA_NUGET_KEY:?set GITEA_NUGET_KEY to your Gitea access token}"
|
|
|
|
dotnet pack -c Release -o ./artifacts
|
|
|
|
dotnet nuget push "./artifacts/*.nupkg" \
|
|
--source "$GITEA_NUGET_SOURCE" \
|
|
--api-key "$GITEA_NUGET_KEY" \
|
|
--skip-duplicate
|