Merge 7.0.3.1 into release/7.0.x

Author: zivkan

build/config.props

@@ -14,7 +14,7 @@
     <!-- when changing any of the NuGetVersion props below, run tools-local\ship-public-apis -->
     <MajorNuGetVersion Condition="'$(MajorNuGetVersion)' == ''">7</MajorNuGetVersion>
     <MinorNuGetVersion Condition="'$(MinorNuGetVersion)' == ''">0</MinorNuGetVersion>
-    <PatchNuGetVersion Condition="'$(PatchNuGetVersion)' == ''">2</PatchNuGetVersion>
+    <PatchNuGetVersion Condition="'$(PatchNuGetVersion)' == ''">3</PatchNuGetVersion>
     <SemanticVersion Condition=" '$(SemanticVersion)' == '' ">$(MajorNuGetVersion).$(MinorNuGetVersion).$(PatchNuGetVersion)</SemanticVersion>
 
     <!-- ** Change for each new preview/rc -->

eng/pipelines/pull_request.yml

@@ -27,6 +27,8 @@ variables:
 extends:
   template: azure-pipelines/MicroBuild.1ES.Unofficial.yml@MicroBuildTemplate
   parameters:
+    settings:
+      networkIsolationPolicy: Permissive
     sdl:
       sourceAnalysisPool: VSEngSS-MicroBuild2022-1ES
       binskim:

eng/pipelines/templates/Build.yml

@@ -4,6 +4,8 @@ parameters:
   - name: SigningType
     displayName: Type of signing to use
     type: string
+  - name: isOfficialBuild
+    type: boolean
 
 steps:
   - task: PowerShell@1
@@ -300,27 +302,28 @@ steps:
     # Using MSBuild CLI results in an assembly binding failure for NuGet.Common.dll 4.4.0.3 because Microsoft.DotNet.Build.Tasks.Feed.dll references SleetLib.dll which references NuGet.Common 4.4.0.3.
     # The Microsoft.DotNet.Build.Tasks.Feed package includes NuGet.Common 4.9.0.6 and a binding redirection in Microsoft.DotNet.Build.Tasks.Feed.dll.config but the binding redirection is not processed.
     # This would probably solve it:  https://github.com/Microsoft/msbuild/issues/1309
-  - task: UseDotNet@2
-    displayName: "Install .NET 10.0.0 for BAR publishing"
-    inputs:
-      packageType: sdk
-      version: 10.0.x
-      includePreviewVersions: true
-      installationPath: $(Agent.TempDirectory)/dotnet
-      workingDirectory: $(Agent.TempDirectory)
-    condition: "and(succeeded(),eq(variables['PublishArtifactsToDotNetBuildAssetRegistry'], 'true'), eq(variables['BuildRTM'], 'false'))"
-
-  - task: AzureCLI@2
-    displayName: "Publish to the .NET Core build asset registry (BAR)"
-    inputs:
-      azureSubscription: "Darc: Maestro Production"
-      scriptType: ps
-      scriptLocation: inlineScript
-      inlineScript: |
-        $(Agent.TempDirectory)/dotnet/dotnet msbuild $(Build.Repository.LocalPath)\build\publish.proj /t:PublishToBuildAssetRegistry /property:NuGetClientNupkgsDirectoryPath=$(Build.Repository.LocalPath)\artifacts\$(NupkgOutputDir) /property:BUILD_BUILDNUMBER=$(Build.BuildNumber) /property:BUILD_SOURCEBRANCH=$(SourceBranch) /property:BUILD_SOURCEVERSION=$(Build.SourceVersion) /property:BUILD_REPOSITORY_URI=$(Build.Repository.Uri) /property:BUILD_REPOSITORY_NAME=$(Build.Repository.Name) /property:ArtifactsLogDir=$(Build.Repository.LocalPath)\artifacts\manifests\ /binarylogger:$(Build.StagingDirectory)\binlog\21.PublishToBuildAssetRegistry.binlog /property:MaestroApiEndpoint=$(MaestroApiEndpoint)
-      workingDirectory: cli
-      failOnStderr: true
-    env:
-      DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
-      DOTNET_MULTILEVEL_LOOKUP: true
-    condition: "and(succeeded(),eq(variables['PublishArtifactsToDotNetBuildAssetRegistry'], 'true'), eq(variables['BuildRTM'], 'false'))"
+  - ${{ if parameters.isOfficialBuild }}:
+    - task: UseDotNet@2
+      displayName: "Install .NET 10.0.0 for BAR publishing"
+      inputs:
+        packageType: sdk
+        version: 10.0.x
+        includePreviewVersions: true
+        installationPath: $(Agent.TempDirectory)/dotnet
+        workingDirectory: $(Agent.TempDirectory)
+      condition: "and(succeeded(),eq(variables['PublishArtifactsToDotNetBuildAssetRegistry'], 'true'), eq(variables['BuildRTM'], 'false'))"
+
+    - task: AzureCLI@2
+      displayName: "Publish to the .NET Core build asset registry (BAR)"
+      inputs:
+        azureSubscription: "Darc: Maestro Production"
+        scriptType: ps
+        scriptLocation: inlineScript
+        inlineScript: |
+          $(Agent.TempDirectory)/dotnet/dotnet msbuild $(Build.Repository.LocalPath)\build\publish.proj /t:PublishToBuildAssetRegistry /property:NuGetClientNupkgsDirectoryPath=$(Build.Repository.LocalPath)\artifacts\$(NupkgOutputDir) /property:BUILD_BUILDNUMBER=$(Build.BuildNumber) /property:BUILD_SOURCEBRANCH=$(SourceBranch) /property:BUILD_SOURCEVERSION=$(Build.SourceVersion) /property:BUILD_REPOSITORY_URI=$(Build.Repository.Uri) /property:BUILD_REPOSITORY_NAME=$(Build.Repository.Name) /property:ArtifactsLogDir=$(Build.Repository.LocalPath)\artifacts\manifests\ /binarylogger:$(Build.StagingDirectory)\binlog\21.PublishToBuildAssetRegistry.binlog /property:MaestroApiEndpoint=$(MaestroApiEndpoint)
+        workingDirectory: cli
+        failOnStderr: true
+      env:
+        DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
+        DOTNET_MULTILEVEL_LOOKUP: true
+      condition: "and(succeeded(),eq(variables['PublishArtifactsToDotNetBuildAssetRegistry'], 'true'), eq(variables['BuildRTM'], 'false'))"

eng/pipelines/templates/pipeline.yml

@@ -178,6 +178,7 @@ stages:
       parameters:
         BuildRTM: false
         SigningType: ${{ parameters.SigningType }}
+        isOfficialBuild: ${{ parameters.isOfficialBuild }}
 
 - stage: Build_For_Publishing
   displayName: Build NuGet published to nuget.org
@@ -240,6 +241,7 @@ stages:
       parameters:
         BuildRTM: true
         SigningType: ${{ parameters.SigningType }}
+        isOfficialBuild: ${{ parameters.isOfficialBuild }}
 
   - job: Validate_Publishing_Artifacts
     condition: "and(succeeded(), ne(variables['RunBuildForPublishing'], 'false'))"

src/NuGet.Core/NuGet.Packaging/PackageExtractor.cs

@@ -466,6 +466,8 @@ public static async Task<bool> InstallFromSourceAsync(
 
                                     using (var packageReader = new PackageArchiveReader(nupkgStream))
                                     {
+                                        ValidateExpectedPackage(packageIdentity, packageReader);
+
                                         if (packageSaveMode.HasFlag(PackageSaveMode.Nuspec) || packageSaveMode.HasFlag(PackageSaveMode.Files))
                                         {
                                             telemetry.StartIntervalMeasure();
@@ -588,6 +590,22 @@ await VerifyPackageSignatureAsync(
             }
         }
 
+        private static void ValidateExpectedPackage(PackageIdentity packageIdentity, PackageArchiveReader packageReader)
+        {
+            PackageIdentity actualIdentity = packageReader.GetIdentity();
+            if (!PackageIdentityComparer.Default.Equals(packageIdentity, actualIdentity))
+            {
+                string message = string.Format(
+                    CultureInfo.InvariantCulture,
+                    Strings.ErrorPackageIdentityDoesNotMatch,
+                    packageIdentity.Id,
+                    packageIdentity.Version,
+                    actualIdentity.Id,
+                    actualIdentity.Version);
+                throw new PackagingException(message);
+            }
+        }
+
         /// <summary>
         /// Delete the target directory path and the temp nupkg path in case of a failed extraction.
         /// </summary>
@@ -947,6 +965,7 @@ public static async Task<IEnumerable<string>> CopySatelliteFilesAsync(
             {
                 using (var packageReader = new PackageArchiveReader(nupkgFilePath))
                 {
+                    ValidateExpectedPackage(packageIdentity, packageReader);
                     return await CopySatelliteFilesAsync(
                         packageReader,
                         packagePathResolver,

src/NuGet.Core/NuGet.Packaging/Strings.Designer.cs

@@ -887,4 +887,8 @@ Valid from:</comment>
 {2}</value>
     <comment>0 is a certificate subject, 1 is a certificate fingerprint, and 2 is a PEM-encoded certificate.</comment>
   </data>
+  <data name="ErrorPackageIdentityDoesNotMatch" xml:space="preserve">
+    <value>Expected package {0} {1}, but got package {2} {3}</value>
+    <comment>0 and 2 are package names, and 1 and 3 are versions numbers.</comment>
+  </data>
 </root>

src/NuGet.Core/NuGet.Packaging/Strings.resx

@@ -183,6 +183,11 @@
         <target state="translated">ID balíčku má prázdnou hodnotu nebo hodnotu null.</target>
         <note />
       </trans-unit>
+      <trans-unit id="ErrorPackageIdentityDoesNotMatch">
+        <source>Expected package {0} {1}, but got package {2} {3}</source>
+        <target state="new">Expected package {0} {1}, but got package {2} {3}</target>
+        <note>0 and 2 are package names, and 1 and 3 are versions numbers.</note>
+      </trans-unit>
       <trans-unit id="ErrorPackageNotSigned">
         <source>The package is not signed.</source>
         <target state="translated">Balíček není podepsaný.</target>

src/NuGet.Core/NuGet.Packaging/xlf/Strings.cs.xlf

@@ -183,6 +183,11 @@
         <target state="translated">NULL oder leere Paket-ID.</target>
         <note />
       </trans-unit>
+      <trans-unit id="ErrorPackageIdentityDoesNotMatch">
+        <source>Expected package {0} {1}, but got package {2} {3}</source>
+        <target state="new">Expected package {0} {1}, but got package {2} {3}</target>
+        <note>0 and 2 are package names, and 1 and 3 are versions numbers.</note>
+      </trans-unit>
       <trans-unit id="ErrorPackageNotSigned">
         <source>The package is not signed.</source>
         <target state="translated">Das Paket ist nicht signiert.</target>

src/NuGet.Core/NuGet.Packaging/xlf/Strings.de.xlf

@@ -183,6 +183,11 @@
         <target state="translated">Id. de paquete vacío o nulo</target>
         <note />
       </trans-unit>
+      <trans-unit id="ErrorPackageIdentityDoesNotMatch">
+        <source>Expected package {0} {1}, but got package {2} {3}</source>
+        <target state="new">Expected package {0} {1}, but got package {2} {3}</target>
+        <note>0 and 2 are package names, and 1 and 3 are versions numbers.</note>
+      </trans-unit>
       <trans-unit id="ErrorPackageNotSigned">
         <source>The package is not signed.</source>
         <target state="translated">El paquete no está firmado.</target>