NuGetPackageDownloader: Stop verifying the package signature on Mac and queue off of the environment on Linux #47463
Conversation
…tnet#47321) Co-authored-by: Noah Gilson <OTAKUPENGUINOP@GMAIL.COM> Co-authored-by: Forgind <12969783+Forgind@users.noreply.github.com>
dotnet-issue-labeler
bot
added
Area-Workloads
untriaged
There was a problem hiding this comment.
Pull Request Overview
This PR updates the NuGet package downloader to verify package signatures only on Windows by default while providing an override via an environment variable, and ensures that packages failing verification are deleted.
- Added XML documentation for the _verifySignatures field.
- Updated the constructor logic to conditionally verify signatures based on the operating system and an environment variable.
- Wrapped the signature verification in a try-catch to delete packages that fail verification.
edvilme
changed the title
There was a problem hiding this comment.
@mmitche @marcpopMSFT Does this change mean we will need to take a new p2 build again? Dotnet tool install on mac for tools with old certificates will fail without this change (was considered important to service 9.0.200.)
|
@nagilson They are taking another change from Aracade so decided to include this as well. |
|
I would say this doesn't need tactics approval because it was approved for 9.0.2xx, which should be a higher bar than 10.0.1xx-p2. Is that correct? |
It got tactics approval. It still needs that even for these because preview 2 is on a build by build slip so we can't just check in anything. This is only allowed because another change was going in. |
Backport of #47321