Lagersystem/Directory.Build.props at main · lukislp/Lagersystem · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
<Project>

  <!--
    Repository-wide MSBuild defaults.
    Applied automatically to every project (main and tests).
    Keep settings here that are TRULY universal; project-specific tweaks
    belong in the .csproj.
  -->

  <PropertyGroup>
    <!-- Language & nullability -->
    <LangVersion>latest</LangVersion>
    <Nullable>enable</Nullable>
    <ImplicitUsings>enable</ImplicitUsings>

    <!-- Static analysis -->
    <AnalysisLevel>latest-recommended</AnalysisLevel>
    <AnalysisMode>Recommended</AnalysisMode>
    <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
    <EnableNETAnalyzers>true</EnableNETAnalyzers>

    <!--
      Strict mode: NEW warnings break the build. Existing warnings are
      pinned to a NoWarn baseline below so the codebase ratchets forward
      without forcing a big-bang cleanup. Remove codes from the baseline
      as they are fixed.
    -->
    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
    <WarningsAsErrors>$(WarningsAsErrors);ASP0000</WarningsAsErrors>
    <!--
      CA1848 (LoggerMessage source generator) is being migrated incrementally.
      Fully migrated services (catalog files in *.Log.cs):
        - AuthService                (EventIds 1000-1083)
        - SessionManagementService   (EventIds 1100-1201)
        - NotificationService        (EventIds 4000-4099)
        - BackupManagementService    (EventIds 3000-3099)
      Until the rest of the codebase is migrated, CA1848 remains a warning
      (visible in Error List) but does NOT break the build.
    -->
    <WarningsNotAsErrors>$(WarningsNotAsErrors);CA1848</WarningsNotAsErrors>
    <NoWarn>
      $(NoWarn);
      ASPDEPR005;BL0008;
      CA1000;CA1001;CA1304;CA1305;CA1310;CA1311;CA1707;CA1716;
      CA1805;CA1822;CA1835;CA1845;CA1850;CA1852;CA1854;
      CA1859;CA1860;CA1861;CA1862;CA1866;CA1869;CA1872;CA1873;
      CA1875;CA2016;CA2022;CA2024;CA2201;CA2254;CA5350;
      CS0169;CS0219;CS0414;CS0472;CS0618;CS4014;CS8601;CS8602;
      CS8604;CS8629;
      EF1002;NU1608;SYSLIB0060
    </NoWarn>

    <!-- Make build deterministic in CI -->
    <Deterministic>true</Deterministic>
    <ContinuousIntegrationBuild Condition="'$(CI)' == 'true'">true</ContinuousIntegrationBuild>
  </PropertyGroup>

  <!--
    NuGet audit exclusions: advisories that are acknowledged but not
    blanket-suppressed via NoWarn, so future new advisories still break
    the build. One entry per advisory, with the reason it's excluded.
  -->
  <ItemGroup>
    <!--
      GHSA-2m69-gcr7-jv3q: SQLitePCLRaw.lib.e_sqlite3 bundles a pre-3.50.2
      SQLite affected by CVE-2025-6965 (memory corruption via aggregate
      terms exceeding column count). No patched release exists on the
      2.1.x line; the fix requires SQLitePCLRaw 3.x, which restructures
      the package graph (lib.e_sqlite3 is replaced by config.e_sqlite3 +
      a separate SQLite package) and isn't yet what Microsoft.Data.Sqlite/
      EF Core Sqlite (still on 2.1.11 as of 10.0.10) build against, so it
      can't be pinned in isolation without risking a native-interop
      mismatch. The few ExecuteSqlRaw call sites in this app build SQL
      from fixed internal schema metadata (EF model table/column names)
      or hardcoded strings, never from external/user input, so the CVE's
      exploit vector (attacker-crafted aggregate-heavy query text) isn't
      reachable here. Revisit once EF Core Sqlite moves to SQLitePCLRaw
      3.x upstream.
    -->
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-2m69-gcr7-jv3q" />
  </ItemGroup>

  <!--
    Authenticode signing of the build outputs.
    Only active if scripts\codesigning.thumbprint exists
    (generated by scripts\setup-codesigning.ps1).
    Signs the output assembly after build with the local
    code-signing certificate; combined with the public key
    imported into TrustedPublisher, this unblocks the DLL
    against WDAC. Not active in CI (no local cert store there).
  -->
  <PropertyGroup>
    <_CodeSigningThumbprintFile>$(MSBuildThisFileDirectory)scripts\codesigning.thumbprint</_CodeSigningThumbprintFile>
    <EnableLocalCodeSigning Condition="'$(CI)' != 'true' AND '$(EnableLocalCodeSigning)' == '' AND Exists('$(_CodeSigningThumbprintFile)')">true</EnableLocalCodeSigning>
  </PropertyGroup>

  <Target Name="SignOutputWithLocalDevCert"
          AfterTargets="Build"
          Condition="'$(EnableLocalCodeSigning)' == 'true'">
    <ReadLinesFromFile File="$(_CodeSigningThumbprintFile)">
      <Output TaskParameter="Lines" PropertyName="_CodeSigningThumbprint" />
    </ReadLinesFromFile>
    <ItemGroup>
      <_AssembliesToSign Include="$(OutDir)LagersystemLVHome*.dll" />
    </ItemGroup>
    <Message Importance="high" Text="Signing @(_AssembliesToSign->Count()) assemblies in $(OutDir) with $(_CodeSigningThumbprint)" Condition="'@(_AssembliesToSign)' != ''" />
    <Exec Command="powershell -NoProfile -ExecutionPolicy Bypass -Command &quot;$cert = Get-ChildItem Cert:\CurrentUser\My\$(_CodeSigningThumbprint); if ($null -eq $cert) { exit 0 }; $sig = Get-AuthenticodeSignature -FilePath '%(_AssembliesToSign.FullPath)'; if ($sig.SignerCertificate -ne $null -and $sig.SignerCertificate.Thumbprint -eq $cert.Thumbprint -and $sig.TimeStamperCertificate -ne $null) { exit 0 }; Set-AuthenticodeSignature -FilePath '%(_AssembliesToSign.FullPath)' -Certificate $cert -HashAlgorithm SHA256 -TimestampServer 'http://timestamp.digicert.com' | Out-Null&quot;"
          Condition="'@(_AssembliesToSign)' != ''"
          IgnoreExitCode="false" />
  </Target>

</Project>