Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add container labels for the runtime major/minor and SDK versions #544

Closed
baronfel opened this issue Jan 26, 2024 · 5 comments
Closed

Add container labels for the runtime major/minor and SDK versions #544

baronfel opened this issue Jan 26, 2024 · 5 comments
Labels
Area: Library Tasks and stories around the image and layer manipulation library
Milestone

Comments

@baronfel
Copy link
Member

baronfel commented Jan 26, 2024

For provenance/security scanner purposes it would help if .NET images surfaced their runtime major/minor and SDK tooling versions. We propose:

  • net.dot.runtime.majorminor - the TFM version this app is running on
  • net.dot.sdk.version - the SDK major.minor.patch that was used to build this image

We're using net.dot as a prefix because we own/control the https://dot.net URI, and these are not intended to be labels constrained to the Microsoft-shipped .NET SDKs, but also for any SDKs built by our Source-Build partners and their users.

@baronfel baronfel added this to the 8.0.300 milestone Jan 26, 2024
@baronfel baronfel changed the title Ad container labels for the runtime major/minor and SDK versions Add container labels for the runtime major/minor and SDK versions Jan 26, 2024
@baronfel baronfel added the Area: Library Tasks and stories around the image and layer manipulation library label Jan 29, 2024
@richlander
Copy link
Member

Another name is net.dotnet. I'm not saying that's better, but an option. It's shorter and less Microsoft.

@baronfel
Copy link
Member Author

I dig it. I was leaning more in the 'this is Microsoft's opinion' line of thinking with the naming, but I'm not opposed to something more general.

@samsp-msft
Copy link
Member

We should "own" the domain name for whatever we use. http://dotnet.net does not appear to be owned by us, and is a blog last updated in 2007. The point of the naming scheme is to prevent collisions. I think we are safest with com.microsoft.dotnet.

@richlander
Copy link
Member

richlander commented Jan 30, 2024

Sorry. I meant net.dot. That said, I'm fine with either option.

@baronfel
Copy link
Member Author

Closing as we've implemented this for 8.0.300.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Area: Library Tasks and stories around the image and layer manipulation library
Projects
None yet
Development

No branches or pull requests

3 participants