Davis Goodin comments

Results 47 comments of


                                            Davis Goodin

Migrate from Build Artifacts to Pipeline Artifacts

For sure, opened this issue to have a place to track/discuss issues and motivations for Arcade migration.

Create guidance: how to develop and run a C# build task with source in the local repo

The ask is to have some way to run custom *tasks*, and C# *scripts* are a potential implementation of this request that was suggested in the linked issue (https://github.com/dotnet/arcade/issues/96). I...

Go detector overreports dependencies, sometimes causing false vuln claims that are unusually difficult to "upgrade anyway"

I wouldn't say I have a strategy here, so far this is just a bug report with a few tools and args that I suggest avoiding, with other commands to...

Go detector overreports dependencies, sometimes causing false vuln claims that are unusually difficult to "upgrade anyway"

If I'm understanding this right, you're saying that it looks like parsing a valid (buildable) >=1.17 `go.mod` file is enough to gather a complete list of dependencies because of the...

Go detector overreports dependencies, sometimes causing false vuln claims that are unusually difficult to "upgrade anyway"

> I think with latest versions of go you can't even build it if go.mod is outdated, but that is out of scope for the detector. I looked a little...

[Bug] confidential.CertFromPEM fails with Azure Key Vault: "failed to parse private key (use ParsePKCS1PrivateKey instead for this key format)"

Alternative workaround: modify `blocks` when iterating through it: ```go // ... for _, block := range blocks { if block.Type == "PRIVATE KEY" { _, err = x509.ParsePKCS1PrivateKey(block.Bytes) if err...

[Bug] confidential.CertFromPEM fails with Azure Key Vault: "failed to parse private key (use ParsePKCS1PrivateKey instead for this key format)"

I take it from the close that this issue will not be fixed, and using one of the workarounds is your recommendation?