Indirect dependency on privacy-violating SponsorLink package?

[egil]

It looks like this project has an indirect dependency on the https://www.nuget.org/packages/Devlooped.SponsorLink/ package via the dependency on the https://www.nuget.org/packages/GitInfo package.

I am not sure if SponsorLink's questionable behavior impacts the users or devs of MAUI though, but probably something that should be investigated regardless.

maui/eng/Git.Build.targets

Line 3 in 7c66539

<PackageReference Include="GitInfo" Version="2.2.0" PrivateAssets="All" />

[sjordanGSS]

Your "questionable behaviour" link doesn't seem to go anywhere

[egil]

Fixed. Here you can find more details: https://seankilleen.com/2023/08/on-moq-and-our-part-in-the-oss-sustainability-social-contract/

[jonpryor]

@egil wrote:

It looks like this project has an indirect dependency on [SponsorLink]…

Does it? MAUI is explicitly using GitInfo 2.2.0, which contains no occurrences of "SponsorLink". SponsorLink wasn't added until devlooped/GitInfo@5be5956 in GitInfo v3.0.0. Versions if GitInfo before 3.0.0 do not use SponsorLink (unless the binary was updated after the fact, and I'm not sure that's possible).

Now, if MAUI were to update to GitInfo >= v3.0.0, then SponsorLink would be used, but this feels highly unlikely to happen at this point in time.

Additionally, MAUI does not use nuget.org to resolve packages:

maui/NuGet.config

Lines 16 to 25 in 1541190

	<add key="dotnet-eng" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" protocolVersion="3" />
	<add key="dotnet-public" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json" protocolVersion="3" />
	<add key="dotnet6" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet6/nuget/v3/index.json" />
	<add key="dotnet7" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet7/nuget/v3/index.json" />
	<add key="skiasharp" value="https://pkgs.dev.azure.com/xamarin/public/_packaging/SkiaSharp/nuget/v3/index.json" />
	<add key="wasdk-internal" value="https://pkgs.dev.azure.com/microsoft/ProjectReunion/_packaging/Project.Reunion.nuget.internal/nuget/v3/index.json" />
	<add key="benchmark-dotnet-prerelease" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/benchmark-dotnet-prerelease/nuget/v3/index.json" />
	<!-- Added manually for dotnet/runtime 6.0.11 -->
	<add key="darc-pub-dotnet-emsdk-c3fc739" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-emsdk-c3fc739c/nuget/v3/index.json" />
	<add key="darc-pub-dotnet-runtime-1e1f688" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/darc-pub-dotnet-runtime-1e1f688d/nuget/v3/index.json" />

The packages sources MAUI uses do not provide GitInfo v3.0.0 or later.

[egil]

You are right. Didn't check the version numbers before posting. I suspect the author of GitInfo may remove the SponsorLink package in a later release due to the backlash.

[jfversluis]

In addition here is our response also on the .NET runtime repo which is also valid for this repository: dotnet/runtime#90222 (comment)