Compliance issue for [SFI-ES5.1] Azure Artifacts - Central Feed Services (CFS)

Open
#119 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Stale
Tech stack
azure
Domain
ci-cd, devops, security

Research direction

Start at the MicrosoftSecurityDevOps@1 task entry point and trace how the templateanalyzer tool installs Microsoft.Security.DevOps.Tools.Configuration. Review how feedsToUse, nugetConfigPath, and nuget.config are handled, then compare the package source with the logged public feed. Done means package retrieval can honor the configured Azure Artifacts feed and suppress the public source.

Written by the indexing model from the issue text.

Description

Hi Team,

I integrated this tool into our repo build pipeline, but encountered a compliance issue [SFI-ES5.1] related to Azure Artifacts - Central Feed Services (CFS). The requirement is that builds must pull open-source libraries from an [Azure Artifacts] feed. To resolve this, I tried using configuration options similar to those provided by other Azure DevOps tasks, providing the params like feedsToUse and nugetConfigPath, such as:

- task: MicrosoftSecurityDevOps@1
  displayName: 'Run Template Analyzer'
  inputs:    
    tools: 'templateanalyzer'
    break: false
    feedsToUse: config
    nugetConfigPath: 'nuget.config'

However, this didn't work as expected. The logs show that MSDO is still retrieving the feed from the public source:

Installing Microsoft.Security.DevOps.Tools.Configuration from feed...
  ------------------------------------------------------------------------------
      GET https://msdous.pkgs.visualstudio.com/d1ee6cdc-c4ce-4e34-95df-4c038f0d3683/_packaging/7c44b921-ee7b-48f1-bad3-d9227399a9fc/nuget/v3/registrations2-semver2/microsoft.security.devops.tools.configuration/index.json
      OK https://msdous.pkgs.visualstudio.com/d1ee6cdc-c4ce-4e34-95df-4c038f0d3683/_packaging/7c44b921-ee7b-48f1-bad3-d9227399a9fc/nuget/v3/registrations2-semver2/microsoft.security.devops.tools.configuration/index.json 84ms

Should we consider supporting a feed suppression feature to help meet security compliance requirements?

Thanks,
Best regards,

Dominant language
TypeScript
Stars
86
Forks
22
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/security-devops-azdevops

All issues in microsoft/security-devops-azdevops

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.