Only allow certain packages in source build (#5178)

NuGet · May 24, 2023 · 8993787 · 8993787
1 parent c954cf4
commit 8993787
Show file tree

Hide file tree

Showing 2 changed files with 34 additions and 2 deletions.
diff --git a/Directory.Packages.props b/Directory.Packages.props
@@ -126,7 +126,7 @@
 
   <ItemGroup>
     <GlobalPackageReference Include="Microsoft.SourceLink.GitHub" Version="1.0.0" Condition="'$(Shipping)' == 'true' AND '$(IsXPlat)' != 'true'" />
-    <GlobalPackageReference Include="Microsoft.VisualStudioEng.MicroBuild.Core" version="1.0.0" />
+    <GlobalPackageReference Include="Microsoft.VisualStudioEng.MicroBuild.Core" version="1.0.0" Condition=" '$(DotNetBuildFromSource)' != 'true' " />
   </ItemGroup>
 
   <ItemGroup Condition=" '$(UsePublicApiAnalyzer)' == 'true' ">
@@ -153,4 +153,36 @@
     <GlobalPackageReference Include="Microsoft.CodeAnalysis.BannedApiAnalyzers" Version="3.3.3" />
     <AdditionalFiles Include="$(MSBuildThisFileDirectory)build\BannedSymbols.txt" Condition="'$(TestProject)' != 'true'" />
   </ItemGroup>
+
+  <!-- DotNetBuildFromSource can only use packages that are open source -->
+  <Target Name="CheckSourceBuildPackageReferences" AfterTargets="CollectPackageReferences" Condition=" '$(DotNetBuildFromSource)' == 'true' ">
+    <ItemGroup>
+      <_allowBuildFromSourcePackage Remove="@(_allowBuildFromSourcePackage)" />
+      <_sourceBuildUnexpectedPackage Remove="@(_sourceBuildUnexpectedPackage)" />
+
+      <_allowBuildFromSourcePackage Include="@(PackageReference)" Condition=" '%(PackageReference.IsImplicitlyDefined)' == 'true' " />
+
+      <_allowBuildFromSourcePackage Include="Microsoft.Build.Framework" />
+      <_allowBuildFromSourcePackage Include="Microsoft.Build.Tasks.Core" />
+      <_allowBuildFromSourcePackage Include="Microsoft.Build.Utilities.Core" />
+      <_allowBuildFromSourcePackage Include="Microsoft.Build" />
+      <_allowBuildFromSourcePackage Include="Microsoft.CSharp" />
+      <_allowBuildFromSourcePackage Include="Microsoft.Extensions.CommandLineUtils.Sources" />
+      <_allowBuildFromSourcePackage Include="Microsoft.Extensions.FileProviders.Abstractions" />
+      <_allowBuildFromSourcePackage Include="Microsoft.Extensions.FileSystemGlobbing" />
+      <_allowBuildFromSourcePackage Include="Microsoft.SourceLink.AzureRepos.Git" />
+      <_allowBuildFromSourcePackage Include="Microsoft.SourceLink.GitHub" />
+      <_allowBuildFromSourcePackage Include="Microsoft.Web.Xdt" />
+      <_allowBuildFromSourcePackage Include="Newtonsoft.Json" />
+      <_allowBuildFromSourcePackage Include="System.ComponentModel.Composition" />
+      <_allowBuildFromSourcePackage Include="System.Diagnostics.Debug" />
+      <_allowBuildFromSourcePackage Include="System.Security.Cryptography.Cng" />
+      <_allowBuildFromSourcePackage Include="System.Security.Cryptography.Pkcs" />
+      <_allowBuildFromSourcePackage Include="System.Security.Cryptography.ProtectedData" />
+
+      <_sourceBuildUnexpectedPackage Include="@(PackageReference)" Exclude="@(_allowBuildFromSourcePackage)" />
+    </ItemGroup>
+    <Error Text="Found @(_sourceBuildUnexpectedPackage-&gt;Count()) PackageReferences not on DotNetBuildFromSource allow list: '@(_sourceBuildUnexpectedPackage)'" Condition=" '@(_sourceBuildUnexpectedPackage)' != '' " />
+  </Target>
+
 </Project>
diff --git a/src/NuGet.Core/NuGet.Build.Tasks.Pack/NuGet.Build.Tasks.Pack.csproj b/src/NuGet.Core/NuGet.Build.Tasks.Pack/NuGet.Build.Tasks.Pack.csproj
@@ -37,7 +37,7 @@
   </ItemGroup>
 
   <ItemGroup>
-    <PackageReference Include="ILMerge" PrivateAssets="All" />
+    <PackageReference Include="ILMerge" PrivateAssets="All" Condition=" '$(DotNetBuildFromSource)' != 'true' " />
   </ItemGroup>
 
   <ItemGroup Condition=" '$(IsCore)' == 'true' ">