[Bug 2110033] Re: Disable strict bootstrapping artifact RID matching

[Launchpad Bug Tracker]

This bug was fixed in the package dotnet8 -
8.0.116-8.0.16-0ubuntu1~25.04.1

---------------
dotnet8 (8.0.116-8.0.16-0ubuntu1~25.04.1) plucky; urgency=medium

  * New upstream release
  * SECURITY UPDATE: spoofing vulnerability
    - CVE-2025-26646: .NET and Visual Studio Spoofing Vulnerability
  * Remove strict bootstrapping artifact RID matching. Strict matching caused
    issues during bootstrapping of .NET for a new Ubuntu series, because it
    was build with the binary artifact of the previous series, which caused
    the RIDs not to match. (LP: #2110033) Affected files:
    - debian/rules
    - debian/eng/source_build_artifact_path.py
    - debian/tests/build-time-tests/tests.py

 -- Dominik Viererbe <dominik.viererbe at canonical.com>  Tue, 06 May 2025
13:59:06 +0300

** Changed in: dotnet8 (Ubuntu)
       Status: In Progress => Fix Released

** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2025-26646

** Changed in: dotnet8 (Ubuntu)
       Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to dotnet8 in Ubuntu.
https://bugs.launchpad.net/bugs/2110033

Title:
  Disable strict bootstrapping artifact RID matching

Status in dotnet8 package in Ubuntu:
  Fix Released
Status in dotnet9 package in Ubuntu:
  Fix Released

Bug description:
  No longer require that the .NET artifacts used for bootstrapping the .NET SDK have the same RID as the build output.
      
  This strict matching caused issues during bootstrapping of .NET for a new Ubuntu series, because it was build with the binary artifact of the previous series, which caused the RIDs not to match.

  Fixes: https://github.com/canonical/dotnet-source-build/issues/12

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/dotnet8/+bug/2110033/+subscriptions