NuGetAudit should not download vulnerabilities database when project does not use any packages

[zivkan]

NuGet Product(s) Affected

NuGet.exe, MSBuild.exe, dotnet.exe

Current Behavior

As the title says, NuGetAudit download the vulnerabilities database, even when there are no packages to check.

The "easiest" way to validate is to open a CLI shell, set the environment variable http_proxy to http://localhost:12345/ (make sure there isn't a real HTTP proxy running on this port), then do dotnet new console. Note, if you ran a restore more recently than 30 minutes ago, you might need to run dotnet nuget locals http-cache --clear, to ensure that the cached vulnerabilities isn't used.

Desired Behavior

The scenario described above should not fail. In other words, when there are no packages, NuGetAudit should "skip" itself, and avoid making HTTP requests.

Additional Context

No response

[dtivel]

Another repro using Docker:

docker run -it mcr.microsoft.com/cbl-mariner/base/core:2.0 bash
tdnf install dotnet-sdk-8.0 -y
dotnet new console -o test

Result

The template "Console App" was created successfully.

Processing post-creation actions...
Restoring /test/test.csproj:
  Determining projects to restore...
/usr/share/dotnet/sdk/8.0.100/NuGet.targets(156,5): error : Unable to load the service index for source https://api.nuget.org/v3/index.json. [/test/test.csproj]
/usr/share/dotnet/sdk/8.0.100/NuGet.targets(156,5): error :   The SSL connection could not be established, see inner exception. [/test/test.csproj]
/usr/share/dotnet/sdk/8.0.100/NuGet.targets(156,5): error :   The remote certificate is invalid because of errors in the certificate chain: UntrustedRoot [/test/test.csproj]
Restore failed.
Post action failed.
Manual instructions: Run 'dotnet restore'

When dotnet/runtime#96874 is fixed, you may need to uninstall ca-certificates first:

tdnf remove ca-certificates

Workaround

Create a file named Directory.Build.props in the root directory with the following content:

<Project>
  <PropertyGroup>
    <NuGetAudit>false</NuGetAudit>
  </PropertyGroup>
</Project>

[nkolev92]

Team Triage: We should try to fix this in 17.9/6.9.

@zivkan let us know if you have capacity, if not we can try to find someone with more time.