Davis Goodin

Create guidance: how to develop and run a C# build task with source in the local repo

2

From https://github.com/dotnet/arcade/issues/96#issuecomment-375389291: > [@tmat] ... The root problem here seems to be the inability to build and use a task "dynamically". But we do have a similar ability - the...

[Bug] confidential.CertFromPEM fails with Azure Key Vault: "failed to parse private key (use ParsePKCS1PrivateKey instead for this key format)"

2

**Which version of MSAL Go are you using?** github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 (latest) **Where is the issue?** Confidential client - client certificate https://github.com/AzureAD/microsoft-authentication-library-for-go/blob/882b562b72d131d87e866691c54cbc08111ba804/apps/confidential/confidential.go#L98-L116 This code assumes that all `PRIVATE KEY` blocks can...

###### Merge Checklist **All** boxes should be checked before merging the PR *(just tick any boxes which don't apply to this PR)* - [x] The toolchain has been rebuilt successfully...

###### Merge Checklist **All** boxes should be checked before merging the PR *(just tick any boxes which don't apply to this PR)* - [x] The toolchain has been rebuilt successfully...

###### Merge Checklist **All** boxes should be checked before merging the PR *(just tick any boxes which don't apply to this PR)* - [x] The toolchain has been rebuilt successfully...

Update from Go 1.20 to 1.22 causes CodeQL to no longer detect that we built Go code

6

We use CodeQL through GitHub Actions and had an issue with CodeQL no longer finding Go code when we updated Go from 1.20 to 1.22. Our build actually builds the...

Add option to publish image-info using GitHub App installation auth rather than account PAT

4

Policies around bot accounts and PATs [are changing](https://docs.opensource.microsoft.com/security/tsg/pat), and for the Microsoft build of Go, [we're migrating](https://github.com/microsoft/go-lab/issues/152) to GitHub Apps. For our Go infra tasks, [what this looks like](https://github.com/microsoft/go-infra/pull/217) is...

Reopening this issue because I want to understand better why it was closed: * https://github.com/AzureAD/microsoft-authentication-library-for-go/issues/488 It was closed as won't-fix with a recommendation to use a workaround. It doesn't seem...

Migrate from Build Artifacts to Pipeline Artifacts

4

- Is this issue blocking (yes/no): no - Is this issue causing unreasonable pain (yes/no): no This has been making a lot of noise, filing this issue to track for...

Go detector overreports dependencies, sometimes causing false vuln claims that are unusually difficult to "upgrade anyway"

8

I'm helping work on a project that needs to build https://github.com/konveyor/kantra/tree/215adcbbdfc337b5dee439404dc280d78e3e62f6 in Microsoft systems. This means component-detection is used to detect its dependencies, and the dependencies are associated with known...