Skip to content

Conversation

@NikolaMilosavljevic
Copy link
Member

@NikolaMilosavljevic NikolaMilosavljevic commented Apr 24, 2024

Fixes: #99610

Current NETStandard 2.1 targeting pack package does not support installation on FIPS-enabled systems. Original repo and branch (core-setup, release/3.1) have been deprecated and cannot be used for building this package anymore.

The solution is to repackage it. Extraction is done using rpm2cpio <original-package> | cpio -idmv which preserves original content and file modification time. Packaging is done with FPM, using regular tooling for RPM package creation. This tooling supports FIPS, by enabling sha256 package digest.

There are some small differences in metadata - description and packager fields, as well as copyright. Details are available in the appropriate sections.

Naming and versioning

Old package name was netstandard-targeting-pack-2.1.0-x64.rpm as it did not get renamed during publishing to PMC. New packages will get renamed to follow common naming schema. New package name will be: netstandard-targeting-pack-2.1-8.0.6-1.x86_64.rpm

Copyright differences

There is a minor difference in the comment section of the copyright file that ships with this package. It is picked up from new packaging infra. I've attached old and new copyright files, for review. I've outlined the differences.

Old copyright New copyright
Comment Licensed to the .NET Foundation under one or more agreements. The .NET Foundation licenses this file to you under the MIT license. See the LICENSE file in the project root for more information. Licensed to the .NET Foundation under one or more agreements. The .NET Foundation licenses this file to you under the MIT license.

Package metadata differences

Version difference is intentional as a result of building in 8.0 servicing branch. This can likely be tweaked if needed, but it is a correct model as this is how distros version the same package, in their servicing releases.

Packager and Description values are coming from new package infra - shared with all packages produced in 8.0 release. This can likely be tweaked if needed. I've outlined the differences.

Old package New package
Version 2.1.0 8.0.6
Release 1 1
Packager .NET Core Team dotnetpackages@dotnetfoundation.org .NET Team dotnetpackages@dotnetfoundation.org
Description .NET Core is a development platform that you can use to build command-line applications, microservices and modern websites. It is open source, cross-platform and is supported by Microsoft. We hope you enjoy using it! If you do, please consider joining the active community of developers that are contributing to the project on GitHub (https://github.com/dotnet/core). We happily accept issues and PRs. .NET is a development platform that you can use to build command-line applications, microservices and modern websites. It is open source, cross-platform and is supported by Microsoft. We hope you enjoy using it! If you do, please consider joining the active community of developers that are contributing to the project on GitHub (https://github.com/dotnet/core). We happily accept issues and PRs.

I've attached the full metadata content as files, for review.

Testing

  • Verified installation on FIPS-enabled system.
  • Verified package upgrade.
  • Verified that applications targeting NETStandard 2.1 can build against new package content.

metadata.new.txt
metadata.original.txt
copyright.new.txt
copyright.original.txt

@rbhanda rbhanda modified the milestones: 8.0.x, 8.0.6 Apr 25, 2024
@rbhanda rbhanda added Servicing-approved Approved for servicing release and removed Servicing-consider Issue for next servicing release review labels Apr 25, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

area-Setup Servicing-approved Approved for servicing release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants