Skip to content

[release/13.2] Enable CFSClean policies and use dotnet-public feed for winget CLI #15541

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
joperezr merged 3 commits into from
Mar 25, 2026
Merged

[release/13.2] Enable CFSClean policies and use dotnet-public feed for winget CLI #15541

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1c9a13d
Enable CFSClean policies and use dotnet-public feed for winget CLI
mmitche Mar 19, 2026
2bc9193
Update eng/pipelines/templates/prepare-winget-manifest.yml
radical Mar 23, 2026
f564e75
Update eng/pipelines/azure-pipelines.yml
radical Mar 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions eng/pipelines/azure-pipelines.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,8 @@ resources:
extends:
template: v1/1ES.Official.PipelineTemplate.yml@1ESPipelineTemplates
parameters:
settings:
networkIsolationPolicy: Permissive,CFSClean,CFSClean2
Copy link
Copy Markdown
Member

@joperezr joperezr Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Help me understand why we need CFSClean, CFSClean2? What's the difference? Also, why do we need permisive, and do we need an exclusion list to get the gallery?

Copy link
Copy Markdown
Member

@radical radical Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a backport of the PR we meged for main.
@mmitche ^^

Copy link
Copy Markdown
Member

@radical radical Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IIUC, Permissive -> CFSClean -> CFSClean2 - they are building upon the previous one to establish the restrictions, and allowances. Permissive is the base one allowing most outbound connections.

Copy link
Copy Markdown
Member

@mmitche mmitche Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CFSClean and Clean2 are separate policies and we require both of them.

featureFlags:
autoEnablePREfastWithNewRuleset: false
autoEnableRoslynWithNewRuleset: false
Expand Down
14 changes: 12 additions & 2 deletions eng/pipelines/templates/prepare-winget-manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,9 +57,19 @@ steps:
displayName: 🟣Set version ${{ parameters.version }}

- pwsh: |
Write-Host "Installing Microsoft.WinGet.Client from PSGallery..."
Install-PSResource -Name Microsoft.WinGet.Client -Repository PSGallery -TrustRepository
$repoName = 'dotnet-public'
Copy link
Copy Markdown
Member

@joperezr joperezr Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be microsoft-public now

Copy link
Copy Markdown
Member

@joperezr joperezr Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually, maybe not, sorry. What is that for?

Copy link
Copy Markdown
Member

@radical radical Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is feed we are using to get winget cli.

$repoUri = 'https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json'

Write-Host "Ensuring PSResource repository '$repoName' is registered..."
$existingRepo = Get-PSResourceRepository -Name $repoName -ErrorAction SilentlyContinue
if ($null -eq $existingRepo) {
Register-PSResourceRepository -Name $repoName -Uri $repoUri -Trusted
} else {
Write-Host "PSResource repository '$repoName' is already registered. Skipping registration."
}

Write-Host "Installing Microsoft.WinGet.Client from $repoName feed..."
Install-PSResource -Name Microsoft.WinGet.Client -Repository $repoName -TrustRepository
Write-Host "Microsoft.WinGet.Client installed. Listing installed version:"
Get-Module -ListAvailable Microsoft.WinGet.Client | Select-Object Name, Version | Format-Table

Expand Down
Loading