dotnet-source-build-reference-packages
LOW
maintainer ChrisTX
0 votes
scanned 2026-10-31 05:57:59.662655
Why flagged
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD
1
# Maintainer: Christian Pfeiffer <cpfeiffer at rev-crew dot info>
2
# shellcheck disable=SC2034,SC2154
3
# shellcheck shell=bash
4
5
pkgname=dotnet-source-build-reference-packages
6
# The version of the source-built .NET SDK whose sources (the VMR) the commit is taken from
7
pkgver=10.0.113
8
pkgrel=1
9
pkgdesc="Reference, targeting and text-only NuGet packages of .NET's source build (SBRP), e.g. NETStandard.Library"
10
arch=('any')
11
url='https://github.com/dotnet/source-build-assets'
12
license=('MIT')
13
_dotnetsdkver="10.0"
14
# Arcade, the MSBuild SDKs and ILAsm come from the source-built .NET
15
makedepends=(
16
dotnet-sdk-"$_dotnetsdkver"
17
dotnet-source-built-artifacts-"$_dotnetsdkver"
18
)
19
# The commit of src/source-build-assets in the VMR (dotnet/dotnet, src/source-manifest.json) of the
20
# tag v$pkgver. The repository was renamed from source-build-reference-packages.
21
_commit="a13f85878bf40ed4c57f997b82cbdade521826d3"
22
source=("source-build-assets-$_commit.tar.gz::$url/archive/$_commit.tar.gz")
23
sha512sums=('e0401152c8710f551d33865e0126172bd1a9f508e8b5f32536eaf190bc0f6bb9a182ccc5f431e1b9efc685ae7073a6015d97471a3bd70404bb5a3aab68fca129')
24
b2sums=('c8fbe8aa05b9a6b6721b61c2e091e3017296c92e4e6344a6afb1cc4d171bf5b3a6617d8835acb6c044dbf884de96b6eeaf45eb4b298010906e0e6aa41d1f924b')
25
26
_dotnet_env() {
27
export NUGET_PACKAGES="$srcdir/nuget"
28
export DOTNET_CLI_HOME="$srcdir/dotnet-home"
29
export DOTNET_CLI_TELEMETRY_OPTOUT=1
30
export DOTNET_NOLOGO=1
31
# Arcade uses the installed SDK instead of downloading the one global.json names
32
export DOTNET_INSTALL_DIR=/usr/share/dotnet
33
# RID of the .NET SDK: arch-x64 for the source-built .NET of Arch Linux
34
_rid=$(dotnet --info | sed -n -E 's/^ *RID: *//p')
35
}
36
37
# Writes NuGet.config with the packages from the source-built artifacts, and the given feeds ($@, as
38
# key=url) for everything else
39
_nuget_config() {
40
local _feed
41
{
42
cat <<EOF
43
<?xml version="1.0" encoding="utf-8"?>
44
<configuration>
45
<packageSources>
46
<clear />
47
<add key="dotnet-source-built" value="$srcdir/nuget-local" />
48
EOF
49
for _feed in "$@"; do
50
echo " <add key=\"${_feed%%=*}\" value=\"${_feed#*=}\" />"
51
done
52
cat <<EOF
53
</packageSources>
54
<packageSourceMapping>
55
<clear />
56
<packageSource key="dotnet-source-built">
57
<package pattern="*" />
58
</packageSource>
59
EOF
60
for _feed in "$@"; do
61
printf ' <packageSource key="%s">\n <package pattern="*" />\n </packageSource>\n' "${_feed%%=*}"
62
done
63
cat <<EOF
64
</packageSourceMapping>
65
</configuration>
66
EOF
67
} >NuGet.config
68
}
69
70
prepare() {
71
# Besides Arcade and the tools, some reference packages restore their dependencies from there, like
72
# in the VMR (e.g. Newtonsoft.Json for NuGet.Packaging)
73
mkdir -p nuget-local
74
bsdtar -xf /usr/share/dotnet/source-built-artifacts/Private.SourceBuilt.Artifacts.*.tar.gz -C nuget-local '*.nupkg'
75
76
cd "source-build-assets-$_commit" || exit
77
# The installed SDK and the Arcade of the source-built .NET, instead of the versions upstream pins
78
local _sdkver _arcadever
79
_sdkver=$(dotnet --version)
80
_arcadever=$(find "$srcdir/nuget-local" -name 'Microsoft.DotNet.Arcade.Sdk.*.nupkg' -printf '%f\n' |
81
sed -E 's/^Microsoft\.DotNet\.Arcade\.Sdk\.(.*)\.nupkg$/\1/')
82
sed -i -E \
83
-e "s|(\"version\": \")[^\"]*\"|\1$_sdkver\"|" \
84
-e "s|(\"dotnet\": \")[^\"]*\"|\1$_sdkver\"|" \
85
-e "s|(\"Microsoft.DotNet.Arcade.Sdk\": \")[^\"]*\"|\1$_arcadever\"|" \
86
global.json
87
# The external packages are other projects' sources as git submodules (e.g. Newtonsoft.Json), which
88
# are packaged on their own
89
sed -i '/externalPackages.proj/d' eng/Build.props
90
}
91
92
build() {
93
_dotnet_env
94
cd "source-build-assets-$_commit" || exit
95
# Only from the source-built artifacts, nothing is downloaded. ILAsm builds the targeting packs, in
96
# the version and for the RID of the source-built .NET.
97
_nuget_config
98
local _ilasmver
99
_ilasmver=$(find "$srcdir/nuget-local" -name "runtime.$_rid.Microsoft.NETCore.ILAsm.*.nupkg" -printf '%f\n' |
100
sed -E "s/^runtime\.$_rid\.Microsoft\.NETCore\.ILAsm\.(.*)\.nupkg$/\1/")
101
./build.sh --ci --configuration Release \
102
-p:MicrosoftNetCoreIlasmPackageRuntimeId="$_rid" \
103
-p:MicrosoftNETCoreILAsmVersion="$_ilasmver"
104
}
105
106
check() {
107
_dotnet_env
108
cd "source-build-assets-$_commit" || exit
109
# The test framework comes from nuget.org
110
_nuget_config "nuget.org=https://api.nuget.org/v3/index.json"
111
# The validation tests check the built packages: the reference assemblies are marked as built by
112
# SBRP, and no package is signed. The tests of generate.sh download the packages from nuget.org to
113
# generate their sources again, which isn't needed for building them.
114
dotnet test tests/SbrpTests/Sbrp.Tests.csproj --configuration Release \
115
--filter 'FullyQualifiedName~ValidationTests'
116
}
117
118
# Fails if a binary in $pkgdir, also inside the .nupkg files there, is identical to one of the packages
119
# restored from a remote feed like nuget.org into $1, so no prebuilt binary slips in instead of one built
120
# from source
121
_check_prebuilt() {
122
local _extracted="$srcdir/check-prebuilt" _metadata _file _hash _found=0
123
local _binaries=(-type f '(' -name '*.dll' -o -name '*.exe' -o -name '*.so' -o -name '*.so.*' -o -name '*.dylib' ')')
124
local -A _prebuilt=()
125
while IFS= read -r -d '' _metadata; do
126
grep -qE '"source": *"https?://' "$_metadata" || continue
127
while IFS= read -r -d '' _file; do
128
_prebuilt[$(sha256sum <"$_file")]="${_file#"$1"/}"
129
done < <(find "${_metadata%/*}" "${_binaries[@]}" -print0)
130
done < <(find "$1" -name .nupkg.metadata -print0)
131
132
rm -rf "$_extracted"
133
mkdir -p "$_extracted"
134
while IFS= read -r -d '' _file; do
135
mkdir -p "$_extracted/${_file#"$pkgdir"/}"
136
bsdtar -xf "$_file" -C "$_extracted/${_file#"$pkgdir"/}"
137
done < <(find "$pkgdir" -type f -name '*.nupkg' -print0)
138
while IFS= read -r -d '' _file; do
139
_hash=$(sha256sum <"$_file")
140
if [[ -v "_prebuilt[$_hash]" ]]; then
141
echo "Prebuilt binary: ${_file#"$_extracted"/} is ${_prebuilt[$_hash]}" >&2
142
_found=1
143
fi
144
done < <(find "$pkgdir" "$_extracted" "${_binaries[@]}" -print0)
145
rm -rf "$_extracted"
146
return "$_found"
147
}
148
149
package() {
150
cd "source-build-assets-$_commit" || exit
151
# In a feed of their own: some reference packages have their reference assemblies in lib/ (e.g.
152
# System.Collections.Immutable), which must not end up in applications, so consumers map only the
153
# packages they compile against to this feed
154
install -Dm644 artifacts/packages/Release/{ReferenceOnly,Shipping}/*.nupkg \
155
-t "$pkgdir/usr/share/dotnet/source-build-reference-packages/"
156
install -Dm644 LICENSE.txt -t "$pkgdir/usr/share/licenses/$pkgname/"
157
158
_check_prebuilt "$srcdir/nuget"
159
}
160
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-31 05:57:59 | Low | 1 |