Merging internal commits for release/8.0.4xx

NuGet.config

@@ -4,22 +4,26 @@
     <clear />
     <!--Begin: Package sources managed by Dependency Flow automation. Do not edit the sources below.-->
     <!--  Begin: Package sources from dotnet-emsdk -->
+    <add key="darc-pub-dotnet-emsdk-ac9f809" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-emsdk-ac9f8092/nuget/v3/index.json" />
     <!--  End: Package sources from dotnet-emsdk -->
     <!--  Begin: Package sources from dotnet-format -->
     <add key="darc-pub-dotnet-format-6eca172" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-format-6eca172f/nuget/v3/index.json" />
     <!--  End: Package sources from dotnet-format -->
     <!--  Begin: Package sources from dotnet-aspnetcore -->
+    <add key="darc-int-dotnet-aspnetcore-03ef277" value="https://pkgs.dev.azure.com/dnceng/internal/_packaging/darc-int-dotnet-aspnetcore-03ef277b/nuget/v3/index.json" />
     <!--  End: Package sources from dotnet-aspnetcore -->
     <!--  Begin: Package sources from DotNet-msbuild-Trusted -->
     <!--  End: Package sources from DotNet-msbuild-Trusted -->
     <!--  Begin: Package sources from dotnet-roslyn-analyzers -->
     <!--  End: Package sources from dotnet-roslyn-analyzers -->
     <!--  Begin: Package sources from dotnet-runtime -->
+    <add key="darc-int-dotnet-runtime-18fd75c" value="https://pkgs.dev.azure.com/dnceng/internal/_packaging/darc-int-dotnet-runtime-18fd75c8/nuget/v3/index.json" />
     <!--  End: Package sources from dotnet-runtime -->
     <!--  Begin: Package sources from dotnet-templating -->
     <add key="darc-pub-dotnet-templating-582216c" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-templating-582216c8/nuget/v3/index.json" />
     <!--  End: Package sources from dotnet-templating -->
     <!--  Begin: Package sources from dotnet-windowsdesktop -->
+    <add key="darc-int-dotnet-windowsdesktop-580168d" value="https://pkgs.dev.azure.com/dnceng/internal/_packaging/darc-int-dotnet-windowsdesktop-580168d2/nuget/v3/index.json" />
     <!--  End: Package sources from dotnet-windowsdesktop -->
     <!--  Begin: Package sources from dotnet-winforms -->
     <!--  End: Package sources from dotnet-winforms -->
@@ -46,14 +50,17 @@
     <!--  Begin: Package sources from dotnet-templating -->
     <!--  End: Package sources from dotnet-templating -->
     <!--  Begin: Package sources from dotnet-aspnetcore -->
+    <add key="darc-int-dotnet-aspnetcore-03ef277" value="true" />
     <!--  End: Package sources from dotnet-aspnetcore -->
     <!--  Begin: Package sources from DotNet-msbuild-Trusted -->
     <!--  End: Package sources from DotNet-msbuild-Trusted -->
     <!--  Begin: Package sources from dotnet-format -->
     <!--  End: Package sources from dotnet-format -->
     <!--  Begin: Package sources from dotnet-runtime -->
+    <add key="darc-int-dotnet-runtime-18fd75c" value="true" />
     <!--  End: Package sources from dotnet-runtime -->
     <!--  Begin: Package sources from dotnet-windowsdesktop -->
+    <add key="darc-int-dotnet-windowsdesktop-580168d" value="true" />
     <!--  Begin: Package sources from dotnet-winforms -->
     <!--  End: Package sources from dotnet-winforms -->
     <!--  End: Package sources from dotnet-windowsdesktop -->

eng/Versions.props

@@ -51,22 +51,22 @@
   </PropertyGroup>
   <PropertyGroup>
     <!-- Dependencies from https://github.com/dotnet/runtime -->
-    <MicrosoftNETCoreAppRefPackageVersion>8.0.28</MicrosoftNETCoreAppRefPackageVersion>
-    <VSRedistCommonNetCoreSharedFrameworkx6480PackageVersion>8.0.28-servicing.26264.13</VSRedistCommonNetCoreSharedFrameworkx6480PackageVersion>
-    <MicrosoftNETCoreAppRuntimewinx64PackageVersion>8.0.28</MicrosoftNETCoreAppRuntimewinx64PackageVersion>
+    <MicrosoftNETCoreAppRefPackageVersion>8.0.29</MicrosoftNETCoreAppRefPackageVersion>
+    <VSRedistCommonNetCoreSharedFrameworkx6480PackageVersion>8.0.29-servicing.26324.3</VSRedistCommonNetCoreSharedFrameworkx6480PackageVersion>
+    <MicrosoftNETCoreAppRuntimewinx64PackageVersion>8.0.29</MicrosoftNETCoreAppRuntimewinx64PackageVersion>
     <MicrosoftNETCoreAppRuntimePackageVersion>$(MicrosoftNETCoreAppRuntimewinx64PackageVersion)</MicrosoftNETCoreAppRuntimePackageVersion>
     <MicrosoftExtensionsDependencyModelPackageVersion>8.0.2</MicrosoftExtensionsDependencyModelPackageVersion>
-    <MicrosoftNETCoreDotNetHostResolverPackageVersion>8.0.28</MicrosoftNETCoreDotNetHostResolverPackageVersion>
-    <MicrosoftNETHostModelVersion>8.0.28-servicing.26264.13</MicrosoftNETHostModelVersion>
+    <MicrosoftNETCoreDotNetHostResolverPackageVersion>8.0.29</MicrosoftNETCoreDotNetHostResolverPackageVersion>
+    <MicrosoftNETHostModelVersion>8.0.29-servicing.26324.3</MicrosoftNETHostModelVersion>
     <MicrosoftExtensionsFileSystemGlobbingPackageVersion>8.0.0</MicrosoftExtensionsFileSystemGlobbingPackageVersion>
     <MicrosoftExtensionsDependencyModelVersion>$(MicrosoftExtensionsDependencyModelPackageVersion)</MicrosoftExtensionsDependencyModelVersion>
     <MicrosoftExtensionsLoggingVersion>8.0.1</MicrosoftExtensionsLoggingVersion>
     <MicrosoftExtensionsLoggingAbstractionsVersion>8.0.3</MicrosoftExtensionsLoggingAbstractionsVersion>
     <MicrosoftExtensionsLoggingConsoleVersion>8.0.1</MicrosoftExtensionsLoggingConsoleVersion>
-    <MicrosoftNETILLinkTasksPackageVersion>8.0.28</MicrosoftNETILLinkTasksPackageVersion>
+    <MicrosoftNETILLinkTasksPackageVersion>8.0.29</MicrosoftNETILLinkTasksPackageVersion>
     <MicrosoftBclAsyncInterfacesPackageVersion>8.0.0</MicrosoftBclAsyncInterfacesPackageVersion>
     <MicrosoftExtensionsFileProvidersAbstractionsPackageVersion>8.0.0</MicrosoftExtensionsFileProvidersAbstractionsPackageVersion>
-    <MicrosoftExtensionsObjectPoolPackageVersion>8.0.28</MicrosoftExtensionsObjectPoolPackageVersion>
+    <MicrosoftExtensionsObjectPoolPackageVersion>8.0.29</MicrosoftExtensionsObjectPoolPackageVersion>
     <MicrosoftWin32SystemEventsPackageVersion>8.0.0</MicrosoftWin32SystemEventsPackageVersion>
     <SystemCompositionAttributedModelPackageVersion>8.0.0</SystemCompositionAttributedModelPackageVersion>
     <SystemCompositionConventionPackageVersion>8.0.0</SystemCompositionConventionPackageVersion>
@@ -77,7 +77,7 @@
     <SystemConfigurationConfigurationManagerPackageVersion>8.0.1</SystemConfigurationConfigurationManagerPackageVersion>
     <SystemDrawingCommonPackageVersion>8.0.7</SystemDrawingCommonPackageVersion>
     <SystemSecurityCryptographyPkcsPackageVersion>8.0.1</SystemSecurityCryptographyPkcsPackageVersion>
-    <SystemSecurityCryptographyXmlPackageVersion>8.0.3</SystemSecurityCryptographyXmlPackageVersion>
+    <SystemSecurityCryptographyXmlPackageVersion>8.0.4</SystemSecurityCryptographyXmlPackageVersion>
     <SystemSecurityPermissionsPackageVersion>8.0.0</SystemSecurityPermissionsPackageVersion>
     <SystemServiceProcessServiceControllerVersion>8.0.1</SystemServiceProcessServiceControllerVersion>
     <SystemTextJsonPackageVersion>8.0.6</SystemTextJsonPackageVersion>
@@ -171,13 +171,13 @@
   </PropertyGroup>
   <PropertyGroup>
     <!-- Dependencies from https://github.com/aspnet/AspNetCore -->
-    <MicrosoftAspNetCoreAppRefPackageVersion>8.0.28</MicrosoftAspNetCoreAppRefPackageVersion>
-    <MicrosoftAspNetCoreDeveloperCertificatesXPlatPackageVersion>8.0.28-servicing.26269.13</MicrosoftAspNetCoreDeveloperCertificatesXPlatPackageVersion>
-    <MicrosoftAspNetCoreComponentsSdkAnalyzersPackageVersion>8.0.28-servicing.26269.13</MicrosoftAspNetCoreComponentsSdkAnalyzersPackageVersion>
-    <MicrosoftAspNetCoreMvcAnalyzersPackageVersion>8.0.28-servicing.26269.13</MicrosoftAspNetCoreMvcAnalyzersPackageVersion>
-    <MicrosoftAspNetCoreMvcApiAnalyzersPackageVersion>8.0.28-servicing.26269.13</MicrosoftAspNetCoreMvcApiAnalyzersPackageVersion>
-    <MicrosoftAspNetCoreAnalyzersPackageVersion>8.0.28-servicing.26269.13</MicrosoftAspNetCoreAnalyzersPackageVersion>
-    <MicrosoftAspNetCoreTestHostPackageVersion>8.0.28</MicrosoftAspNetCoreTestHostPackageVersion>
+    <MicrosoftAspNetCoreAppRefPackageVersion>8.0.29</MicrosoftAspNetCoreAppRefPackageVersion>
+    <MicrosoftAspNetCoreDeveloperCertificatesXPlatPackageVersion>8.0.29-servicing.26325.17</MicrosoftAspNetCoreDeveloperCertificatesXPlatPackageVersion>
+    <MicrosoftAspNetCoreComponentsSdkAnalyzersPackageVersion>8.0.29-servicing.26325.17</MicrosoftAspNetCoreComponentsSdkAnalyzersPackageVersion>
+    <MicrosoftAspNetCoreMvcAnalyzersPackageVersion>8.0.29-servicing.26325.17</MicrosoftAspNetCoreMvcAnalyzersPackageVersion>
+    <MicrosoftAspNetCoreMvcApiAnalyzersPackageVersion>8.0.29-servicing.26325.17</MicrosoftAspNetCoreMvcApiAnalyzersPackageVersion>
+    <MicrosoftAspNetCoreAnalyzersPackageVersion>8.0.29-servicing.26325.17</MicrosoftAspNetCoreAnalyzersPackageVersion>
+    <MicrosoftAspNetCoreTestHostPackageVersion>8.0.29</MicrosoftAspNetCoreTestHostPackageVersion>
   </PropertyGroup>
   <!-- Dependencies from https://github.com/dotnet/razor -->
   <PropertyGroup>
@@ -187,7 +187,7 @@
   </PropertyGroup>
   <PropertyGroup>
     <!-- Dependencies from https://github.com/dotnet/wpf -->
-    <MicrosoftNETSdkWindowsDesktopPackageVersion>8.0.28-servicing.26269.2</MicrosoftNETSdkWindowsDesktopPackageVersion>
+    <MicrosoftNETSdkWindowsDesktopPackageVersion>8.0.29-servicing.26325.4</MicrosoftNETSdkWindowsDesktopPackageVersion>
   </PropertyGroup>
   <PropertyGroup Label="Manually updated">
     <!-- Dependencies from https://github.com/microsoft/MSBuildLocator -->
@@ -231,7 +231,7 @@
   </PropertyGroup>
   <PropertyGroup>
     <!-- Workloads from dotnet/emsdk -->
-    <MicrosoftNETWorkloadEmscriptenCurrentManifest80100PackageVersion>8.0.28</MicrosoftNETWorkloadEmscriptenCurrentManifest80100PackageVersion>
+    <MicrosoftNETWorkloadEmscriptenCurrentManifest80100PackageVersion>8.0.29</MicrosoftNETWorkloadEmscriptenCurrentManifest80100PackageVersion>
     <EmscriptenWorkloadManifestVersion>$(MicrosoftNETWorkloadEmscriptenCurrentManifest80100PackageVersion)</EmscriptenWorkloadManifestVersion>
     <!-- emsdk workload prerelease version band must match the emsdk feature band -->
     <EmscriptenWorkloadFeatureBand>8.0.100$([System.Text.RegularExpressions.Regex]::Match($(EmscriptenWorkloadManifestVersion), `-rtm|-[A-z]*\.*\d*`))</EmscriptenWorkloadFeatureBand>

src/Containers/Microsoft.NET.Build.Containers/ContentStore.cs

@@ -8,30 +8,18 @@ namespace Microsoft.NET.Build.Containers;
 
 internal static class ContentStore
 {
-    public static string ArtifactRoot { get; set; } = Path.Combine(Path.GetTempPath(), "Containers");
+    public static string ArtifactRoot { get; set; } = EnsureCacheDirectory();
     public static string ContentRoot
     {
         get
         {
             string contentPath = Path.Join(ArtifactRoot, "Content");
-
-            Directory.CreateDirectory(contentPath);
-
+            CreateCacheDirectory(contentPath);
             return contentPath;
         }
     }
 
-    public static string TempPath
-    {
-        get
-        {
-            string tempPath = Path.Join(ArtifactRoot, "Temp");
-
-            Directory.CreateDirectory(tempPath);
-
-            return tempPath;
-        }
-    }
+    public static string TempPath { get; } = Directory.CreateTempSubdirectory().FullName;
 
     public static string PathForDescriptor(Descriptor descriptor)
     {
@@ -62,8 +50,81 @@ public static string GetPathForHash(string contentHash)
         return Path.Combine(ContentRoot, contentHash);
     }
 
-    public static string GetTempFile()
+    public static string GetTempFile() => Path.Join(TempPath, Path.GetRandomFileName());
+
+    /// <summary>
+    /// Gets the path to the user cache directory for SDK container builds, creating it if it does
+    /// not already exist.
+    /// </summary>
+    private static string EnsureCacheDirectory()
+    {
+        string userCacheDir = GetUserCacheDirectoryPath();
+        CreateCacheDirectory(userCacheDir);
+
+        string dotnetCacheDir = Path.Join(userCacheDir, "dotnet");
+        CreateCacheDirectory(dotnetCacheDir);
+
+        string containersCacheDir = Path.Join(dotnetCacheDir, "Containers");
+        CreateCacheDirectory(containersCacheDir);
+
+        return containersCacheDir;
+    }
+
+    /// <summary>
+    /// Creates a cache directory with user-scoped permissions based on the OS.
+    /// </summary>
+    /// <remarks>
+    /// Permissions are only set for the leaf directory. The caller is expected to handle
+    /// permissions for intermediate directories.
+    /// </remarks>
+    private static void CreateCacheDirectory(string path)
+    {
+        if (OperatingSystem.IsWindows())
+        {
+            Directory.CreateDirectory(path);
+        }
+        else
+        {
+            // Per XDG_CACHE_HOME spec: if the cache directory doesn't exist, try to create it with
+            // permissions 0700. If it already exists, don't try to change the permissions.
+            // See https://specifications.freedesktop.org/basedir/latest/#referencing
+            Directory.CreateDirectory(path, UnixFileMode.UserRead | UnixFileMode.UserWrite | UnixFileMode.UserExecute);
+        }
+    }
+
+    /// <summary>
+    /// Gets the user-scoped cache directory, accounting for OS differences.
+    /// </summary>
+    private static string GetUserCacheDirectoryPath()
     {
-        return Path.Join(TempPath, Path.GetRandomFileName());
+        if (OperatingSystem.IsLinux())
+        {
+            // See "XDG Base Directory Specification":
+            // https://specifications.freedesktop.org/basedir/latest/
+            string? xdgCacheHome = Environment.GetEnvironmentVariable("XDG_CACHE_HOME");
+            if (!string.IsNullOrEmpty(xdgCacheHome) && Path.IsPathFullyQualified(xdgCacheHome))
+            {
+                return xdgCacheHome;
+            }
+
+            // From the spec, if XDG_CACHE_HOME is not set then fall back to ~/.cache
+            string userHomeDirectory = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
+            return Path.Join(userHomeDirectory, ".cache");
+        }
+
+        if (OperatingSystem.IsMacOS())
+        {
+            // See "macOS Library Directory Details":
+            // https://developer.apple.com/library/archive/documentation/FileManagement/Conceptual/FileSystemProgrammingGuide/MacOSXDirectories/MacOSXDirectories.html
+            string userHomeDirectory = Environment.GetFolderPath(Environment.SpecialFolder.UserProfile);
+            return Path.Join(userHomeDirectory, "Library", "Caches");
+        }
+
+        // On other platforms, use the local application data folder.
+        string localAppData = Environment.GetFolderPath(
+            Environment.SpecialFolder.LocalApplicationData,
+            Environment.SpecialFolderOption.DoNotVerify);
+
+        return localAppData;
     }
 }

src/Containers/Microsoft.NET.Build.Containers/DigestUtils.cs

@@ -37,4 +37,17 @@ internal static string GetSha(string str)
 
         return Convert.ToHexString(hash).ToLowerInvariant();
     }
+
+    /// <summary>
+    /// Returns the encoded (hash) portion of a digest string as raw bytes.
+    /// </summary>
+    /// <remarks>
+    /// <c>GetEncodedValue("sha256:e3b0c4...")</c> returns the bytes for <c>"e3b0c4..."</c>.
+    /// </remarks>
+    internal static byte[] GetEncodedValue(string digest)
+    {
+        int separatorIndex = digest.IndexOf(':');
+        string encoded = separatorIndex >= 0 ? digest[(separatorIndex + 1)..] : digest;
+        return Convert.FromHexString(encoded);
+    }
 }

src/Containers/Microsoft.NET.Build.Containers/Exceptions/InvalidDigestException.cs

@@ -0,0 +1,24 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+using System.Security.Cryptography;
+
+namespace Microsoft.NET.Build.Containers;
+
+internal sealed class InvalidDigestException : Exception
+{
+    public InvalidDigestException(string message)
+        : base(message)
+    {
+    }
+
+    public static void ThrowIfMismatched(ReadOnlySpan<byte> expected, ReadOnlySpan<byte> actual)
+    {
+        if (!CryptographicOperations.FixedTimeEquals(expected, actual))
+        {
+            string expectedHashString = Convert.ToHexString(expected).ToLowerInvariant();
+            string actualHashString = Convert.ToHexString(actual).ToLowerInvariant();
+            throw new InvalidDigestException($"Expected {expectedHashString}, got {actualHashString}.");
+        }
+    }
+}

src/Containers/Microsoft.NET.Build.Containers/Registry/Registry.cs

@@ -6,6 +6,7 @@
 using NuGet.RuntimeModel;
 using System.Diagnostics;
 using System.Net.Http.Json;
+using System.Security.Cryptography;
 using System.Text.Json.Nodes;
 
 namespace Microsoft.NET.Build.Containers;
@@ -405,28 +406,50 @@ public async Task<string> DownloadBlobAsync(string repository, Descriptor descri
     {
         cancellationToken.ThrowIfCancellationRequested();
         string localPath = ContentStore.PathForDescriptor(descriptor);
-    
-        if (File.Exists(localPath))
+
+        try
         {
-            // Assume file is up to date and just return it
+            var fileStream = File.OpenRead(localPath);
+
+            var actualHash = SHA256.HashData(fileStream);
+            var expectedHash = DigestUtils.GetEncodedValue(descriptor.Digest);
+            InvalidDigestException.ThrowIfMismatched(expectedHash, actualHash);
+
             return localPath;
         }
-
+        catch (DirectoryNotFoundException)
+        {
+            // Cache miss
+        }
+        catch (FileNotFoundException)
+        {
+            // Cache miss
+        }
+        catch (InvalidDigestException exception)
+        {
+            // Incorrect digest
+            _logger.LogTrace(
+                "Digest validation failed for cached blob {1} ({2}), redownloading from registry.",
+                localPath, exception.Message);
+        }
+
         string tempTarballPath = ContentStore.GetTempFile();
-    
+
         int retryCount = 0;
         while (retryCount < MaxDownloadRetries)
         {
             try
             {
                 // No local copy, so download one
                 using Stream responseStream = await _registryAPI.Blob.GetStreamAsync(repository, descriptor.Digest, cancellationToken).ConfigureAwait(false);
-    
+
                 using (FileStream fs = File.Create(tempTarballPath))
                 {
-                    await responseStream.CopyToAsync(fs, cancellationToken).ConfigureAwait(false);
+                    await responseStream
+                        .CopyToAndVerifyAsync(fs, descriptor.Digest, cancellationToken)
+                        .ConfigureAwait(false);
                 }
-    
+
                 // Break the loop if successful
                 break;
             }
@@ -437,16 +460,16 @@ public async Task<string> DownloadBlobAsync(string repository, Descriptor descri
                 {
                     throw new UnableToDownloadFromRepositoryException(repository);
                 }
-    
+
                 _logger.LogTrace("Download attempt {0}/{1} for repository '{2}' failed. Error: {3}", retryCount, MaxDownloadRetries, repository, ex.ToString());
-    
+
                 // Wait before retrying
                 await Task.Delay(_retryDelayProvider(), cancellationToken).ConfigureAwait(false);
             }
         }
-    
+
         File.Move(tempTarballPath, localPath, overwrite: true);
-    
+
         return localPath;
     }
 
@@ -563,7 +586,7 @@ public async Task PushManifestListAsync(
             _logger.LogInformation(Strings.Registry_TagUploadStarted, tag, RegistryName);
             await _registryAPI.Manifest.PutAsync(destinationImageReference.Repository, tag, multiArchImage.ImageIndex, multiArchImage.ImageIndexMediaType, cancellationToken).ConfigureAwait(false);
             _logger.LogInformation(Strings.Registry_TagUploaded, tag, RegistryName);
-        }          
+        }
     }
 
     public Task PushAsync(BuiltImage builtImage, SourceImageReference source, DestinationImageReference destination, CancellationToken cancellationToken)