Credentials_swap

.azure-pipelines/nuget.config

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+This Nuget config file is only used in release builds to redirect all
+NuGet package sources to the Central Feed Services (CFS) feed.
+-->
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="CFS" value="https://pkgs.dev.azure.com/mseng/1ES/_packaging/1ES_PublicPackages/nuget/v3/index.json" />
+  </packageSources>
+</configuration>

.azure-pipelines/release.yml

@@ -134,6 +134,15 @@ extends:
                     artifactName: '${{ dim.runtime }}'
               steps:
                 - checkout: self
+                - task: CopyFiles@2
+                  displayName: 'Use Central Feed Services (CFS)'
+                  inputs:
+                    SourceFolder: '$(Build.SourcesDirectory)\.azure-pipelines'
+                    Contents: 'nuget.config'
+                    TargetFolder: '$(Build.SourcesDirectory)'
+                    Overwrite: true
+                - task: NuGetAuthenticate@1
+                  displayName: 'Authenticate to NuGet feeds'
                 - task: PowerShell@2
                   displayName: 'Read version file'
                   inputs:
@@ -295,12 +304,26 @@ extends:
                     artifactName: '${{ dim.runtime }}'
               steps:
                 - checkout: self
+                - task: CopyFiles@2
+                  displayName: 'Use Central Feed Services (CFS)'
+                  inputs:
+                    SourceFolder: '$(Build.SourcesDirectory)/.azure-pipelines'
+                    Contents: 'nuget.config'
+                    TargetFolder: '$(Build.SourcesDirectory)'
+                    Overwrite: true
+                - task: NuGetAuthenticate@1
+                  displayName: 'Authenticate to NuGet feeds'
                 - task: Bash@3
                   displayName: 'Read version file'
                   inputs:
                     targetType: inline
                     script: |
                       echo "##vso[task.setvariable variable=version;isReadOnly=true]$(cat ./VERSION | sed -E 's/.[0-9]+$//')"
+                - task: UseDotNet@2
+                  displayName: 'Use .NET 8 SDK (ESRP dependency)'
+                  inputs:
+                    packageType: sdk
+                    version: '8.x'
                 - task: UseDotNet@2
                   displayName: 'Use .NET 10 SDK'
                   inputs:
@@ -565,12 +588,26 @@ extends:
                     artifactName: '${{ dim.runtime }}'
               steps:
                 - checkout: self
+                - task: CopyFiles@2
+                  displayName: 'Use Central Feed Services (CFS)'
+                  inputs:
+                    SourceFolder: '$(Build.SourcesDirectory)/.azure-pipelines'
+                    Contents: 'nuget.config'
+                    TargetFolder: '$(Build.SourcesDirectory)'
+                    Overwrite: true
+                - task: NuGetAuthenticate@1
+                  displayName: 'Authenticate to NuGet feeds'
                 - task: Bash@3
                   displayName: 'Read version file'
                   inputs:
                     targetType: inline
                     script: |
                       echo "##vso[task.setvariable variable=version;isReadOnly=true]$(cat ./VERSION | sed -E 's/.[0-9]+$//')"
+                - task: UseDotNet@2
+                  displayName: 'Use .NET 8 SDK (ESRP dependency)'
+                  inputs:
+                    packageType: sdk
+                    version: '8.x'
                 - task: UseDotNet@2
                   displayName: 'Use .NET 10 SDK'
                   inputs:
@@ -629,7 +666,7 @@ extends:
                       inlineOperation: |
                         [
                           {
-                            "KeyCode": "CP-453387-Pgp",
+                            "KeyCode": "CP-500207-Pgp",
                             "OperationCode": "LinuxSign",
                             "ToolName": "sign",
                             "ToolVersion": "1.0",
@@ -663,6 +700,15 @@ extends:
                   artifactName: 'dotnet-tool'
             steps:
               - checkout: self
+              - task: CopyFiles@2
+                displayName: 'Use Central Feed Services (CFS)'
+                inputs:
+                  SourceFolder: '$(Build.SourcesDirectory)\.azure-pipelines'
+                  Contents: 'nuget.config'
+                  TargetFolder: '$(Build.SourcesDirectory)'
+                  Overwrite: true
+              - task: NuGetAuthenticate@1
+                displayName: 'Authenticate to NuGet feeds'
               - task: PowerShell@2
                 displayName: 'Read version file'
                 inputs:
@@ -862,9 +908,13 @@ extends:
             dependsOn: release_validation
             condition: and(succeeded(), eq('${{ parameters.nuget }}', true))
             pool:
+              # Run on Windows so the underlying NuGetCommand@2 task can use the
+              # native nuget.exe. On Ubuntu 24.04+ the legacy NuGet task fails
+              # because Mono is no longer available.
+              # See https://aka.ms/nuget-task-mono.
               name: GitClientPME-1ESHostedPool-intel-pc
-              image: ubuntu-x86_64-ado1es
-              os: linux
+              image: win-x86_64-ado1es
+              os: windows
             variables:
               version: $[dependencies.release_validation.outputs['version.value']]
             templateContext:

.github/workflows/codeql-analysis.yml

@@ -22,21 +22,21 @@ jobs:
         language: [ 'csharp' ]
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5.1.0
+      uses: actions/setup-dotnet@v5.4.0
       with:
         dotnet-version: 10.0.x
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@v4.37.6
       with:
         languages: ${{ matrix.language }}
 
     - run: |
        dotnet build
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@v4.37.6

.github/workflows/continuous-integration.yml

@@ -25,10 +25,10 @@ jobs:
             os: windows-11-arm
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5.1.0
+      uses: actions/setup-dotnet@v5.4.0
       with:
         dotnet-version: 10.0.x
 
@@ -82,10 +82,10 @@ jobs:
         runtime: [ linux-x64, linux-arm64, linux-arm ]
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5.1.0
+      uses: actions/setup-dotnet@v5.4.0
       with:
         dotnet-version: 10.0.x
 
@@ -126,10 +126,10 @@ jobs:
         runtime: [ osx-x64, osx-arm64 ]
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5.1.0
+      uses: actions/setup-dotnet@v5.4.0
       with:
         dotnet-version: 10.0.x
 

.github/workflows/lint-docs.yml

@@ -13,14 +13,17 @@ on:
       - '**.md'
       - '.github/workflows/lint-docs.yml'
 
+permissions:
+  contents: read
+
 jobs:
   lint-markdown:
     name: Lint markdown files
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: DavidAnson/markdownlint-cli2-action@ce4853d43830c74c1753b39f3cf40f71c2031eb9
+      - uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff
         with:
           globs: |
             "**/*.md"
@@ -30,12 +33,12 @@ jobs:
     name: Check for broken links
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Run link checker
         # For any troubleshooting, see:
         # https://github.com/lycheeverse/lychee/blob/master/docs/TROUBLESHOOTING.md
-        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8
         with:
           # user-agent: if a user agent is not specified, some websites (e.g.
           # GitHub Docs) return HTTP errors which Lychee will interpret as

.github/workflows/maintainer-absence.yml

@@ -18,7 +18,7 @@ jobs:
     name: create-issue
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@v9
         with:
           script: |
             const startDate = new Date('${{ github.event.inputs.startDate }}');

.github/workflows/validate-install-from-source.yml

@@ -5,6 +5,9 @@ on:
   push:
     branches:
       - main
+  pull_request:
+    branches:
+      - main
 
 jobs:
   docker:
@@ -15,7 +18,7 @@ jobs:
       matrix:
         vector:
         - image: ubuntu
-        - image: debian:bullseye
+        - image: debian:bookworm
         - image: fedora
         # Centos no longer officially maintains images on Docker Hub. However,
         # tgagor is a contributor who pushes updated images weekly, which should
@@ -42,7 +45,7 @@ jobs:
             GNUPGHOME=/root/.gnupg tdnf install tar -y # needed for `actions/checkout`
           fi
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - run: |
           sh "${GITHUB_WORKSPACE}/src/linux/Packaging.Linux/install-from-source.sh" -y

Directory.Packages.props

@@ -14,9 +14,9 @@
     <PackageVersion Include="Avalonia.Win32" Version="11.1.3" />
 
     <!-- Microsoft Identity -->
-    <PackageVersion Include="Microsoft.Identity.Client" Version="4.65.0" />
-    <PackageVersion Include="Microsoft.Identity.Client.Broker" Version="4.65.0" />
-    <PackageVersion Include="Microsoft.Identity.Client.Extensions.Msal" Version="4.65.0" />
+    <PackageVersion Include="Microsoft.Identity.Client" Version="4.84.2" />
+    <PackageVersion Include="Microsoft.Identity.Client.Broker" Version="4.84.2" />
+    <PackageVersion Include="Microsoft.Identity.Client.Extensions.Msal" Version="4.84.2" />
 
     <!-- MSBuild -->
     <PackageVersion Include="Microsoft.Build.Framework" Version="16.0.461" />
@@ -25,6 +25,7 @@
     <!-- Other -->
     <PackageVersion Include="System.CommandLine" Version="2.0.0-beta4.22272.1" />
     <PackageVersion Include="System.Text.Json" Version="8.0.5" />
+    <PackageVersion Include="Tmds.DBus.Protocol" Version="0.21.3" />
     <PackageVersion Include="Tools.InnoSetup" Version="6.3.1" GeneratePathProperty="true" />
 
     <!-- Testing -->

VERSION

@@ -1 +1 @@
-2.7.3.0
+2.9.1.0

docs/credstores.md

@@ -277,7 +277,7 @@ Note that you'll want to ensure that another credential helper is placed before
 GCM in the `credential.helper` Git configuration or else you will be prompted to
 enter your credentials every time you interact with a remote repository.
 
-[access-windows-credential-manager]: https://support.microsoft.com/en-us/windows/accessing-credential-manager-1b5c916a-6a16-889f-8581-fc16e8165ac0
+[access-windows-credential-manager]: https://support.microsoft.com/en-US/Windows/Security/credential-manager-in-windows
 [aws-cloudshell]: https://aws.amazon.com/cloudshell/
 [azure-cloudshell]: https://docs.microsoft.com/azure/cloud-shell/overview
 [cmdkey]: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/cmdkey

docs/generic-oauth.md

@@ -42,6 +42,7 @@ following values in your Git configuration:
 - Client Secret (optional)
 - Redirect URL (optional, defaults to `http://127.0.0.1`)
 - Scopes (optional)
+- Response Mode (optional, defaults to `query`)
 - OAuth Endpoints
   - Authorization Endpoint
   - Token Endpoint
@@ -62,6 +63,7 @@ git config --global credential.<HOST>.oauthAuthorizeEndpoint <AuthEndpoint>
 git config --global credential.<HOST>.oauthTokenEndpoint <TokenEndpoint>
 git config --global credential.<HOST>.oauthScopes <Scopes>
 git config --global credential.<HOST>.oauthDeviceEndpoint <DeviceEndpoint>
+git config --global credential.<HOST>.oauthResponseMode <ResponseMode>
 ```
 
 **Example commands:**
@@ -83,13 +85,35 @@ git config --global credential.<HOST>.oauthDeviceEndpoint <DeviceEndpoint>
     oauthScopes = "code:write profile:read"
     oauthDefaultUserName = "OAUTH"
     oauthUseClientAuthHeader = false
+    oauthResponseMode = "query"
 ```
 
 ### Additional configuration
 
 Depending on the specific implementation of OAuth with your Git host you may
 also need to specify additional behavior.
 
+#### Response mode
+
+The response mode controls how the authorization server returns the response to
+the loopback redirect URI once the user has authenticated. GCM supports the
+following values:
+
+- `query` (default) - parameters are returned in the redirect URI query string.
+- `fragment` - parameters are returned in the redirect URI fragment.
+- `form_post` - parameters are returned as an auto-submitting HTML form that is
+  POSTed to the redirect URI, as described by the
+  [OAuth 2.0 Form Post Response Mode][form-post-spec] specification.
+
+Most hosts use the default `query` mode. Only set this if your host requires a
+specific response mode:
+
+```shell
+git config --global credential.<HOST>.oauthResponseMode <query|fragment|form_post>
+```
+
+[form-post-spec]: https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html
+
 #### Token user name
 
 If your Git host requires that you specify a username to use with OAuth tokens

docs/github-apideprecation.md

@@ -143,6 +143,6 @@ the new token-based authentication requirements **DO NOT** apply to GHES:
 [windows-cli-save-pat-image]: img/windows-cli-save-pat.png
 [vs-2019]: https://docs.microsoft.com/en-us/visualstudio/install/update-visual-studio?view=vs-2019
 [vs-2017]: https://docs.microsoft.com/en-us/visualstudio/install/update-visual-studio?view=vs-2017
-[windows-credential-manager]: https://support.microsoft.com/en-us/windows/accessing-credential-manager-1b5c916a-6a16-889f-8581-fc16e8165ac0
+[windows-credential-manager]: https://support.microsoft.com/en-US/Windows/Security/credential-manager-in-windows
 [windows-gui-add-pat-image]: img/windows-gui-add-pat.png
 [windows-gui-credentials-image]: img/windows-gui-credentials.png

docs/install.md

@@ -210,7 +210,7 @@ the preferred install method for Linux because you can use it to install on any
 distribution][dotnet-supported-distributions]. You
 can also use this method on macOS if you so choose.
 
-**Note:** Make sure you have installed [version 8.0 of the .NET
+**Note:** Make sure you have installed [version 10.0 of the .NET
 SDK][dotnet-install] before attempting to run the following `dotnet tool`
 commands. After installing, you will also need to follow the output instructions
 to add the tools directory to your `PATH`.