{"action":"closed","number":7076,"pull_request":{"url":"https://api.github.com/repos/dotnet/cli/pulls/7076","id":129000091,"html_url":"https://github.com/dotnet/cli/pull/7076","diff_url":"https://github.com/dotnet/cli/pull/7076.diff","patch_url":"https://github.com/dotnet/cli/pull/7076.patch","issue_url":"https://api.github.com/repos/dotnet/cli/issues/7076","number":7076,"state":"closed","locked":false,"title":"Security build definition for CLI","user":{"login":"ravimeda","id":12752450,"avatar_url":"https://avatars1.githubusercontent.com/u/12752450?v=4","gravatar_id":"","url":"https://api.github.com/users/ravimeda","html_url":"https://github.com/ravimeda","followers_url":"https://api.github.com/users/ravimeda/followers","following_url":"https://api.github.com/users/ravimeda/following{/other_user}","gists_url":"https://api.github.com/users/ravimeda/gists{/gist_id}","starred_url":"https://api.github.com/users/ravimeda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ravimeda/subscriptions","organizations_url":"https://api.github.com/users/ravimeda/orgs","repos_url":"https://api.github.com/users/ravimeda/repos","events_url":"https://api.github.com/users/ravimeda/events{/privacy}","received_events_url":"https://api.github.com/users/ravimeda/received_events","type":"User","site_admin":false},"body":"Similar to https://github.com/dotnet/core-setup/pull/2722\r\nThe approach for acquiring official build blobs is different since CLI does not have a dependency dotnet/buildtools that offers reliable means to download Azure blobs. \r\n\r\nApproach:\r\n1. Clone core-setup, and run `init-tools` command to acquire BuildTools.\r\n2. Download blobs with from `dotnetcli/Sdk/<branch>` . For Windows build, include only blobs with extension `.zip` or `.exe`.\r\n3. Run BinSkim and APIScan on all assemblies and executables in the downloaded blobs.\r\n4. Get sources corresponding to the official build. This means checkout at the SHA listed `latest.version`\r\n5. Run CredScan and PoliCheck on the sources.\r\n\r\n@morganbr  list of issues found -\r\nhttps://msazure.visualstudio.com/DefaultCollection/One/_workitems?tempQueryId=740da6e8-15ce-4912-b983-2cf87ed6a530\r\n\r\n@livarcocc PTAL.\r\n\r\nPost PR, I will update documentation for launching security build for CLI at  https://github.com/dotnet/core-eng/blob/master/Documentation/Project-Docs/security-builds.md\r\n\r\nhttps://github.com/dotnet/core-eng/issues/650\r\n\r\n","created_at":"2017-07-05T16:06:23Z","updated_at":"2017-07-27T17:42:30Z","closed_at":"2017-07-27T17:42:30Z","merged_at":null,"merge_commit_sha":"08733dde3a19540a677fec50b72f72adfa238d4e","assignee":{"login":"ravimeda","id":12752450,"avatar_url":"https://avatars1.githubusercontent.com/u/12752450?v=4","gravatar_id":"","url":"https://api.github.com/users/ravimeda","html_url":"https://github.com/ravimeda","followers_url":"https://api.github.com/users/ravimeda/followers","following_url":"https://api.github.com/users/ravimeda/following{/other_user}","gists_url":"https://api.github.com/users/ravimeda/gists{/gist_id}","starred_url":"https://api.github.com/users/ravimeda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ravimeda/subscriptions","organizations_url":"https://api.github.com/users/ravimeda/orgs","repos_url":"https://api.github.com/users/ravimeda/repos","events_url":"https://api.github.com/users/ravimeda/events{/privacy}","received_events_url":"https://api.github.com/users/ravimeda/received_events","type":"User","site_admin":false},"assignees":[{"login":"ravimeda","id":12752450,"avatar_url":"https://avatars1.githubusercontent.com/u/12752450?v=4","gravatar_id":"","url":"https://api.github.com/users/ravimeda","html_url":"https://github.com/ravimeda","followers_url":"https://api.github.com/users/ravimeda/followers","following_url":"https://api.github.com/users/ravimeda/following{/other_user}","gists_url":"https://api.github.com/users/ravimeda/gists{/gist_id}","starred_url":"https://api.github.com/users/ravimeda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ravimeda/subscriptions","organizations_url":"https://api.github.com/users/ravimeda/orgs","repos_url":"https://api.github.com/users/ravimeda/repos","events_url":"https://api.github.com/users/ravimeda/events{/privacy}","received_events_url":"https://api.github.com/users/ravimeda/received_events","type":"User","site_admin":false}],"requested_reviewers":[{"login":"livarcocc","id":367554,"avatar_url":"https://avatars3.githubusercontent.com/u/367554?v=4","gravatar_id":"","url":"https://api.github.com/users/livarcocc","html_url":"https://github.com/livarcocc","followers_url":"https://api.github.com/users/livarcocc/followers","following_url":"https://api.github.com/users/livarcocc/following{/other_user}","gists_url":"https://api.github.com/users/livarcocc/gists{/gist_id}","starred_url":"https://api.github.com/users/livarcocc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/livarcocc/subscriptions","organizations_url":"https://api.github.com/users/livarcocc/orgs","repos_url":"https://api.github.com/users/livarcocc/repos","events_url":"https://api.github.com/users/livarcocc/events{/privacy}","received_events_url":"https://api.github.com/users/livarcocc/received_events","type":"User","site_admin":false},{"login":"morganbr","id":11641665,"avatar_url":"https://avatars1.githubusercontent.com/u/11641665?v=4","gravatar_id":"","url":"https://api.github.com/users/morganbr","html_url":"https://github.com/morganbr","followers_url":"https://api.github.com/users/morganbr/followers","following_url":"https://api.github.com/users/morganbr/following{/other_user}","gists_url":"https://api.github.com/users/morganbr/gists{/gist_id}","starred_url":"https://api.github.com/users/morganbr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/morganbr/subscriptions","organizations_url":"https://api.github.com/users/morganbr/orgs","repos_url":"https://api.github.com/users/morganbr/repos","events_url":"https://api.github.com/users/morganbr/events{/privacy}","received_events_url":"https://api.github.com/users/morganbr/received_events","type":"User","site_admin":false}],"milestone":null,"commits_url":"https://api.github.com/repos/dotnet/cli/pulls/7076/commits","review_comments_url":"https://api.github.com/repos/dotnet/cli/pulls/7076/comments","review_comment_url":"https://api.github.com/repos/dotnet/cli/pulls/comments{/number}","comments_url":"https://api.github.com/repos/dotnet/cli/issues/7076/comments","statuses_url":"https://api.github.com/repos/dotnet/cli/statuses/affd7196a27c2cbf6126346b7f3207745ab5421a","head":{"label":"ravimeda:sec_build","ref":"sec_build","sha":"affd7196a27c2cbf6126346b7f3207745ab5421a","user":{"login":"ravimeda","id":12752450,"avatar_url":"https://avatars1.githubusercontent.com/u/12752450?v=4","gravatar_id":"","url":"https://api.github.com/users/ravimeda","html_url":"https://github.com/ravimeda","followers_url":"https://api.github.com/users/ravimeda/followers","following_url":"https://api.github.com/users/ravimeda/following{/other_user}","gists_url":"https://api.github.com/users/ravimeda/gists{/gist_id}","starred_url":"https://api.github.com/users/ravimeda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ravimeda/subscriptions","organizations_url":"https://api.github.com/users/ravimeda/orgs","repos_url":"https://api.github.com/users/ravimeda/repos","events_url":"https://api.github.com/users/ravimeda/events{/privacy}","received_events_url":"https://api.github.com/users/ravimeda/received_events","type":"User","site_admin":false},"repo":{"id":83845417,"name":"cli","full_name":"ravimeda/cli","owner":{"login":"ravimeda","id":12752450,"avatar_url":"https://avatars1.githubusercontent.com/u/12752450?v=4","gravatar_id":"","url":"https://api.github.com/users/ravimeda","html_url":"https://github.com/ravimeda","followers_url":"https://api.github.com/users/ravimeda/followers","following_url":"https://api.github.com/users/ravimeda/following{/other_user}","gists_url":"https://api.github.com/users/ravimeda/gists{/gist_id}","starred_url":"https://api.github.com/users/ravimeda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ravimeda/subscriptions","organizations_url":"https://api.github.com/users/ravimeda/orgs","repos_url":"https://api.github.com/users/ravimeda/repos","events_url":"https://api.github.com/users/ravimeda/events{/privacy}","received_events_url":"https://api.github.com/users/ravimeda/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/ravimeda/cli","description":"This repo contains the .NET Core command-line (CLI) tools, used for building .NET Core apps and libraries through your development flow (compiling, NuGet package management, running, testing, ...).","fork":true,"url":"https://api.github.com/repos/ravimeda/cli","forks_url":"https://api.github.com/repos/ravimeda/cli/forks","keys_url":"https://api.github.com/repos/ravimeda/cli/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ravimeda/cli/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ravimeda/cli/teams","hooks_url":"https://api.github.com/repos/ravimeda/cli/hooks","issue_events_url":"https://api.github.com/repos/ravimeda/cli/issues/events{/number}","events_url":"https://api.github.com/repos/ravimeda/cli/events","assignees_url":"https://api.github.com/repos/ravimeda/cli/assignees{/user}","branches_url":"https://api.github.com/repos/ravimeda/cli/branches{/branch}","tags_url":"https://api.github.com/repos/ravimeda/cli/tags","blobs_url":"https://api.github.com/repos/ravimeda/cli/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ravimeda/cli/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ravimeda/cli/git/refs{/sha}","trees_url":"https://api.github.com/repos/ravimeda/cli/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ravimeda/cli/statuses/{sha}","languages_url":"https://api.github.com/repos/ravimeda/cli/languages","stargazers_url":"https://api.github.com/repos/ravimeda/cli/stargazers","contributors_url":"https://api.github.com/repos/ravimeda/cli/contributors","subscribers_url":"https://api.github.com/repos/ravimeda/cli/subscribers","subscription_url":"https://api.github.com/repos/ravimeda/cli/subscription","commits_url":"https://api.github.com/repos/ravimeda/cli/commits{/sha}","git_commits_url":"https://api.github.com/repos/ravimeda/cli/git/commits{/sha}","comments_url":"https://api.github.com/repos/ravimeda/cli/comments{/number}","issue_comment_url":"https://api.github.com/repos/ravimeda/cli/issues/comments{/number}","contents_url":"https://api.github.com/repos/ravimeda/cli/contents/{+path}","compare_url":"https://api.github.com/repos/ravimeda/cli/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ravimeda/cli/merges","archive_url":"https://api.github.com/repos/ravimeda/cli/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ravimeda/cli/downloads","issues_url":"https://api.github.com/repos/ravimeda/cli/issues{/number}","pulls_url":"https://api.github.com/repos/ravimeda/cli/pulls{/number}","milestones_url":"https://api.github.com/repos/ravimeda/cli/milestones{/number}","notifications_url":"https://api.github.com/repos/ravimeda/cli/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ravimeda/cli/labels{/name}","releases_url":"https://api.github.com/repos/ravimeda/cli/releases{/id}","deployments_url":"https://api.github.com/repos/ravimeda/cli/deployments","created_at":"2017-03-03T22:00:56Z","updated_at":"2017-03-03T22:01:01Z","pushed_at":"2017-07-27T15:44:32Z","git_url":"git://github.com/ravimeda/cli.git","ssh_url":"git@github.com:ravimeda/cli.git","clone_url":"https://github.com/ravimeda/cli.git","svn_url":"https://github.com/ravimeda/cli","homepage":"https://docs.microsoft.com/dotnet/","size":31056,"stargazers_count":0,"watchers_count":0,"language":"C#","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"dotnet:master","ref":"master","sha":"fe49b772ce8e9c66afefbc2b62f43c1b3689a234","user":{"login":"dotnet","id":9141961,"avatar_url":"https://avatars0.githubusercontent.com/u/9141961?v=4","gravatar_id":"","url":"https://api.github.com/users/dotnet","html_url":"https://github.com/dotnet","followers_url":"https://api.github.com/users/dotnet/followers","following_url":"https://api.github.com/users/dotnet/following{/other_user}","gists_url":"https://api.github.com/users/dotnet/gists{/gist_id}","starred_url":"https://api.github.com/users/dotnet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dotnet/subscriptions","organizations_url":"https://api.github.com/users/dotnet/orgs","repos_url":"https://api.github.com/users/dotnet/repos","events_url":"https://api.github.com/users/dotnet/events{/privacy}","received_events_url":"https://api.github.com/users/dotnet/received_events","type":"Organization","site_admin":false},"repo":{"id":43568107,"name":"cli","full_name":"dotnet/cli","owner":{"login":"dotnet","id":9141961,"avatar_url":"https://avatars0.githubusercontent.com/u/9141961?v=4","gravatar_id":"","url":"https://api.github.com/users/dotnet","html_url":"https://github.com/dotnet","followers_url":"https://api.github.com/users/dotnet/followers","following_url":"https://api.github.com/users/dotnet/following{/other_user}","gists_url":"https://api.github.com/users/dotnet/gists{/gist_id}","starred_url":"https://api.github.com/users/dotnet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dotnet/subscriptions","organizations_url":"https://api.github.com/users/dotnet/orgs","repos_url":"https://api.github.com/users/dotnet/repos","events_url":"https://api.github.com/users/dotnet/events{/privacy}","received_events_url":"https://api.github.com/users/dotnet/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/dotnet/cli","description":"This repo contains the .NET Core command-line (CLI) tools, used for building .NET Core apps and libraries through your development flow (compiling, NuGet package management, running, testing, ...).","fork":false,"url":"https://api.github.com/repos/dotnet/cli","forks_url":"https://api.github.com/repos/dotnet/cli/forks","keys_url":"https://api.github.com/repos/dotnet/cli/keys{/key_id}","collaborators_url":"https://api.github.com/repos/dotnet/cli/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/dotnet/cli/teams","hooks_url":"https://api.github.com/repos/dotnet/cli/hooks","issue_events_url":"https://api.github.com/repos/dotnet/cli/issues/events{/number}","events_url":"https://api.github.com/repos/dotnet/cli/events","assignees_url":"https://api.github.com/repos/dotnet/cli/assignees{/user}","branches_url":"https://api.github.com/repos/dotnet/cli/branches{/branch}","tags_url":"https://api.github.com/repos/dotnet/cli/tags","blobs_url":"https://api.github.com/repos/dotnet/cli/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/dotnet/cli/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/dotnet/cli/git/refs{/sha}","trees_url":"https://api.github.com/repos/dotnet/cli/git/trees{/sha}","statuses_url":"https://api.github.com/repos/dotnet/cli/statuses/{sha}","languages_url":"https://api.github.com/repos/dotnet/cli/languages","stargazers_url":"https://api.github.com/repos/dotnet/cli/stargazers","contributors_url":"https://api.github.com/repos/dotnet/cli/contributors","subscribers_url":"https://api.github.com/repos/dotnet/cli/subscribers","subscription_url":"https://api.github.com/repos/dotnet/cli/subscription","commits_url":"https://api.github.com/repos/dotnet/cli/commits{/sha}","git_commits_url":"https://api.github.com/repos/dotnet/cli/git/commits{/sha}","comments_url":"https://api.github.com/repos/dotnet/cli/comments{/number}","issue_comment_url":"https://api.github.com/repos/dotnet/cli/issues/comments{/number}","contents_url":"https://api.github.com/repos/dotnet/cli/contents/{+path}","compare_url":"https://api.github.com/repos/dotnet/cli/compare/{base}...{head}","merges_url":"https://api.github.com/repos/dotnet/cli/merges","archive_url":"https://api.github.com/repos/dotnet/cli/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/dotnet/cli/downloads","issues_url":"https://api.github.com/repos/dotnet/cli/issues{/number}","pulls_url":"https://api.github.com/repos/dotnet/cli/pulls{/number}","milestones_url":"https://api.github.com/repos/dotnet/cli/milestones{/number}","notifications_url":"https://api.github.com/repos/dotnet/cli/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/dotnet/cli/labels{/name}","releases_url":"https://api.github.com/repos/dotnet/cli/releases{/id}","deployments_url":"https://api.github.com/repos/dotnet/cli/deployments","created_at":"2015-10-02T18:03:15Z","updated_at":"2017-07-27T13:12:56Z","pushed_at":"2017-07-27T17:42:12Z","git_url":"git://github.com/dotnet/cli.git","ssh_url":"git@github.com:dotnet/cli.git","clone_url":"https://github.com/dotnet/cli.git","svn_url":"https://github.com/dotnet/cli","homepage":"https://github.com/dotnet/core","size":34935,"stargazers_count":2176,"watchers_count":2176,"language":"C#","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":723,"mirror_url":null,"open_issues_count":372,"forks":723,"open_issues":372,"watchers":2176,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/dotnet/cli/pulls/7076"},"html":{"href":"https://github.com/dotnet/cli/pull/7076"},"issue":{"href":"https://api.github.com/repos/dotnet/cli/issues/7076"},"comments":{"href":"https://api.github.com/repos/dotnet/cli/issues/7076/comments"},"review_comments":{"href":"https://api.github.com/repos/dotnet/cli/pulls/7076/comments"},"review_comment":{"href":"https://api.github.com/repos/dotnet/cli/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/dotnet/cli/pulls/7076/commits"},"statuses":{"href":"https://api.github.com/repos/dotnet/cli/statuses/affd7196a27c2cbf6126346b7f3207745ab5421a"}},"merged":false,"mergeable":true,"rebaseable":false,"mergeable_state":"unstable","merged_by":null,"comments":8,"review_comments":4,"maintainer_can_modify":false,"commits":267,"additions":2480,"deletions":1019,"changed_files":211}}
{"actor":{"display_login":"ravimeda"}}