> “ .NET's ecosystem uses binaries as the primary exchange mechanism. This solves various problems, especially shielding the consumer from having to replicate the build environment. It's also what enables the multi-language ecosystem.”
And then
> “ However, one largely unsolved problem is the link between source code and binaries. While a significant portion of packages on nuget.org are open source and often link to the GitHub repo, there is no way to ensure that the source code being pointed too actually matches the binaries submitted to nuget.org.”
If the goal of .Net 6 is to defragment the .Net ecosystem then why would you still have to shield developers from a build environment? The multi-language argument is weak too.
Developers should be able to publish source code to nuget instead of binaries as an alternative. Rust managed to achieve this and that doesn’t even have a common intermediate language to protect itself from hardware differences.
Instead, we have to endure this horrible code signing nonsense which is just security theatre, especially for small published open source libraries.
And then
> “ However, one largely unsolved problem is the link between source code and binaries. While a significant portion of packages on nuget.org are open source and often link to the GitHub repo, there is no way to ensure that the source code being pointed too actually matches the binaries submitted to nuget.org.”
If the goal of .Net 6 is to defragment the .Net ecosystem then why would you still have to shield developers from a build environment? The multi-language argument is weak too.
Developers should be able to publish source code to nuget instead of binaries as an alternative. Rust managed to achieve this and that doesn’t even have a common intermediate language to protect itself from hardware differences.
Instead, we have to endure this horrible code signing nonsense which is just security theatre, especially for small published open source libraries.