Hello,
I am preparing a Windows desktop application for distribution and use the official NuGet package:
MicroCom.Runtime 0.11.6
During release qualification, the exact DLL from the NuGet package is rejected because it contains an embedded absolute developer/build path similar to:
/home/.../Projects/MicroCom/...
The DLL is unchanged from the official package.
SHA-256 of the exact MicroCom.Runtime.dll I am using:
2538EC6F3C24E901A90E33C37788B9A4E4B6AE8158CAB7328A00A00BB28EAB9E
For supply-chain/provenance reasons I do not want to binary-patch, strip, or locally rebuild the DLL while keeping the same upstream identity/version.
Could you please confirm one of the following:
- Is there an official corrected/path-free MicroCom.Runtime artifact available?
- Is a newer official package planned that removes absolute developer/build paths?
- If not, can an officially identified rebuilt artifact/package be provided from the same source revision without embedded absolute developer paths?
I do not need any private signing material. I only need an official upstream artifact or authoritative guidance that can be tied to a package/version/hash.
Thank you.
Hello,
I am preparing a Windows desktop application for distribution and use the official NuGet package:
MicroCom.Runtime 0.11.6
During release qualification, the exact DLL from the NuGet package is rejected because it contains an embedded absolute developer/build path similar to:
/home/.../Projects/MicroCom/...
The DLL is unchanged from the official package.
SHA-256 of the exact MicroCom.Runtime.dll I am using:
2538EC6F3C24E901A90E33C37788B9A4E4B6AE8158CAB7328A00A00BB28EAB9E
For supply-chain/provenance reasons I do not want to binary-patch, strip, or locally rebuild the DLL while keeping the same upstream identity/version.
Could you please confirm one of the following:
I do not need any private signing material. I only need an official upstream artifact or authoritative guidance that can be tied to a package/version/hash.
Thank you.