Where do builds set the AssemblyCompanyAttribute attribute for assemblies?

[jcolebrand]

Where do builds set the AssemblyCompanyAttribute attribute for assemblies?

Apologies if this is the wrong place, feel free to redirect me to a better place to ask, but seems like the source-build team knows these things better than anyone, if I had to guess.

We are looking to build some tooling around assembly scanning and wanted to exclude the Microsoft assemblies from our internal assemblies (not excluding everyone's assemblies, just the ones owned by the Microsoft teams) and wanted to know if there was a likelihood that the AssemblyCompanyAttribute attribute may change in the future. With quite a few thousand (mostly tests and handling code) results in github seearch, and knowing that it is usually just AssemblyCompany in expected files, I'm not sure how to narrow it down to see where it might get injected into a build pipeline.

"But Cole, why would it ever change from Microsoft" excellent question. While I can ponder a few ideas, such as a Community Foundation type naming structure, I don't know exactly, but figured if I can find who owns that, they can give me a better indication of if it might ever change.

FWIW this is the code my coworker wrote today:

        private static bool IsMicrosoftAssembly(AssemblyDefinition assembly)
        {
            if (assembly.HasCustomAttributes)
            {
                var assemblyCompany = assembly.CustomAttributes.FirstOrDefault(a => a.AttributeType.FullName == "System.Reflection.AssemblyCompanyAttribute");

                return ((assemblyCompany != null)
                    && assemblyCompany.ConstructorArguments.Any(arg => arg.Value?.ToString().StartsWith("Microsoft") == true));
            }

            return false;
        }

I'm sure you can see how that would potentially be a problem, especially if we don't understand the nuances, etc. Is it brittle? Almost certainly.

I would also accept "look, don't do that, do this instead" but better to learn how to fish with seeing the entirety of the ecosystem than to ask highly specific questions, because I would like to learn how to fish.

If it were me setting this up, I would have that as a variable in a pipeline and not hard-coded in a script, which are dynamic, and so I expect it is here as well.

Cheers!

[crummel]

Most of the .NET repos use Arcade to build which sets the Company attribute here: https://github.com/dotnet/arcade/blob/3dd12f0a1d25fa29b84e38b7d2345a693f4ae45e/src/Microsoft.DotNet.Arcade.Sdk/tools/ProjectDefaults.props#L10. In general I think a better approach might be checking for a Microsoft signature since the company attribute is something that anyone can just set, but then you'll have to keep up on the Microsoft certificates, which might be more effort than it's worth for your application. I'll transfer this over to arcade who would probably know better than us whether the Company attribute is ever likely to change.

[jcolebrand]

The link above is really the pertinent bit, because now I can just keep an eye on that :D Still learning all there is to know about the ecosystem, but lord idk if anyone ever can learn all of it (idk, probably just need more time :D )

Cheers!

[crummel]

The arcade issue is dotnet/arcade#11801.