PublishAot brings in Microsoft.DotNet.ILCompiler and causes AppLocker issue
#95,174 opened on Nov 23, 2023
Repository metrics
- Stars
- (17,886 stars)
- PR merge metrics
- (Avg merge 12d 11h) (661 merged PRs in 30d)
Description
Description
Publishing a project with aot tries to call findvcvarsall.bat in C:\Users\_USER_\.nuget\packages\microsoft.dotnet.ilcompiler\8.0.0\build which in turn is blocked in a corporate environment by AppLocker rules.
Reproduction Steps
- Create new console project with
dotnet new console --aot - Publish the project with
dotnet publish /p:RuntimeIdentifier=win-x64 /p:SelfContained=true
Expected behavior
Project is successfully published.
Actual behavior
The build is cancelled, because at least one batch file is run from a location where, under default corporate AppLocker rules, script and exe execution is not allowed.
Regression?
No response
Known Workarounds
No response
Configuration
.NET SDK: Version: 8.0.100 Commit: 57efcf1350 Workload version: 8.0.100-manifests.8d38d0cc
OS Name: Windows OS Version: 10.0.19045 OS Platform: Windows RID: win-x64 Base Path: C:\Program Files\dotnet\sdk\8.0.100\
Other information
New workflows should be created in a way that developers can take advantage, without having administrative rights on their machines and without bothering it helpdesk and sysadmin people.
In a world where it security is a top priority it is a bad habit to expect developers in corporate environments to have excess rights on their machines just to develop software.