Status
Accepted (2026-07-12).
Context
After Framework and Platform moved to commercial NuGet delivery, dotnet restore became part of the production supply chain. If package source, credentials, signature, versions, and release artifacts are unverifiable, customer projects risk dependency confusion, credential leak, package overwrite, or non-reproducible builds.
Decision
Ten decisions define the supply chain:
- Package Source Mapping —
BitzOrcas.*packages publish only to an authenticated private feed, pinned by Package Source Mapping. - Short-lived tokens — dev machines use a Credential Provider; CI uses short-lived workload identity or a controlled secret. Long-lived tokens and plaintext credentials never enter repo/template/image/logs.
- Least-privilege tokens — read-only, short-lived, revocable, scoped by Customer/Product/Package Prefix/Version Channel.
- Code signing + timestamp — commercial packages are signed with a code-signing cert plus a trusted timestamp; the release pipeline verifies the signature and records SHA-256, Git commit, and immutable version.
- SBOM/vulnerability/license — a pre-release generates and archives SBOM, dependency-vulnerability results, third-party-license policy results, and provenance. A released PackageId+Version cannot be overwritten.
- No source in the customer feed — the customer feed defaults to no
.cs, Embedded Source, public Source Link, or public symbol package; debug symbols go to an authenticated internal or customer-support symbol server. - No floating versions — the Consumer Solution forbids floating versions; it uses a unified SDK/BOM and lock-restore. Upgrades go through
bitz-upgrade --planshowing compat impact. - Clean-room release verification — starts from an empty NuGet cache and an isolated consumer project; ProjectReference, local absolute feeds, and product-repo paths do not participate.
- Source Generator packaging — packaged as a standard analyzer/buildTransitive asset; verify
PrivateAssets, diagnostics, and generated output; generated artifacts contain no commercial implementation. - Runbook — feed HA, backup, cert rotation, token leak, and malicious-package events each have a runbook; a feed failure must not break an already-deployed instance’s local Runtime License verification.
Consequences
An internal ProjectReference build passing no longer equals a consumable commercial package — an independent consumer contract test becomes the release gate. Not every source project becomes a public package; the package product line is designed by external interface plus independently-useful module, avoiding a shallow package forest. Local absolute NuGet sources and the default IsPackable=false converge during migration.