Use a deterministic order for files when calculating psmdcp hash
#14.916 geöffnet am 23.05.2026
Repository-Metriken
- Stars
- (1.459 Sterne)
- PR-Merge-Metriken
- (Durchschn. Merge 464T 23h) (1 gemergte PR in 30 T)
Beschreibung
NuGet Product(s) Involved
dotnet.exe
The Elevator Pitch
With reproducible builds, software can become more trustworthy, transparent and secure. It becomes easier to verify that binaries have not been tampered with it, and easier to identify some types of security attacks.
As part of that, it would be great if nupkgs were fully reproducible.
One current area of non-reproducibility, missed in https://github.com/NuGet/Home/issues/14448, is the order of files used to generate the psmdcp hash in PackageBuilder .
NuGet.Client's PackageBuilder.CalcPsmdcpName relies on the order the files defined in the manifest. The order is non-deterministic when file globs are used (example). We should make this order well-defined.
Additional Context and Details
Relates to https://github.com/dotnet/source-build/issues/4963