Security Vulnerabilities in git2-106a5f2.dll: Non-Compliance with Secure Hashing and Compiler Security Best Practices about libgit2sharp

[ethomson]

Hi @ocallesp - looks like you're vetting libgit2sharp through some Microsoft security process? Let me know if I'm wrong but this all sounds very familiar to me from when we did this in Visual Studio.

Is this a new inclusion of libgit2sharp or is there some changing requirement for an existing dependency?

Can you not reuse the exceptions to these requirements that devdiv (VS and Azure DevOps) have already completed?

For example, MD5 is used for NTLM compatibility and there's no possibility of upgrading to SHA-256, so that needs to be accepted and, subsequently, excepted.

Let me know if you want to discuss this further. I've done this before and would be willing to jump on a quick call to get you pointed in the right direction.

[ocallesp]

Not needed anymore. We removed this DLL from our extension.