Fix Secure Supply Chain compliance issues #11548
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dannyvv
reviewed
May 4, 2023
| <!-- Warning: Never add more NuGet feeds, to be compliant this repo must only rely on this single ADO feed. --> | ||
| <add key="react-native" value="https://pkgs.dev.azure.com/ms/react-native/_packaging/react-native-public/nuget/v3/index.json" /> | ||
| <!-- Remove (comment out) the nuget.org feed once our ADO feed is configured correctly. See https://github.com/microsoft/react-native-windows/issues/11557 --> | ||
| <add key="nuget.org" value="https://api.nuget.org/v3/index.json" /> |
There was a problem hiding this comment.
Just FYI: Nuget fires requests to all feeds at the same time and first to return will be chosen. If you want ot populate our public feed you'll need ot make sure you have no nuget cache and remove this line...
There was a problem hiding this comment.
Yeah, the goal is once we're ready to turn on upstream for react-native-public then I'll remove the nuget.org line and going forward we'll be compliant.
| @@ -33,6 +33,12 @@ node_modules | |||
| # Optional REPL history | |||
| .node_repl_history | |||
|
|
|||
| # No NPM config to pass CFS compliance | |||
| .npmrc | |||
There was a problem hiding this comment.
Confused about why we are ignoring lock files and .npmrc... Just like nuget.config we need to have a .npmrc at the root
There was a problem hiding this comment.
Not according to the task - I removed .npmrc and it passes.
|
Note: we'll need to do the same for |
dannyvv
approved these changes
May 4, 2023
jonthysell
added a commit
to jonthysell/react-native-windows
that referenced
this pull request
Jul 19, 2023
This PR backports PRs microsoft#11548 and microsoft#11855 to 0.72. Fix Secure Supply Chain compliance issues (microsoft#11548) Resolves Secure Supply Chain warnings. - Bug fix (non-breaking change which fixes an issue) To meet compliance requirements. Closes microsoft#11209 Closes microsoft#10374 * Removed invalid `nuget.config` configurations * Removed unnecessary `.npmrc` files * Temporarily left nuget.org feed in config (tracking: microsoft#11557) N/A N/A CG: Move to single nuget source (microsoft#11855) * CG: Move to single nuget source * update nuget lock files * Change files
jonthysell
added a commit
that referenced
this pull request
Jul 19, 2023
This PR backports PRs #11548 and #11855 to 0.72. # Fix Secure Supply Chain compliance issues (#11548) ## Description Resolves Secure Supply Chain warnings. ### Type of Change - Bug fix (non-breaking change which fixes an issue) ### Why To meet compliance requirements. Closes #11209 Closes #10374 ### What * Removed invalid `nuget.config` configurations * Removed unnecessary `.npmrc` files * Temporarily left nuget.org feed in config (tracking: #11557) ## Screenshots N/A ## Testing N/A # CG: Move to single nuget source (#11855) ## Description CG is failing builds due to multiple nuget feeds in nuget.config. ### Why What is the motivation for this change? Add a few sentences describing the context and overall goals of the pull request's commits. Resolves #11557
jonthysell
added a commit
to jonthysell/react-native-windows
that referenced
this pull request
Aug 14, 2023
This PR backports PRs microsoft#11548 and microsoft#11855 to 0.70. Resolves Secure Supply Chain warnings. - Bug fix (non-breaking change which fixes an issue) To meet compliance requirements. Closes microsoft#11209 Closes microsoft#10374 * Removed invalid `nuget.config` configurations * Removed unnecessary `.npmrc` files * Temporarily left nuget.org feed in config (tracking: microsoft#11557) N/A N/A CG is failing builds due to multiple nuget feeds in nuget.config. What is the motivation for this change? Add a few sentences describing the context and overall goals of the pull request's commits. Resolves microsoft#11557
jonthysell
added a commit
to jonthysell/react-native-windows
that referenced
this pull request
Aug 14, 2023
This PR backports PRs microsoft#11548 and microsoft#11855 to 0.72. Resolves Secure Supply Chain warnings. - Bug fix (non-breaking change which fixes an issue) To meet compliance requirements. Closes microsoft#11209 Closes microsoft#10374 * Removed invalid `nuget.config` configurations * Removed unnecessary `.npmrc` files * Temporarily left nuget.org feed in config (tracking: microsoft#11557) N/A N/A CG is failing builds due to multiple nuget feeds in nuget.config. What is the motivation for this change? Add a few sentences describing the context and overall goals of the pull request's commits. Resolves microsoft#11557
jonthysell
added a commit
that referenced
this pull request
Aug 14, 2023
This PR backports PRs #11548 and #11855 to 0.70. # Fix Secure Supply Chain compliance issues (#11548) ## Description Resolves Secure Supply Chain warnings. ### Type of Change - Bug fix (non-breaking change which fixes an issue) ### Why To meet compliance requirements. Closes #11209 Closes #10374 ### What * Removed invalid `nuget.config` configurations * Removed unnecessary `.npmrc` files * Temporarily left nuget.org feed in config (tracking: #11557) ## Screenshots N/A ## Testing N/A # CG: Move to single nuget source (#11855) ## Description CG is failing builds due to multiple nuget feeds in nuget.config. ### Why What is the motivation for this change? Add a few sentences describing the context and overall goals of the pull request's commits. Resolves #11557
jonthysell
added a commit
to jonthysell/react-native-windows
that referenced
this pull request
Aug 14, 2023
This PR backports PRs microsoft#11548 and microsoft#11855 to 0.69. Resolves Secure Supply Chain warnings. - Bug fix (non-breaking change which fixes an issue) To meet compliance requirements. Closes microsoft#11209 Closes microsoft#10374 * Removed invalid `nuget.config` configurations * Removed unnecessary `.npmrc` files * Temporarily left nuget.org feed in config (tracking: microsoft#11557) N/A N/A CG is failing builds due to multiple nuget feeds in nuget.config. What is the motivation for this change? Add a few sentences describing the context and overall goals of the pull request's commits. Resolves microsoft#11557 # Please enter the commit message for your changes. Lines starting # with '#' will be kept; you may remove them yourself if you want to. # An empty message aborts the commit. # # Author: Jon Thysell <jthysell@microsoft.com> # Date: Mon Aug 14 11:55:01 2023 -0700 # # On branch securefeed69 # Changes to be committed: # modified: .gitignore # new file: GuardianCustomConfiguration.json # modified: NuGet.Config # new file: change/react-native-windows-14a87dda-f285-4cd4-8a0f-b5aa9543cb9f.json # new file: change/react-native-windows-bfb79e47-04d8-4f4e-a72f-26b1621873d2.json # deleted: packages/e2e-test-app/.npmrc # deleted: packages/e2e-test-app/windows/NuGet.Config # deleted: packages/integration-test-app/windows/NuGet.Config # deleted: packages/playground/windows/NuGet.Config # deleted: packages/sample-apps/.npmrc # deleted: packages/sample-apps/windows/NuGet.Config # deleted: vnext/.npmrc # modified: vnext/Microsoft.ReactNative.Managed.UnitTests/packages.lock.json # modified: vnext/Microsoft.ReactNative.Managed/packages.lock.json # deleted: vnext/NuGet.Config #
jonthysell
added a commit
that referenced
this pull request
Aug 14, 2023
This PR backports PRs #11548 and #11855 to 0.71. # Fix Secure Supply Chain compliance issues (#11548) ## Description Resolves Secure Supply Chain warnings. ### Type of Change - Bug fix (non-breaking change which fixes an issue) ### Why To meet compliance requirements. Closes #11209 Closes #10374 ### What * Removed invalid `nuget.config` configurations * Removed unnecessary `.npmrc` files * Temporarily left nuget.org feed in config (tracking: #11557) ## Screenshots N/A ## Testing N/A # CG: Move to single nuget source (#11855) ## Description CG is failing builds due to multiple nuget feeds in nuget.config. ### Why What is the motivation for this change? Add a few sentences describing the context and overall goals of the pull request's commits. Resolves #11557
jonthysell
added a commit
that referenced
this pull request
Aug 14, 2023
This PR backports PRs #11548 and #11855 to 0.69. # Fix Secure Supply Chain compliance issues (#11548) ## Description Resolves Secure Supply Chain warnings. ### Type of Change - Bug fix (non-breaking change which fixes an issue) ### Why To meet compliance requirements. Closes #11209 Closes #10374 ### What * Removed invalid `nuget.config` configurations * Removed unnecessary `.npmrc` files * Temporarily left nuget.org feed in config (tracking: #11557) ## Screenshots N/A ## Testing N/A # CG: Move to single nuget source (#11855) ## Description CG is failing builds due to multiple nuget feeds in nuget.config. ### Why What is the motivation for this change? Add a few sentences describing the context and overall goals of the pull request's commits. Resolves #11557
jonthysell
added a commit
to jonthysell/react-native-windows
that referenced
this pull request
Nov 13, 2023
This PR backports PRs microsoft#9990, microsoft#11548 and microsoft#11855 to 0.68 to resolve Secure Supply Chain warnings.
jonthysell
added a commit
to jonthysell/react-native-windows
that referenced
this pull request
Nov 13, 2023
This PR backports PRs microsoft#9990, microsoft#11548 and microsoft#11855 to 0.67 to resolve Secure Supply Chain warnings.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Resolves Secure Supply Chain warnings.
Type of Change
Why
To meet compliance requirements.
Closes #11209
Closes #10374
What
nuget.configconfigurations.npmrcfilesScreenshots
N/A
Testing
N/A
Microsoft Reviewers: Open in CodeFlow