From 1a3cc1ed75312b9163b816bfa8e03a45901ab207 Mon Sep 17 00:00:00 2001
From: Viktor Hofer <viktor.hofer@microsoft.com>
Date: Tue, 27 Aug 2024 16:48:26 +0200
Subject: [PATCH] Enable NuGetAudit (#8318)

* Enable NuGetAudit

Contributes to https://github.com/dotnet/arcade/issues/15019

Also remove the unnecessary `SystemFormatsAsn1Version` property.

* Update NuGet.config
---
 Directory.Build.props    |  3 +++
 Directory.Packages.props | 11 +++++++----
 NuGet.config             | 23 +++++------------------
 eng/Versions.props       |  4 ----
 4 files changed, 15 insertions(+), 26 deletions(-)

diff --git a/Directory.Build.props b/Directory.Build.props
index ee780122bdb..3f80822baa2 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -24,6 +24,9 @@
     <TemplateEnginePublicKey>0024000004800000940000000602000000240000525341310004000001000100f33a29044fa9d740c9b3213a93e57c84b472c84e0b8a0e1ae48e67a9f8f6de9d5f7f3d52ac23e48ac51801f1dc950abe901da34d2a9e3baadb141a17c77ef3c565dd5ee5054b91cf63bb3c6ab83f72ab3aafe93d0fc3c2348b764fafb0b1c0733de51459aeab46580384bf9d74c4e28164b7cde247f891ba07891c9d872ad2bb</TemplateEnginePublicKey>
     <DynamicProxyGenAssembly2PublicKey>0024000004800000940000000602000000240000525341310004000001000100c547cac37abd99c8db225ef2f6c8a3602f3b3606cc9891605d02baa56104f4cfc0734aa39b93bf7852f7d9266654753cc297e7d2edfe0bac1cdcf9f717241550e0a7b191195b7667bb4f64bcb8e2121380fd1d9d46ad2d92d2d15605093924cceaf74c4861eff62abf69b9291ed0a340e113be11e6a7d3113e92484cf7045cc7</DynamicProxyGenAssembly2PublicKey>
 
+    <!-- Only upgrade NuGetAudit warnings to errors for official builds. -->
+    <WarningsNotAsErrors Condition="'$(OfficialBuild)' != 'true'">$(WarningsNotAsErrors);NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>
+
     <EnableAnalyzers>true</EnableAnalyzers>
     <!-- Disable analyzers in sourcebuild -->
     <EnableAnalyzers Condition="'$(DotNetBuildSourceOnly)' == 'true'">false</EnableAnalyzers>
diff --git a/Directory.Packages.props b/Directory.Packages.props
index 67e8b2d41c8..1331a4385e2 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -27,8 +27,9 @@
     <PackageVersion Include="Microsoft.Extensions.Logging.Abstractions" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Logging.Console" Version="8.0.0" />
     <PackageVersion Include="Microsoft.Extensions.Logging" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.IO.Redist" Version="6.0.1" />
-    <PackageVersion Include="System.Formats.Asn1" Version="$(SystemFormatsAsn1Version)" />
+    <PackageVersion Include="Microsoft.IO.Redist" Version="6.0.1" /> <!-- Pin transitive dependency to avoid vulnerable 6.0.0 version. -->
+    <PackageVersion Include="System.Formats.Asn1" Version="8.0.1" /> <!-- Pin transitive dependency to avoid vulnerable 8.0.0 version. -->
+    <PackageVersion Include="System.Text.Json" Version="8.0.4" /> <!-- Pin transitive dependency to avoid vulnerable 8.0.0 version. -->
   </ItemGroup>
 
   <!-- External dependencies -->
@@ -45,7 +46,7 @@
     <PackageVersion Include="xunit.extensibility.execution" Version="$(XUnitVersion)" />
   </ItemGroup>
 
-  <!-- DotNetBuild overrides -->
+  <!-- DotNetBuild overrides needed until https://github.com/dotnet/source-build/issues/4467 is implemented. -->
   <ItemGroup>
     <PackageVersion Update="Microsoft.Build.Framework" Version="$(MicrosoftBuildFrameworkVersion)" Condition="'$(MicrosoftBuildFrameworkVersion)' != ''" />
     <PackageVersion Update="Microsoft.Build.Utilities.Core" Version="$(MicrosoftBuildUtilitiesCoreVersion)" Condition="'$(MicrosoftBuildUtilitiesCoreVersion)' != ''" />
@@ -57,6 +58,8 @@
     <PackageVersion Update="NuGet.Configuration" Version="$(NuGetConfigurationVersion)" Condition="'$(NuGetConfigurationVersion)' != ''" />
     <PackageVersion Update="NuGet.Credentials" Version="$(NuGetCredentialsVersion)" Condition="'$(NuGetCredentialsVersion)' != ''" />
     <PackageVersion Update="NuGet.Protocol" Version="$(NuGetProtocolVersion)" Condition="'$(NuGetProtocolVersion)' != ''" />
+    <PackageVersion Update="System.Formats.Asn1" Version="$(SystemFormatsAsn1Version)" Condition="'$(SystemFormatsAsn1Version)' != ''" />
+    <PackageVersion Update="System.Text.Json" Version="$(SystemTextJsonVersion)" Condition="'$(SystemTextJsonVersion)' != ''" />
   </ItemGroup>
 
-</Project>
\ No newline at end of file
+</Project>
diff --git a/NuGet.config b/NuGet.config
index ced55102a9a..db34d499431 100644
--- a/NuGet.config
+++ b/NuGet.config
@@ -2,15 +2,6 @@
 <configuration>
   <packageSources>
     <clear />
-    <!--Begin: Package sources managed by Dependency Flow automation. Do not edit the sources below.-->
-    <!--  Begin: Package sources from dotnet-runtime -->
-    <add key="darc-int-dotnet-runtime-2aade6b" value="https://pkgs.dev.azure.com/dnceng/internal/_packaging/darc-int-dotnet-runtime-2aade6be/nuget/v3/index.json" />
-    <add key="darc-int-dotnet-runtime-2aade6b-5" value="https://pkgs.dev.azure.com/dnceng/internal/_packaging/darc-int-dotnet-runtime-2aade6be-5/nuget/v3/index.json" />
-    <add key="darc-int-dotnet-runtime-2aade6b-3" value="https://pkgs.dev.azure.com/dnceng/internal/_packaging/darc-int-dotnet-runtime-2aade6be-3/nuget/v3/index.json" />
-    <add key="darc-int-dotnet-runtime-2aade6b-2" value="https://pkgs.dev.azure.com/dnceng/internal/_packaging/darc-int-dotnet-runtime-2aade6be-2/nuget/v3/index.json" />
-    <add key="darc-int-dotnet-runtime-2aade6b-1" value="https://pkgs.dev.azure.com/dnceng/internal/_packaging/darc-int-dotnet-runtime-2aade6be-1/nuget/v3/index.json" />
-    <!--  End: Package sources from dotnet-runtime -->
-    <!--End: Package sources managed by Dependency Flow automation. Do not edit the sources above.-->
     <add key="dotnet-public" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json" />
     <add key="dotnet-eng" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" />
     <add key="dotnet-tools" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json" />
@@ -18,15 +9,11 @@
     <add key="dotnet9" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet9/nuget/v3/index.json" />
     <add key="dotnet9-transport" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet9-transport/nuget/v3/index.json" />
   </packageSources>
+  <auditSources>
+    <clear />
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+  </auditSources>
   <disabledPackageSources>
-    <!--Begin: Package sources managed by Dependency Flow automation. Do not edit the sources below.-->
-    <!--  Begin: Package sources from dotnet-runtime -->
-    <add key="darc-int-dotnet-runtime-2aade6b-1" value="true" />
-    <add key="darc-int-dotnet-runtime-2aade6b-2" value="true" />
-    <add key="darc-int-dotnet-runtime-2aade6b-3" value="true" />
-    <add key="darc-int-dotnet-runtime-2aade6b-5" value="true" />
-    <add key="darc-int-dotnet-runtime-2aade6b" value="true" />
-    <!--  End: Package sources from dotnet-runtime -->
-    <!--End: Package sources managed by Dependency Flow automation. Do not edit the sources above.-->
+    <clear />
   </disabledPackageSources>
 </configuration>
diff --git a/eng/Versions.props b/eng/Versions.props
index 5c3df6e46e4..8e008007ca0 100644
--- a/eng/Versions.props
+++ b/eng/Versions.props
@@ -16,8 +16,4 @@
     <!-- Command-line-api dependencies -->
     <SystemCommandLinePackageVersion>2.0.0-beta4.24324.3</SystemCommandLinePackageVersion>
   </PropertyGroup>
-  <PropertyGroup>
-    <!-- Non-maestro versions -->
-    <SystemFormatsAsn1Version>8.0.1</SystemFormatsAsn1Version>
-  </PropertyGroup>
 </Project>