Source for Avalonia.BuildServices is missing

[corngood]

Describe the bug

I'm trying to package Avalonia for nixpkgs, and I can't find the source for Avalonia.BuildServices anywhere.

Apologies if I'm missing something, but I've searched the github org, etc.

To Reproduce

Search the internet for "Avalonia.BuildServices".

Expected behavior

No response

Avalonia version

11.0.11

OS

No response

Additional context

No response

[maxkatz6]

This package is not open sourced.

[Maxwell175]

That is crazy.

Looking at that package's contents, it seems it adds the following task:

    <Target Name="AvaloniaStats"
            BeforeTargets="CoreCompile"
            Condition="$(DesignTimeBuild) != 'true' And $(UsedAvaloniaProducts) != '' And $(TargetFramework) != ''">
        <AvaloniaStatsTask
                ProjectName="$(MSBuildProjectName)"
                TargetFramework="$(TargetFramework)"
                RuntimeIdentifier="$(RuntimeIdentifier)"
                AvaloniaPackageVersion="$(AvaloniaMainPackageVersion)"
                OutputType="$(OutputType)"
        />
    </Target>

So, this closed-source telemetry task runs on every build and can do anything it wants. There is no way to prevent this task from being executed based on the conditions. So, we have to simply "trust me bro" that it will always be disarmed internally by the environment variable, that the Project Name is actually hashed, and that future versions of this closed source package will not decide to do anything else later on.

Similar projects in the space do open source their telemetry, which allows them to be audited to allow users to be confident in exactly what is being reported and it can easily be disabled with an MSBuild property. The big difference between environment variables and using MSBuild properties is that MSBuild properties can be set in the csproj file once and for all as opposed to environment variables which require more platform-specific configurations, which might make it easy to miss on one of the developers's machines.

[Maxwell175]

To audit this package for myself, I decompiled the libraries in this package. They are available here: https://github.com/Maxwell175/Avalonia.BuildServices

It seems that at least as of version 0.0.31, this task shorts out if either AVALONIA_TELEMETRY_OPTOUT or NCrunch environment variables are present: https://github.com/Maxwell175/Avalonia.BuildServices/blob/master/Avalonia.BuildServices/Avalonia/Telemetry/AvaloniaStatsTask.cs#L37

[kebox7]

It seems that at least as of version 0.0.31, this task shorts out if either AVALONIA_TELEMETRY_OPTOUT or NCrunch environment variables are present:

This behavior is described in the official documentation: Telemetry

[Maxwell175]

This behavior is described in the official documentation: Telemetry

It is irrelevant what the documentation says. When it comes to a security concern, what matters is the ability to audit the code to see what it really does.

[corngood]

So I guess this is a telemetry component that can be removed without any problem?

The metadata lists it as MIT licenced. I realise this doesn't require you to distribute the source, but I think it's surprising that something listed as MIT on nuget.org isn't open-source.

[rabbitism]

I think MIT license describes the repository, not the dependencies of the repository.

[corngood]

I meant the metadata on nuget.org, which is unrelated to the repository: https://www.nuget.org/packages/Avalonia.BuildServices

[corngood]

If before building Avalonia, I run:

        dotnet remove packages/Avalonia/Avalonia.csproj package Avalonia.BuildServices

The dependency is removed from the output nupkg, and Avalonia.BuildServices is no longer required to build Avalonia itself. Projects consuming Avalonia still appear to build and run properly without pulling in Avalonia.Buildservices.

It'll be difficult for users currently using nuget.org to take advantage of this.

Maybe we need an open source alternative to nuget.org (along the lines of fdroid), where we can be confident about the source.