Switch to snupkg and add package validation (#368)

Lumoin · Aug 19, 2024 · c9106e5 · c9106e5
1 parent 492b26f
commit c9106e5
Show file tree

Hide file tree

Showing 11 changed files with 53 additions and 178 deletions.
diff --git a/.config/dotnet-tools.json b/.config/dotnet-tools.json
@@ -57,6 +57,13 @@
         "husky"
       ],
       "rollForward": false
+    },
+    "dotnet-validate": {
+      "version": "0.0.1-preview.304",
+      "commands": [
+        "dotnet-validate"
+      ],
+      "rollForward": false
     }
   }
 }
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -183,16 +183,8 @@ jobs:
 
     - name: Build
       # At the moment Verifiable.Tests cannot be built with -isolate alone due to Coverlet.
-      run: dotnet build --binaryLogger --tl --graphBuild -isolate:MessageUponIsolationViolation --configuration ${{ env.BUILD_CONFIGURATION }} --no-restore -property:ContinuousIntegrationBuild=true /p:Version=${{ env.VERSION }} /p:InformationalVersion=${{ env.PACKAGE_VERSION }} /p:AssemblyVersion=${{ env.TAG_VERSION }} /p:FileVersion=${{ env.TAG_VERSION }}
-      timeout-minutes: 5
-
-    # - name: The sbom-tool does not generate the output directory and fails if it not present.
-    - name: Create SBOM output directory
-      run: mkdir -p "${{ github.workspace }}/${{ matrix.os }}/sbom/"
-
-    # There may a difference in libraries between platforms, so the tool is being run on all platforms.
-    - name: Run BOM analysis
-      run: dotnet tool run sbom-tool generate -DeleteManifestDirIfPresent true -BuildDropPath "${{ github.workspace }}/${{ matrix.os }}/sbom/" -FetchLicenseInformation true -EnablePackageMetadataParsing true -BuildComponentPath . -PackageName "Verifiable" -PackageSupplier "Lumoin" -NamespaceUriBase "https://lumoin.com/verifiable" -PackageVersion ${{ env.PACKAGE_VERSION }} -Verbosity Verbose
+      run: dotnet build --binaryLogger --tl --graphBuild -isolate:MessageUponIsolationViolation --configuration ${{ env.BUILD_CONFIGURATION }} --no-restore --property:ContinuousIntegrationBuild=true --property:Version=${{ env.VERSION }} --property:InformationalVersion=${{ env.PACKAGE_VERSION }} --property:AssemblyVersion=${{ env.TAG_VERSION }} --property:FileVersion=${{ env.TAG_VERSION }}
+      timeout-minutes: 5    
 
     # - name: Set PR markdown title name
     #  run: |
@@ -206,7 +198,7 @@ jobs:
       if: runner.os != 'macOS'
       # See the difference on drivers and paths at https://github.com/microsoft/vstest/issues/2378 and further
       # here on generating the reports.
-      # run: dotnet test --verbosity normal --no-restore --no-build --configuration ${{ env.BUILD_CONFIGURATION }} -property:CollectCoverage=true -property:CoverletOutputFormat=cobertura -property:DeterministicSourcePaths=true -property:IncludeTestAssembly=true -property:CoverletOutput='${{ github.workspace }}/reports/coverage/'
+      # run: dotnet test --verbosity normal --no-restore --no-build --configuration ${{ env.BUILD_CONFIGURATION }} --property:CollectCoverage=true --property:CoverletOutputFormat=cobertura --property:DeterministicSourcePaths=true --property:IncludeTestAssembly=true --property:CoverletOutput='${{ github.workspace }}/reports/coverage/'
       run: dotnet test --collect:"XPlat Code Coverage" --verbosity normal --no-restore --no-build --configuration ${{ env.BUILD_CONFIGURATION }} --logger JUnit -property:DeterministicSourcePaths=true -property:IncludeTestAssembly=true --results-directory '${{ github.workspace }}/reports/coverage/'
       timeout-minutes: 5
 
@@ -295,34 +287,41 @@ jobs:
     #  with:
     #    path: ${{ env.file_name }}
 
-    - name: Pack Nuget files
+    # - name: The sbom-tool does not generate the output directory and fails if it not present.
+    - name: Create SBOM output directory
+      run: mkdir -p "${{ github.workspace }}/${{ matrix.os }}/sbom/"
+
+    # There may a difference in libraries between platforms, so the tool is being run on all platforms.
+    - name: Run BOM analysis
+      run: dotnet tool run sbom-tool generate -DeleteManifestDirIfPresent true -BuildDropPath "${{ github.workspace }}/${{ matrix.os }}/sbom/" -FetchLicenseInformation true -EnablePackageMetadataParsing true -BuildComponentPath . -PackageName "Verifiable" -PackageSupplier "Lumoin" -NamespaceUriBase "https://lumoin.com/verifiable" -PackageVersion ${{ env.PACKAGE_VERSION }} -Verbosity Verbose
+
+    - name: Pack NuGet files
       if: ${{ matrix.os == 'ubuntu-latest' }}
       run: |
-        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --include-symbols --include-source -property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE/$VERIFIABLE.*proj
-        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --include-symbols --include-source -property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE_BOUNCYCASTLE/$VERIFIABLE_BOUNCYCASTLE.*proj
-        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --include-symbols --include-source -property:NoWarn=NU5104 -property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE_CORE/$VERIFIABLE_CORE.csproj
-        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --include-symbols --include-source -property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE_DECENTRALIZEDWEBNODE/$VERIFIABLE_DECENTRALIZEDWEBNODE.*proj
-        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --include-symbols --include-source -property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE_JWT/$VERIFIABLE_JWT.*proj
-        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --include-symbols --include-source -property:NoWarn=NU5104 -property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE_NSEC/$VERIFIABLE_NSEC.*proj
-        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --include-symbols --include-source -property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE_MICROSOFT/$VERIFIABLE_MICROSOFT.*proj
-        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --include-symbols --include-source -property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE_SIDETREE/$VERIFIABLE_SIDETREE.*proj
-        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --include-symbols --include-source -property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE_TPM/$VERIFIABLE_TPM.*proj
-
-    - name: Upload Verifiable Nuget packages
+        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --output nupkgs --property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE/$VERIFIABLE.*proj
+        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --output nupkgs --property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE_BOUNCYCASTLE/$VERIFIABLE_BOUNCYCASTLE.*proj
+        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --output nupkgs --property:NoWarn=NU5104 -property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE_CORE/$VERIFIABLE_CORE.csproj
+        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --output nupkgs --property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE_DECENTRALIZEDWEBNODE/$VERIFIABLE_DECENTRALIZEDWEBNODE.*proj
+        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --output nupkgs --property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE_JWT/$VERIFIABLE_JWT.*proj
+        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --output nupkgs --property:NoWarn=NU5104 -property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE_NSEC/$VERIFIABLE_NSEC.*proj
+        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --output nupkgs --property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE_MICROSOFT/$VERIFIABLE_MICROSOFT.*proj
+        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --output nupkgs --property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE_SIDETREE/$VERIFIABLE_SIDETREE.*proj
+        dotnet pack --verbosity normal --configuration ${{ env.BUILD_CONFIGURATION }} --no-build --output nupkgs --property:PackageVersion=$PACKAGE_VERSION src/$VERIFIABLE_TPM/$VERIFIABLE_TPM.*proj
+
+    # Note that on Windows this would be simply  "dotnet dotnet-validate package local ./snupkgs/*.nupkg", the handling of an array of paths works directly.
+    - name: Validate generated NuGet files
+      if: ${{ matrix.os == 'ubuntu-latest' }}
+      run: |
+        for file in ./nupkgs/*.nupkg; do
+          dotnet dotnet-validate package local "$file"
+        done
+
+    - name: Upload Verifiable NuGet packages
       if: ${{ matrix.os == 'ubuntu-latest' }}
       uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a
       with:
         name: nupkg
-        path: |
-          ./src/${{ env.VERIFIABLE }}/bin/${{ env.BUILD_CONFIGURATION }}/*.nupkg
-          ./src/${{ env.VERIFIABLE_BOUNCYCASTLE }}/bin/${{ env.BUILD_CONFIGURATION }}/*.nupkg
-          ./src/${{ env.VERIFIABLE_CORE }}/bin/${{ env.BUILD_CONFIGURATION }}/*.nupkg
-          ./src/${{ env.VERIFIABLE_DECENTRALIZEDWEBNODE }}/bin/${{ env.BUILD_CONFIGURATION }}/*.nupkg
-          ./src/${{ env.VERIFIABLE_JWT }}/bin/${{ env.BUILD_CONFIGURATION }}/*.nupkg
-          ./src/${{ env.VERIFIABLE_NSEC }}//bin/${{ env.BUILD_CONFIGURATION }}/*.nupkg
-          ./src/${{ env.VERIFIABLE_MICROSOFT }}/bin/${{ env.BUILD_CONFIGURATION }}/*.nupkg
-          ./src/${{ env.VERIFIABLE_SIDETREE }}/bin/${{ env.BUILD_CONFIGURATION }}/*.nupkg
-          ./src/${{ env.VERIFIABLE_TPM }}/bin/${{ env.BUILD_CONFIGURATION }}/*.nupkg
+        path: ./nupkgs/*.*          
 
   # The release idea is inspired by https://dusted.codes/github-actions-for-dotnet-core-nuget-packages.
   prerelease:

diff --git a/Directory.Build.props b/Directory.Build.props
@@ -9,11 +9,13 @@
     <NuGetAudit>true</NuGetAudit>
     <NuGetAuditLevel>low</NuGetAuditLevel>
     <NugetAuditMode>all</NugetAuditMode>
-    <NoWarn>$(NoWarn);1591</NoWarn>
-    <IncludeSymbols>true</IncludeSymbols>
-    <EmbedUntrackedSources>true</EmbedUntrackedSources>        
-    <AllowedOutputExtensionsInPackageBuildOutputFolder>$(AllowedOutputExtensionsInPackageBuildOutputFolder);.pdb</AllowedOutputExtensionsInPackageBuildOutputFolder>
-    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
+    <NoWarn>$(NoWarn);1591</NoWarn>    
+    <EmbedUntrackedSources>true</EmbedUntrackedSources>   
+    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>    
+    <EnablePackageValidation>true</EnablePackageValidation>
+    <!-- This should be the published baseline version to validate against.
+    <PackageValidationBaselineVersion>0.0.1</PackageValidationBaselineVersion>
+    -->
 
     <!--
     TODO: https://docs.microsoft.com/en-us/dotnet/core/deploying/trimming/prepare-libraries-for-trimming
@@ -36,8 +38,10 @@
     <PublishRepositoryUrl>true</PublishRepositoryUrl>
     <RepositoryUrl>https://github.com/lumoin/Verifiable</RepositoryUrl>
     <RepositoryType>git</RepositoryType>
+    <IncludeSymbols>true</IncludeSymbols>    
+    <SymbolPackageFormat>snupkg</SymbolPackageFormat>
 
-    <!-- These are set by the continous integration build. -->    
+    <!-- These are set by the continous integration build (see main.yml). -->    
     <PackageVersion>0.0.0</PackageVersion>
     <AssemblyVersion>0.0.0</AssemblyVersion>
     <FileVersion>0.0.0</FileVersion>    
@@ -52,8 +56,7 @@ See full changelog at https://github.com/lumoin/Verifiable/blob/main/CHANGELOG.m
     <ChangelogFile>../../CHANGELOG.md</ChangelogFile>
   </PropertyGroup>
 
-  <ItemGroup>
-
+  <ItemGroup>    
     <PackageReference Include="SIL.ReleaseTasks" PrivateAssets="all" />    
   </ItemGroup>
 
@@ -98,12 +101,5 @@ See full changelog at https://github.com/lumoin/Verifiable/blob/main/CHANGELOG.m
       <PackagePath>/resources</PackagePath>
     </None>
   </ItemGroup>
-
-  <!-- This is set in main.yml build script. -->
-  <!--
-  <PropertyGroup Condition="'$(GITHUB_ACTIONS)' == 'true'">
-    <ContinuousIntegrationBuild>true</ContinuousIntegrationBuild>
-  </PropertyGroup>
-  -->
-
+
 </Project>
diff --git a/Directory.Packages.props b/Directory.Packages.props
@@ -11,8 +11,7 @@
     <PackageVersion Include="JunitXml.TestLogger" Version="4.0.254" />
     <PackageVersion Include="LiquidTestReports.Markdown" Version="1.4.3-beta" />
     <PackageVersion Include="Microsoft.CodeCoverage" Version="17.10.0" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.10.0" />
-    <PackageVersion Include="Microsoft.SourceLink.GitHub" Version="8.0.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.10.0" />    
     <PackageVersion Include="Microsoft.TSS" Version="2.1.1" />
     <PackageVersion Include="NSec.Cryptography" Version="24.4.0" />
     <PackageVersion Include="Portable.BouncyCastle" Version="1.9.0" />

diff --git a/src/Verifiable.BouncyCastle/packages.lock.json b/src/Verifiable.BouncyCastle/packages.lock.json
@@ -22,16 +22,6 @@
         "resolved": "0.30.2",
         "contentHash": "nQlUtPbp9pQFoArFSp/CZb699W6pqBG/DSpnWHgKbIuQjAu3KNjTZHaIir2vSCPJZuSMGii7tbI6K+nalh4X7w=="
       },
-      "Microsoft.Build.Tasks.Git": {
-        "type": "Transitive",
-        "resolved": "8.0.0",
-        "contentHash": "bZKfSIKJRXLTuSzLudMFte/8CempWjVamNUR5eHJizsy+iuOuO/k2gnh7W0dHJmYY0tBf+gUErfluCv5mySAOQ=="
-      },
-      "Microsoft.SourceLink.Common": {
-        "type": "Transitive",
-        "resolved": "8.0.0",
-        "contentHash": "dk9JPxTCIevS75HyEQ0E4OVAFhB2N+V9ShCXf8Q6FkUQZDkgLI12y679Nym1YqsiSysuQskT7Z+6nUf3yab6Vw=="
-      },
       "System.Memory": {
         "type": "Transitive",
         "resolved": "4.5.5",
@@ -45,7 +35,6 @@
       "verifiable.core": {
         "type": "Project",
         "dependencies": {
-          "Microsoft.SourceLink.GitHub": "[8.0.0, )",
           "SimpleBase": "[4.0.0, )",
           "System.Collections.Immutable": "[8.0.0, )",
           "System.Text.Json": "[8.0.4, )",
@@ -55,16 +44,6 @@
       "verifiable.jwt": {
         "type": "Project"
       },
-      "Microsoft.SourceLink.GitHub": {
-        "type": "CentralTransitive",
-        "requested": "[8.0.0, )",
-        "resolved": "8.0.0",
-        "contentHash": "G5q7OqtwIyGTkeIOAc3u2ZuV/kicQaec5EaRnc0pIeSnh9LUjj+PYQrJYBURvDt7twGl2PKA7nSN0kz1Zw5bnQ==",
-        "dependencies": {
-          "Microsoft.Build.Tasks.Git": "8.0.0",
-          "Microsoft.SourceLink.Common": "8.0.0"
-        }
-      },
       "SimpleBase": {
         "type": "CentralTransitive",
         "requested": "[4.0.0, )",

diff --git a/src/Verifiable.Core/Verifiable.Core.csproj b/src/Verifiable.Core/Verifiable.Core.csproj
@@ -14,8 +14,7 @@
     <!-- <PackageReference Include="Microsoft.CodeAnalysis" Version="3.10.0" /> -->
     <PackageReference Include="System.Collections.Immutable" />
     <PackageReference Include="System.Text.Json" NoWarn="NU5104" />
-    <PackageReference Include="SimpleBase" />
-    <PackageReference Include="Microsoft.SourceLink.GitHub" />
+    <PackageReference Include="SimpleBase" />    
   </ItemGroup>
 
   <ItemGroup>

diff --git a/src/Verifiable.Core/packages.lock.json b/src/Verifiable.Core/packages.lock.json
@@ -2,16 +2,6 @@
   "version": 2,
   "dependencies": {
     "net9.0": {
-      "Microsoft.SourceLink.GitHub": {
-        "type": "Direct",
-        "requested": "[8.0.0, )",
-        "resolved": "8.0.0",
-        "contentHash": "G5q7OqtwIyGTkeIOAc3u2ZuV/kicQaec5EaRnc0pIeSnh9LUjj+PYQrJYBURvDt7twGl2PKA7nSN0kz1Zw5bnQ==",
-        "dependencies": {
-          "Microsoft.Build.Tasks.Git": "8.0.0",
-          "Microsoft.SourceLink.Common": "8.0.0"
-        }
-      },
       "SIL.ReleaseTasks": {
         "type": "Direct",
         "requested": "[2.6.0-beta0030, )",
@@ -50,16 +40,6 @@
         "resolved": "0.30.2",
         "contentHash": "nQlUtPbp9pQFoArFSp/CZb699W6pqBG/DSpnWHgKbIuQjAu3KNjTZHaIir2vSCPJZuSMGii7tbI6K+nalh4X7w=="
       },
-      "Microsoft.Build.Tasks.Git": {
-        "type": "Transitive",
-        "resolved": "8.0.0",
-        "contentHash": "bZKfSIKJRXLTuSzLudMFte/8CempWjVamNUR5eHJizsy+iuOuO/k2gnh7W0dHJmYY0tBf+gUErfluCv5mySAOQ=="
-      },
-      "Microsoft.SourceLink.Common": {
-        "type": "Transitive",
-        "resolved": "8.0.0",
-        "contentHash": "dk9JPxTCIevS75HyEQ0E4OVAFhB2N+V9ShCXf8Q6FkUQZDkgLI12y679Nym1YqsiSysuQskT7Z+6nUf3yab6Vw=="
-      },
       "System.Memory": {
         "type": "Transitive",
         "resolved": "4.5.5",

diff --git a/src/Verifiable.Microsoft/packages.lock.json b/src/Verifiable.Microsoft/packages.lock.json
@@ -22,16 +22,6 @@
         "resolved": "0.30.2",
         "contentHash": "nQlUtPbp9pQFoArFSp/CZb699W6pqBG/DSpnWHgKbIuQjAu3KNjTZHaIir2vSCPJZuSMGii7tbI6K+nalh4X7w=="
       },
-      "Microsoft.Build.Tasks.Git": {
-        "type": "Transitive",
-        "resolved": "8.0.0",
-        "contentHash": "bZKfSIKJRXLTuSzLudMFte/8CempWjVamNUR5eHJizsy+iuOuO/k2gnh7W0dHJmYY0tBf+gUErfluCv5mySAOQ=="
-      },
-      "Microsoft.SourceLink.Common": {
-        "type": "Transitive",
-        "resolved": "8.0.0",
-        "contentHash": "dk9JPxTCIevS75HyEQ0E4OVAFhB2N+V9ShCXf8Q6FkUQZDkgLI12y679Nym1YqsiSysuQskT7Z+6nUf3yab6Vw=="
-      },
       "System.Memory": {
         "type": "Transitive",
         "resolved": "4.5.5",
@@ -45,7 +35,6 @@
       "verifiable.core": {
         "type": "Project",
         "dependencies": {
-          "Microsoft.SourceLink.GitHub": "[8.0.0, )",
           "SimpleBase": "[4.0.0, )",
           "System.Collections.Immutable": "[8.0.0, )",
           "System.Text.Json": "[8.0.4, )",
@@ -55,16 +44,6 @@
       "verifiable.jwt": {
         "type": "Project"
       },
-      "Microsoft.SourceLink.GitHub": {
-        "type": "CentralTransitive",
-        "requested": "[8.0.0, )",
-        "resolved": "8.0.0",
-        "contentHash": "G5q7OqtwIyGTkeIOAc3u2ZuV/kicQaec5EaRnc0pIeSnh9LUjj+PYQrJYBURvDt7twGl2PKA7nSN0kz1Zw5bnQ==",
-        "dependencies": {
-          "Microsoft.Build.Tasks.Git": "8.0.0",
-          "Microsoft.SourceLink.Common": "8.0.0"
-        }
-      },
       "SimpleBase": {
         "type": "CentralTransitive",
         "requested": "[4.0.0, )",

diff --git a/src/Verifiable.NSec/packages.lock.json b/src/Verifiable.NSec/packages.lock.json
@@ -30,16 +30,6 @@
         "resolved": "0.30.2",
         "contentHash": "nQlUtPbp9pQFoArFSp/CZb699W6pqBG/DSpnWHgKbIuQjAu3KNjTZHaIir2vSCPJZuSMGii7tbI6K+nalh4X7w=="
       },
-      "Microsoft.Build.Tasks.Git": {
-        "type": "Transitive",
-        "resolved": "8.0.0",
-        "contentHash": "bZKfSIKJRXLTuSzLudMFte/8CempWjVamNUR5eHJizsy+iuOuO/k2gnh7W0dHJmYY0tBf+gUErfluCv5mySAOQ=="
-      },
-      "Microsoft.SourceLink.Common": {
-        "type": "Transitive",
-        "resolved": "8.0.0",
-        "contentHash": "dk9JPxTCIevS75HyEQ0E4OVAFhB2N+V9ShCXf8Q6FkUQZDkgLI12y679Nym1YqsiSysuQskT7Z+6nUf3yab6Vw=="
-      },
       "System.Memory": {
         "type": "Transitive",
         "resolved": "4.5.5",
@@ -53,7 +43,6 @@
       "verifiable.core": {
         "type": "Project",
         "dependencies": {
-          "Microsoft.SourceLink.GitHub": "[8.0.0, )",
           "SimpleBase": "[4.0.0, )",
           "System.Collections.Immutable": "[8.0.0, )",
           "System.Text.Json": "[8.0.4, )",
@@ -63,16 +52,6 @@
       "verifiable.jwt": {
         "type": "Project"
       },
-      "Microsoft.SourceLink.GitHub": {
-        "type": "CentralTransitive",
-        "requested": "[8.0.0, )",
-        "resolved": "8.0.0",
-        "contentHash": "G5q7OqtwIyGTkeIOAc3u2ZuV/kicQaec5EaRnc0pIeSnh9LUjj+PYQrJYBURvDt7twGl2PKA7nSN0kz1Zw5bnQ==",
-        "dependencies": {
-          "Microsoft.Build.Tasks.Git": "8.0.0",
-          "Microsoft.SourceLink.Common": "8.0.0"
-        }
-      },
       "SimpleBase": {
         "type": "CentralTransitive",
         "requested": "[4.0.0, )",