| Vulnerabilities | |||||
|---|---|---|---|---|---|
| Version | Suggest | Low | Medium | High | Critical |
| 10.0.0 | 0 | 0 | 0 | 0 | 0 |
| 9.0.11 | 0 | 0 | 0 | 0 | 0 |
| 9.0.10 | 0 | 0 | 0 | 0 | 0 |
| 9.0.9 | 0 | 0 | 0 | 0 | 0 |
| 9.0.8 | 0 | 0 | 0 | 0 | 0 |
| 9.0.7 | 0 | 0 | 0 | 0 | 0 |
| 9.0.6 | 0 | 0 | 0 | 0 | 0 |
| 9.0.5 | 0 | 0 | 0 | 0 | 0 |
| 9.0.4 | 0 | 0 | 0 | 0 | 0 |
| 9.0.3 | 0 | 0 | 0 | 0 | 0 |
| 9.0.2 | 0 | 0 | 0 | 0 | 0 |
| 9.0.1 | 0 | 0 | 0 | 0 | 0 |
| 9.0.0 | 0 | 0 | 0 | 0 | 0 |
| 8.0.0 | 0 | 0 | 0 | 0 | 0 |
| 7.0.1 | 0 | 0 | 0 | 0 | 0 |
| 7.0.0 | 0 | 0 | 0 | 0 | 0 |
10.0.0 - This version is safe to use because it has no known security vulnerabilities at this time. Find out if your coding project uses this component and get notified of any reported security vulnerabilities with Meterian-X Open Source Security Platform
Maintain your licence declarations and avoid unwanted licences to protect your IP the way you intended.
MIT - MIT LicenseThis repository is a Virtual Monolithic Repository (VMR) which includes all the source code and infrastructure needed to build the .NET SDK.
What this means:
In the VMR, you can find:
src/,Just like the development repositories, the VMR will have a release branch for every feature band (e.g. release/10.0.1xx).
Similarly, VMR's main branch will follow default branches of product repositories (see Synchronization Based on Declared Dependencies).
More in-depth documentation about the VMR can be found in VMR Design And Operation. See also dotnet/source-build for more information about our whole-product source-build.
You can download the .NET SDK either as an installer (MSI, PKG) or as an archive (zip, tar.gz). The .NET SDK contains both the .NET runtimes and CLI tools.
We will achieve these goals while keeping active coding work in the separate repos where it happens today. For example: ASP.NET features will continue to be developed in dotnet/aspnetcore and CLR features will be continue to be developed in dotnet/runtime. Each of these repos have their own distinct communities and processes, and aggregating development into a true mono-repo would work against that. Hence, the "virtual" monolithic repo: the VMR gives us the simplicity of a mono-repo for building and servicing the product, while active development of components of that product stays in its various existing repos. The day to day experience for typical contributors will not change.
For the latest information about Source-Build support for new .NET versions, please check our GitHub Discussions page for announcements.
The contents of the VMR are two-way synchronized with the product repositories via code flow PRs. Individual repositories flow source changes into the VMR upon promotion of their local official builds (forward flow). The VMR changes are checked in, an official build happens, and then source changes + packages flow backward into the constituent repositories (back flow). For more details on code flow and code flow pull requests, please see this information on Code Flow PRs.
Contribution to the .NET product should currently be done mostly in the constituent repositories. The reasons for this are two-fold:
If you would like to make a cross-cutting change in the VMR, please ask the Unified Build team (please tag @dotnet/product-construction in an issue/discussion in your repository). However, some changes should be made directly in the VMR. For a breakdown of where changes should be made, please see below.
src/* - Constituent repositories, except VMR pipeline changes.src/* directories - Directly in VMReng/common changes - There are many copies of eng/common in the VMR:
src/arcade/eng/common/* for arcade and any repository that builds after arcade. Changes may be made to these files, and they will flow back into arcade as well as to any repository that gets its arcade flow from the VMR. However, due to varying scenarios in which eng/common/ can be used, it is generally recommended that the VMR only be used to test eng/common changes, while actual changes should still be made in the dotnet/arcade repository.For any questions, please ask the Unified Build team.
Please note that this repository is a work-in-progress and there are some usability issues connected to this. These can be nuisances such as some checked-in files getting modified by the build itself and similar. For the latest information about Source-Build support, please watch for announcements posted on our GitHub Discussions page.
The dependencies for building can be found here. In case you don't want to / cannot prepare your environment per the requirements, consider using Docker.
For building the VMR with Source-Build, the following additional dependencies are required for your Linux environment:
brotli-devFor building the VMR on Windows, it is recommended to put the repo under a short path, i.e. C:\dotnet. Also, long path support must be enabled. This is necessary as some of the tools used don't support long paths (WiX Toolset v3 and cl.exe).
For some git commands and when synchronizing changes via the darc CLI, long path support should be enabled in the git config as well:
git config --system core.longpaths true # needs elevated prompt
git config --global core.longpaths trueClone the repository
git clone https://github.com/dotnet/dotnet dotnet-dotnet
cd dotnet-dotnetBuild the .NET SDK
Choose one of the following build modes:
Microsoft based build
For Unix:
./build.sh --clean-while-buildingFor Windows:
.\build.cmd -cleanWhileBuildingBuilding from source
# Prep the source to build on your distro.
# This downloads a .NET SDK and a number of .NET packages needed to build .NET from source.
./prep-source-build.sh
# Build the .NET SDK
./build.sh -sb --clean-while-buildingThe resulting SDK is placed at artifacts/assets/Release/dotnet-sdk-9.0.100-[your-RID].tar.gz (for Unix) or artifacts/assets/Release/dotnet-sdk-9.0.100-[your-RID].zip (for Windows).
(Optional) Unpack and install the .NET SDK
For Unix:
mkdir -p $HOME/dotnet
tar zxf artifacts/assets/Release/dotnet-sdk-10.0.100-[your-RID].tar.gz -C $HOME/dotnet
ln -s $HOME/dotnet/dotnet /usr/bin/dotnetFor Windows:
mkdir %userprofile%\dotnet
tar -xf artifacts/assets/Release/dotnet-sdk-10.0.100-[your RID].zip -C %userprofile%\dotnet
set "PATH=%userprofile%\dotnet;%PATH%"To test your built SDK, run the following:
dotnet --info[!NOTE] Run
./build.sh --help(for Unix) or.\build.cmd -help(for Windows) to see more information about supported build options.
You can also build the repository using a Docker image which has the required prerequisites inside.
The example below creates a Docker volume named vmr and clones and builds the VMR there.
docker run --rm -it -v vmr:/vmr -w /vmr mcr.microsoft.com/dotnet-buildtools/prereqs:centos-stream-10-amd64
git clone https://github.com/dotnet/dotnet .
# - Microsoft based build
./build.sh --clean-while-building
# - Building from source
./prep-source-build.sh && ./build.sh -sb --clean-while-building
mkdir -p $HOME/.dotnet
tar -zxf artifacts/assets/Release/dotnet-sdk-9.0.100-centos.9-x64.tar.gz -C $HOME/.dotnet
ln -s $HOME/.dotnet/dotnet /usr/bin/dotnetYou can also utilize GitHub Codespaces where you can find preset containers in this repository.
You can also build from sources (and not from a context of a git repository), such as the ones you can acquire from a dotnet/dotnet release.
In this case, you need to provide additional information which includes the original repository and commit hash the code was built from so that the SDK can provide a better debugging experience (think the Step into.. functionality).
Usually, this means the dotnet/dotnet repository together with the commit the release tag is connected to.
In practice, this means that when calling the main build script, you need to provide additional arguments when building outside of a context of a git repository.
Alternatively, you can also provide a manifest file where this information can be read from. This file (release.json) can be found attached with the dotnet/dotnet release.
Sometimes you want to make a change in a repository and test that change in the VMR locally (or vice versa). You could of course make the change in the VMR directly, but in case it's already available in your repository, you can synchronize it locally into your clone of the VMR, commit, and then open a PR.
To do this, you need to use the darc vmr forwardflow or darc vmr backflow commands which can move your changes from your repository's dev branch into a local VMR one. Please refer to command's documentation (--help) for more details.
This repo should contain issues that are tied to the VMR infrastructure and documentation.
For other issues, please open them in the appropriate product repos. We have links to many of them on our new issue page.
.NET Runtime is a .NET Foundation project.
.NET is licensed under the MIT license.