Enable BinSkim for the product repos

[andriipatsula]

SDL config example: https://github.com/dotnet/runtime/blob/main/eng/sdl-tsa-vars.config
Build pipeline example: https://github.com/dotnet/windowsdesktop/blob/main/azure-pipelines.yml#L100-L103

List of product repos that have nightly validation

• https://github.com/dotnet/aspnetcore - Enable BinSkim scan in nightly validation aspnetcore#49324
• https://github.com/dotnet/efcore - Enable BinSkim scan in nightly validation efcore#31221
• https://github.com/dotnet/runtime - Enable BinSkim scan in nightly validation runtime#89728
• https://github.com/dotnet/msbuild - Enable BinSkim scan in nightly validation msbuild#8976
• https://github.com/dotnet/sdk - Enable BinSkim scan in nightly validation sdk#33901
• https://github.com/dotnet/installer - no need to scan as it's covered by the scans on other repos
• https://github.com/dotnet/winforms - Enable BinSkim scan in nightly validation winforms#9467
• https://github.com/dotnet/wpf - Enable BinSkim scan in nightly validation wpf#8016
• https://github.com/dotnet/windowsdesktop - Enable BinSkim scan in nightly validation windowsdesktop#3698
• https://github.com/microsoft/reverse-proxy - Enable BinSkim scan in nightly validation microsoft/reverse-proxy#2189

Product repos that run SDL validation in-line in their builds:

• https://github.com/dotnet/fsharp - Enable Binskim scan fsharp#15640
• https://github.com/dotnet/roslyn - Enable Binskim scan in CI builds roslyn#69081
• https://github.com/dotnet/templating - Enable BinSkim scan in CI builds templating#6872
• https://github.com/dotnet/razor - Enable Binskim scan in CI builds razor#8967
• https://github.com/dotnet/diagnostics - Enable Binskim scan in CI builds diagnostics#4087
• https://github.com/dotnet/xdt - Enable Binskim scan in CI builds xdt#519

Additional product repos (no SDL enabled for these repos).

We are not enabling BinSkim for these repos (based on the discussion with mmitche).

• https://github.com/dotnet/test-templates
• https://github.com/microsoft/vstest
• https://github.com/dotnet/emsdk
• https://github.com/dotnet/symreader
• https://github.com/dotnet/llvm-project
• https://github.com/dotnet/cecil
• https://github.com/dotnet/format
• https://github.com/dotnet/roslyn-analyzers
• https://github.com/dotnet/sourcelink
• https://dev.azure.com/dnceng/internal/_git/dotnet-wpf-int
• https://github.com/dotnet/xliff-tasks

[andriipatsula]

Commit example: https://dev.azure.com/dnceng/internal/_git/dotnet-arcade/commit/b41fa2738e7bb1a87cb21101725703e03b8191ab?refName=refs%2Fheads%2Fadd-binskim

But use -ArtifactToolsList @("binskim") instead of -SourceToolsList @("policheck","credscan","binskim") see: https://github.com/dotnet/arcade/blob/main/eng/common/sdl/execute-all-sdl-tools.ps1#L14C1-L16

[MilenaHristova]

The validation pipeline runs for a list of repos that's specified in https://dev.azure.com/dnceng/internal/_git/dotnet-release?path=/eng/pipeline/tools/repos-to-validate.txt

[andriipatsula]

linked PRs:
dotnet/windowsdesktop#3698
dotnet/msbuild#8976
dotnet/aspnetcore#49324
dotnet/razor#8938
dotnet/efcore#31221
dotnet/sdk#33901
dotnet/ef6#2131

[andriipatsula]

@MilenaHristova are we going to enable Binskim for the dotnet/arcade-services ? https://github.com/dotnet/arcade-services/blob/main/azure-pipelines.yml

[andriipatsula]

What about the dotnet/arcade https://github.com/dotnet/arcade/blob/main/azure-pipelines.yml ?
dotnet/dnceng https://github.com/dotnet/dnceng/blob/main/azure-pipelines.yml ?

[andriipatsula]

You can search for all repos using this query: https://github.com/search?q=repo%3Adotnet%2Fdotnet+%22%5C%22policheck%5C%22%22&type=code

[MilenaHristova]

@andriipatsula good question. My understanding was that we need to run it on the assets that are shipped as part of .NET.

[MilenaHristova]

You can search for all repos using this query: https://github.com/search?q=repo%3Adotnet%2Fdotnet+%22%5C%22policheck%5C%22%22&type=code

the repos that are not in this issue are
https://github.com/dotnet/diagnostics
https://github.com/dotnet/deployment-tools
https://github.com/dotnet/xdt
https://github.com/dotnet/arcade

[MilenaHristova]

BinSkim is now enabled for the full list of repos

[NikolaMilosavljevic]

@MilenaHristova @andriipatsula we need to enable Binskim in dotnet/deployment-tools repo. I looked at changes in some of the repos and it seems that this should be as simple as adding a single line to eng/sdl-tsa-vars.config:

-ArtifactToolsList @("binskim")

Is this all that's necessary for Binskim in deployment-tools repo?

[andriipatsula]

Hello @NikolaMilosavljevic , in your particular case you need to modify azure-pipelines.yml#L105-L106

1. Enable SDL validation (you have policheck and credscan specified in the configuration, but they are not enabled)
2. Add two lines to your pipeline as it was done for the dotnet/roslyn repository azure-pipelines-official.yml#L393-L394