[release/10.1xx] Backport CFSClean network isolation fixes - #12665
Open
jonathanpeppers wants to merge 4 commits into
Open
[release/10.1xx] Backport CFSClean network isolation fixes#12665jonathanpeppers wants to merge 4 commits into
jonathanpeppers wants to merge 4 commits into
Conversation
Bumps [external/debugger-libs](https://github.com/mono/debugger-libs) from `f257277` to `e7fbb71`. - [Commits](mono/debugger-libs@f257277...e7fbb71) --- updated-dependencies: - dependency-name: external/debugger-libs dependency-version: e7fbb713d156d11193ed404783ad6fe9c4042a6d dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Roslyn analyzer tests acquire `Microsoft.NETCore.App.Ref` at test runtime. The testing library ignored the repository `NuGet.config` and contacted public NuGet infrastructure, producing CFS network-isolation violations on `main`. Copy the repository NuGet configuration beside the test assembly and configure the analyzer, code-fix, and refactoring verifier types to use it. Runtime reference package acquisition now uses the approved Azure Artifacts feeds already defined by the repository. The reported `ci.dot.net` and `shavamanifest*.azureedge.net` destinations are aliases associated with the same Azure Front Door event as the `testhost.exe` NuGet request. `asmconfigfiles-prod.azure-api.net` is intentionally unchanged because it originates from the pipeline-injected Geneva `ConfigDownloader.exe` and requires infrastructure remediation outside this repository. Validation: `dotnet test src\Microsoft.Android.Sdk.Analysis\Tests\Microsoft.Android.Sdk.Analysis.Tests.csproj -c Release -p:RestoreConfigFile=NuGet.config` (16 passed, 1 skipped). A fresh temporary package cache confirmed `Microsoft.NETCore.App.Ref.3.1.0.nupkg` was acquired through the copied approved-feed configuration. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
- set `networkIsolationPolicy: Permissive,CFSClean` in the shared DevDiv production/PR pipeline entry point - set the same policy in the separate dnceng/internal production pipeline entry point - retain `Permissive` so Android SDK/NDK traffic remains available - rely on centrally required `CFSClean2` and `CFSClean3` instead of listing them in repository YAML - replace `capital P` with `uppercase P` in an sdkmanager parsing comment to avoid a PoliCheck geopolitical false positive without changing behavior | Definition | YAML entry point | 1ES template path | | --- | --- | --- | | DevDiv `11410` — Xamarin.Android | `build-tools/automation/azure-pipelines.yaml` | Official | | DevDiv `12278` — Xamarin.Android-PR | `build-tools/automation/azure-pipelines.yaml` | Unofficial | | dnceng/internal `1644` — dotnet-android-internal | `build-tools/automation/azure-pipelines-internal.yaml` | Official | The dnceng/internal definition is independent of the DevDiv definitions, so both YAML entry points require an explicit setting. `dotnet-android-tools-official` (`1596`) belongs to the separate `dotnet-android-tools` repository and is not in scope. Public, nightly, API-docs, and Renovate definitions are also unchanged. This PR is opened from a branch in the main `dotnet/android` repository so trusted/full definitions can validate the submitted commit. The earlier fork PR was closed. S360 tracks Xamarin.Android (`devdiv/11410`) and Xamarin.Android-PR (`devdiv/12278`). Direct `api.nuget.org` access is classified as a `CFSClean` violation. This change applies the policy without weakening it or adding a public-NuGet allowlist. Final commit: `b63ae9fd6`. The pipeline validation builds below ran against implementation commit `2cc30f604c5742141d9cccff57311614362e99c2`; the final commit changes only comment wording to resolve the resulting PoliCheck false positive. - [Xamarin.Android build 15184305](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=15184305&view=results): `Permissive` and `CFSClean` came from `PipelineArguments`; `CFSClean2` and `CFSClean3` came from `PerPipelineRequiredConfig`. Windows Android preparation succeeded. The run reached a 20-minute Mac .NET timeout after its build/tests had otherwise succeeded; its PoliCheck failure is addressed by the final comment-only commit. - [Xamarin.Android-PR build 15184306](https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=15184306&view=results): the same policy/source composition was applied. `Prepare Solution` downloaded 15 Android archives from `dl.google.com`, including `android-ndk-r28c-windows.zip`, and completed successfully with no network-isolation block. Its PoliCheck failure is addressed by the final comment-only commit. - [dotnet-android-internal build 3064262](https://dev.azure.com/dnceng/internal/_build/results?buildId=3064262&view=results): the same policy/source composition was applied. Its Linux Android archive cache restored successfully, and `make jenkins` actively built native Android targets with the cached SDK CMake and NDK Clang toolchain with no network-isolation or acquisition errors. Expanded `Start Network Isolation` logs for all three definitions report: `Policies=[(Permissive:PipelineArguments), (CFSClean:PipelineArguments), ... (CFSClean2:PerPipelineRequiredConfig), (CFSClean3:PerPipelineRequiredConfig)]` The policy composition and required Android dependency acquisition checks pass; the final comment-only fix removes the observed PoliCheck false positive. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…12544) ## Summary - update the test Xamarin.Build.Download pin from 0.11.4 to 0.11.6 - expose `XamarinBuildDownloadGoogleMavenRepository` repository-wide through the shared Azure Pipelines variables template - route eligible Google Maven downloads through dnceng's `dotnet-public-maven` feed - directly pin the Google Play Services test that would otherwise resolve XBD 0.11.4 transitively The XBD implementation only rewrites URLs beginning with `https://dl.google.com/dl/android/maven2/`; Android SDK/NDK and partial ZIP URLs such as `dl-ssl.google.com/android/repository/...` remain unchanged. ## Validation - parsed the shared pipeline variables YAML - verified an uppercase Azure Pipelines-style environment variable reaches nested `dotnet msbuild` as `$(XamarinBuildDownloadGoogleMavenRepository)` - built `xa-prep-tasks` and `Xamarin.ProjectTools` - inspected the relevant NuGet dependency graphs to identify transitive XBD consumers - migrated Xamarin.Build.Download 0.11.6 through the quarantine feed and verified it is available on dnceng `dotnet-public` Implementation reference: dotnet/android-libraries@4fe06d5 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The changes are consistent and self-contained, and the updated test/pipeline configuration correctly routes network-dependent operations through approved feeds while preserving required traffic.
Pull request overview
This PR backports a set of CI/test infrastructure changes to ensure the release/10.1xx branch remains compatible with CFSClean network isolation requirements, avoiding direct access to public NuGet infrastructure while keeping required Android SDK/NDK traffic functional.
Changes:
- Configure Roslyn analyzer tests to acquire reference assemblies using the repository
NuGet.config(copied to test output and consumed viaReferenceAssemblies). - Enable
networkIsolationPolicy: Permissive,CFSCleanin the shared DevDiv pipeline entry point. - Update/pin
Xamarin.Build.Downloadusage and add a pipeline variable to support routing eligible Google Maven downloads through the mirror feed.
File summaries
| File | Description |
|---|---|
| src/Xamarin.Android.Build.Tasks/Tests/Xamarin.ProjectTools/Android/KnownPackages.cs | Bumps the test pin for Xamarin.Build.Download to 0.11.6. |
| src/Xamarin.Android.Build.Tasks/Tests/Xamarin.Android.Build.Tests/BuildTest2.cs | Directly pins Xamarin.Build.Download in a test project’s PackageReferences to avoid relying on transitive resolution. |
| src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpVerifierHelper.cs | Introduces a shared DefaultReferenceAssemblies configured to use a copied NuGet.config at test runtime. |
| src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpCodeRefactoringVerifier`1+Test.cs | Applies the shared DefaultReferenceAssemblies to refactoring verifier tests. |
| src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpCodeFixVerifier`2+Test.cs | Applies the shared DefaultReferenceAssemblies to code-fix verifier tests. |
| src/Microsoft.Android.Sdk.Analysis/Tests/Verifiers/CSharpAnalyzerVerifier`1+Test.cs | Applies the shared DefaultReferenceAssemblies to analyzer verifier tests. |
| src/Microsoft.Android.Sdk.Analysis/Tests/Microsoft.Android.Sdk.Analysis.Tests.csproj | Copies the repository NuGet.config into test output so the verifier helpers can consume it. |
| build-tools/automation/yaml-templates/variables.yaml | Adds a pipeline variable pointing to the dotnet-public-maven mirror feed for XBD Google Maven support. |
| build-tools/automation/azure-pipelines.yaml | Enables networkIsolationPolicy: Permissive,CFSClean in the shared pipeline settings. |
Review details
- Files reviewed: 10/10 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
jonathanpeppers
added
the
ready-to-review
rolfbjarne
approved these changes
Sep 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Backports the complete CFSClean/network-isolation set needed by
release/10.0.1xx:f257277toe7fbb71#10803 /1e4bbd9c501098d18c2306d74c2117b725553f8b— updatemono/debugger-libsto remove its nestedapi.nuget.orgoverride and use the approveddotnet-toolsfeed7c7d207aa8b73eb8e733a9269c5d7e131587096b— route Roslyn analyzer test reference acquisition through the repositoryNuGet.config8eac8ed475d33470319e8ced1040e866c9f01467— enablenetworkIsolationPolicy: Permissive,CFSCleanin the shared DevDiv production/PR pipelineadb7d10d80907604727cd415fbb184a33fd0e3d2— route Xamarin.Build.Download Google Maven requests throughdotnet-public-maven, update XBD to 0.11.6, and directly pin the transitive test consumerThe commits remain separate and in dependency order.
Release compatibility
The #12643 cherry-pick produced modify/delete conflicts for two main-only files that do not exist on this release branch:
build-tools/automation/azure-pipelines-internal.yamlsrc/Xamarin.Android.Tools.AndroidSdk/SdkManager.Packages.csBoth paths remain absent. The first would invent dnceng/internal topology not used by this release branch; the second upstream change was comment-only. The release-applicable shared
build-tools/automation/azure-pipelines.yamlpolicy change was retained unchanged.CFSClean2andCFSClean3are intentionally not listed because they are supplied centrally byPerPipelineRequiredConfig. RetainingPermissiveallows required Android SDK/NDK traffic; DefaultDeny Google SDK/NDK telemetry is not a failure for this change.Validation
Microsoft.Android.Sdk.Analysis.Tests: 16 passed, 1 skippedgit diff --check origin/release/10.0.1xx...HEADXamarin.Android-PR): build 15200544 — queued on PR merge refrefs/pull/12665/mergeXamarin.Android): build 15200531 — queued on trusted branchjonathanpeppers-release-cfsclean-auditAzure results and network-isolation evidence will be updated when both runs complete.