Make PackageBuilder.CalcPsmdcpName deterministic#7410
Draft
omajid wants to merge 1 commit into
Draft
Conversation
dotnet-policy-service
Bot
added
the
Community
30 tasks
|
johnny1494
approved these changes
May 24, 2026
Contributor
Author
|
Alternatively, we can try and fix the nuspec glob-resolving code at to return in a deterministic order. |
nkolev92
reviewed
May 29, 2026
| using (var hashFunc = new Sha512HashFunction()) | ||
| { | ||
| foreach (var file in Files) | ||
| foreach (var file in Files.OrderBy(f => f, new NormalizedPathComparer())) |
Member
There was a problem hiding this comment.
Any chance you can add a test for this?
An idea could be to have a nuspec with 2 different globs pointing to 2 different folders and files in them, run pack once, and then move the files around but keep the names so that the same net package is generated.
omajid
force-pushed
the
deterministic-packagebuilder-psmdcpname
branch
from
d031db4 to
88533da
Compare
omajid
force-pushed
the
deterministic-packagebuilder-psmdcpname
branch
3 times, most recently
from
300e716 to
1f41056
Compare
The order of input files can vary between nuget pack runs, specially if nuspec files use the `**` glob when specifying `<file>` elements. A simple workaround is to sort files before computing the hash of the file contents in nuget package for the psmdcp file name. This keeps the hash stable across nuget pack runs. Fixes: NuGet/Home#14916
omajid
force-pushed
the
deterministic-packagebuilder-psmdcpname
branch
from
1f41056 to
3f2ef17
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug
Fixes: NuGet/Home#14916
Description
The order of input files can vary between nuget pack runs, specially if nuspec files use the
**glob when specifying<file>elements.A simple workaround is to sort files before computing the hash of the file contents in nuget package for the psmdcp file name. This keeps the hash stable across nuget pack runs.
PR Checklist