Update Tuf and Sigstore to 1.0.1

[Mitch Denny (mitchdenny)]

Description

Updates the Aspire CLI's Sigstore and Tuf dependencies from 1.0.0 to stable 1.0.1.

The stable packages are restored directly from nuget.org using exact package source mappings because the normal upstream feed does not contain them yet. The mapping limits the public source to the Sigstore and Tuf package IDs.

Validation:

• Built a Linux ARM64 local-hive archive containing stable Sigstore and Tuf 1.0.1.
• Ran NewWithAgentInitTests and PlaywrightCliInstallTests against that archive: 3 passed.
• Set NuGetAudit=false for the targeted build because enabling nuget.org surfaces unrelated, pre-existing transitive package advisories as warnings-as-errors.

Security considerations

This draft restores two security-sensitive dependencies directly from nuget.org. Package source mapping restricts the public source to the exact Sigstore and Tuf package IDs. The nuget.org override remains necessary until the normal upstream feed mirrors 1.0.1.

Fixes # (issue)

Checklist

• Is this feature complete?
  • Yes. Ready to ship.
  • No. Follow-up changes expected.
• Are you including unit tests for the changes and scenario tests if relevant?
  • Yes
  • No
• Did you add public API?
  • Yes
    • If yes, did you have an API Review for it?
      • Yes
      • No
    • Did you add <remarks /> and <code /> elements on your triple slash comments?
      • Yes
      • No
  • No
• Does the change make any security assumptions or guarantees?
  • Yes
    • If yes, have you done a threat model and had a security review?
      • Yes
      • No
  • No

[github-actions]

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 19595

Or

• Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 19595"

[Copilot]

Pull request overview

Updates Aspire CLI provenance dependencies to a preview build.

Changes:

• Updates Sigstore and Tuf to 1.0.1-beta.122.1.7bc133a.
• Temporarily adds nuget.org package resolution for those packages.

Show a summary per file

File	Description
NuGet.config	Adds nuget.org source and mappings.
Directory.Packages.props	Updates Sigstore and Tuf versions.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Tests selector (audit mode)

The full test matrix and all jobs still run in audit mode. The tests and jobs below are what selective CI would run under enforcement.

Runs the full test matrix + all jobs (ALL) — a rule matching 'Directory.Packages.props' selects ALL

---

Selection computed for commit 034173d.

[Copilot]

Review details

Suppressed comments (1)

NuGet.config:17

• This permanently adds an unapproved public feed to the repository configuration. Aspire's internal build cannot restore external dependencies directly from nuget.org; these versions must first be mirrored through the dependency migration pipeline and consumed from an approved dnceng feed. Please mirror Sigstore and Tuf, then remove the nuget.org source, its source mapping, and the related disabledPackageSources override.

    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.

[github-actions]

Retrying the failed CI jobs for this pull request from the CI run attempt. The rerun is being tracked in the rerun attempt.