PublishAot brings in Microsoft.DotNet.ILCompiler and causes AppLocker issue
#95,174 创建于 2023年11月23日
仓库指标
- 星标
- (17,886 个星标)
- PR 合并指标
- (平均合并 12天 11小时) (30 天内合并 661 个 PR)
描述
Description
Publishing a project with aot tries to call findvcvarsall.bat in C:\Users\_USER_\.nuget\packages\microsoft.dotnet.ilcompiler\8.0.0\build which in turn is blocked in a corporate environment by AppLocker rules.
Reproduction Steps
- Create new console project with
dotnet new console --aot - Publish the project with
dotnet publish /p:RuntimeIdentifier=win-x64 /p:SelfContained=true
Expected behavior
Project is successfully published.
Actual behavior
The build is cancelled, because at least one batch file is run from a location where, under default corporate AppLocker rules, script and exe execution is not allowed.
Regression?
No response
Known Workarounds
No response
Configuration
.NET SDK: Version: 8.0.100 Commit: 57efcf1350 Workload version: 8.0.100-manifests.8d38d0cc
OS Name: Windows OS Version: 10.0.19045 OS Platform: Windows RID: win-x64 Base Path: C:\Program Files\dotnet\sdk\8.0.100\
Other information
New workflows should be created in a way that developers can take advantage, without having administrative rights on their machines and without bothering it helpdesk and sysadmin people.
In a world where it security is a top priority it is a bad habit to expect developers in corporate environments to have excess rights on their machines just to develop software.