Update dependencies from https://github.com/dotnet/arcade build 20240625.3 (#48)

[main] Update dependencies from dotnet/arcade
2024-06-26 11:44:29 +00:00 · 2024-06-26 11:44:29 +00:00 · c136707d10
--- a/eng/Version.Details.xml
+++ b/eng/Version.Details.xml
@ -3,9 +3,9 @@
  <ProductDependencies>
  </ProductDependencies>
  <ToolsetDependencies>
-    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="9.0.0-beta.24312.1">
+    <Dependency Name="Microsoft.DotNet.Arcade.Sdk" Version="9.0.0-beta.24325.3">
      <Uri>https://github.com/dotnet/arcade</Uri>
-      <Sha>a7f9929d8dfde18489958185375b50ad49fa7a58</Sha>
+      <Sha>cbe141941b81823eb8a7891fb059efa4d830c3ef</Sha>
      <SourceBuild RepoName="arcade" ManagedOnly="true" />
    </Dependency>
  </ToolsetDependencies>
--- a/eng/common/SetupNugetSources.ps1
+++ b/eng/common/SetupNugetSources.ps1
@ -1,32 +1,31 @@
 # This script adds internal feeds required to build commits that depend on internal package sources. For instance,
 # dotnet6-internal would be added automatically if dotnet6 was found in the nuget.config file. In addition also enables
 # disabled internal Maestro (darc-int*) feeds.
-# 
-# Optionally, this script also adds a credential entry for each of the internal feeds if supplied. This credential
-# is added via the standard environment variable VSS_NUGET_EXTERNAL_FEED_ENDPOINTS. See
-# https://github.com/microsoft/artifacts-credprovider/tree/v1.1.1?tab=readme-ov-file#environment-variables for more details
+#
+# Optionally, this script also adds a credential entry for each of the internal feeds if supplied.
 #
 # See example call for this script below.
 #
 #  - task: PowerShell@2
-#    displayName: Setup Internal Feeds
+#    displayName: Setup Private Feeds Credentials
 #    condition: eq(variables['Agent.OS'], 'Windows_NT')
 #    inputs:
 #      filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.ps1
-#      arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config
-#  - task: NuGetAuthenticate@1
-# 
+#      arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config -Password $Env:Token
+#    env:
+#      Token: $(dn-bot-dnceng-artifact-feeds-rw)
+#
 # Note that the NuGetAuthenticate task should be called after SetupNugetSources.
 # This ensures that:
 # - Appropriate creds are set for the added internal feeds (if not supplied to the scrupt)
-# - The credential provider is installed
+# - The credential provider is installed.
 #
 # This logic is also abstracted into enable-internal-sources.yml.

 [CmdletBinding()]
 param (
    [Parameter(Mandatory = $true)][string]$ConfigFile,
-    [string]$Password
+    $Password
 )

 $ErrorActionPreference = "Stop"
@ -35,23 +34,12 @@ Set-StrictMode -Version 2.0

 . $PSScriptRoot\tools.ps1

-$feedEndpoints = $null
-
-# If a credential is provided, ensure that we don't overwrite the current set of
-# credentials that may have been provided by a previous call to the credential provider.
-if ($Password -and $null -ne $env:VSS_NUGET_EXTERNAL_FEED_ENDPOINTS) {
-    $feedEndpoints = $env:VSS_NUGET_EXTERNAL_FEED_ENDPOINTS | ConvertFrom-Json
-} elseif ($Password) {
-    $feedEndpoints = @{ endpointCredentials = @() }
-}
-
 # Add source entry to PackageSources
-function AddPackageSource($sources, $SourceName, $SourceEndPoint, $pwd) {
+function AddPackageSource($sources, $SourceName, $SourceEndPoint, $creds, $Username, $pwd) {
    $packageSource = $sources.SelectSingleNode("add[@key='$SourceName']")
    
-    if ($null -eq $packageSource)
+    if ($packageSource -eq $null)
    {
-        Write-Host "`tAdding package source" $SourceName
        $packageSource = $doc.CreateElement("add")
        $packageSource.SetAttribute("key", $SourceName)
        $packageSource.SetAttribute("value", $SourceEndPoint)
@ -61,33 +49,63 @@ function AddPackageSource($sources, $SourceName, $SourceEndPoint, $pwd) {
        Write-Host "Package source $SourceName already present."
    }

-    if ($pwd) {
-        $feedEndpoints.endpointCredentials = AddCredential -endpointCredentials $feedEndpoints.endpointCredentials -source $SourceEndPoint -pwd $pwd
+    AddCredential -Creds $creds -Source $SourceName -Username $Username -pwd $pwd
+}
+
+# Add a credential node for the specified source
+function AddCredential($creds, $source, $username, $pwd) {
+    # If no cred supplied, don't do anything.
+    if (!$pwd) {
+        return;
+    }
+
+    # Looks for credential configuration for the given SourceName. Create it if none is found.
+    $sourceElement = $creds.SelectSingleNode($Source)
+    if ($sourceElement -eq $null)
+    {
+        $sourceElement = $doc.CreateElement($Source)
+        $creds.AppendChild($sourceElement) | Out-Null
+    }
+
+    # Add the <Username> node to the credential if none is found.
+    $usernameElement = $sourceElement.SelectSingleNode("add[@key='Username']")
+    if ($usernameElement -eq $null)
+    {
+        $usernameElement = $doc.CreateElement("add")
+        $usernameElement.SetAttribute("key", "Username")
+        $sourceElement.AppendChild($usernameElement) | Out-Null
+    }
+    $usernameElement.SetAttribute("value", $Username)
+
+    # Add the <ClearTextPassword> to the credential if none is found.
+    # Add it as a clear text because there is no support for encrypted ones in non-windows .Net SDKs.
+    #   -> https://github.com/NuGet/Home/issues/5526
+    $passwordElement = $sourceElement.SelectSingleNode("add[@key='ClearTextPassword']")
+    if ($passwordElement -eq $null)
+    {
+        $passwordElement = $doc.CreateElement("add")
+        $passwordElement.SetAttribute("key", "ClearTextPassword")
+        $sourceElement.AppendChild($passwordElement) | Out-Null
+    }
+    
+    $passwordElement.SetAttribute("value", $pwd)
+}
+
+function InsertMaestroPrivateFeedCredentials($Sources, $Creds, $Username, $pwd) {
+    $maestroPrivateSources = $Sources.SelectNodes("add[contains(@key,'darc-int')]")
+
+    Write-Host "Inserting credentials for $($maestroPrivateSources.Count) Maestro's private feeds."
+    
+    ForEach ($PackageSource in $maestroPrivateSources) {
+        Write-Host "`tInserting credential for Maestro's feed:" $PackageSource.Key
+        AddCredential -Creds $creds -Source $PackageSource.Key -Username $Username -pwd $pwd
    }
 }

-# Add a new feed endpoint credential
-function AddCredential([array]$endpointCredentials, $source, $pwd) {
-    $endpointCredentials += @{
-        endpoint = $source;
-        password = $pwd
-    }
-    return $endpointCredentials
-}
-
-function InsertMaestroInternalFeedCredentials($Sources, $pwd) {
-    $maestroInternalSources = $Sources.SelectNodes("add[contains(@key,'darc-int')]")
-
-    ForEach ($PackageSource in $maestroInternalSources) {
-        Write-Host "`tAdding credential for Maestro's feed:" $PackageSource.Key
-        $feedEndpoints.endpointCredentials = AddCredential -endpointCredentials $feedEndpoints.endpointCredentials -source $PackageSource.value -pwd $pwd
-    }
-}
-
-function EnableInternalPackageSources($DisabledPackageSources) {
-    $maestroInternalSources = $DisabledPackageSources.SelectNodes("add[contains(@key,'darc-int')]")
-    ForEach ($DisabledPackageSource in $maestroInternalSources) {
-        Write-Host "`tEnsuring internal source '$($DisabledPackageSource.key)' is enabled by deleting it from disabledPackageSource"
+function EnablePrivatePackageSources($DisabledPackageSources) {
+    $maestroPrivateSources = $DisabledPackageSources.SelectNodes("add[contains(@key,'darc-int')]")
+    ForEach ($DisabledPackageSource in $maestroPrivateSources) {
+        Write-Host "`tEnsuring private source '$($DisabledPackageSource.key)' is enabled by deleting it from disabledPackageSource"
        # Due to https://github.com/NuGet/Home/issues/10291, we must actually remove the disabled entries
        $DisabledPackageSources.RemoveChild($DisabledPackageSource)
    }
@ -105,27 +123,38 @@ $doc.Load($filename)

 # Get reference to <PackageSources> or create one if none exist already
 $sources = $doc.DocumentElement.SelectSingleNode("packageSources")
-if ($null -eq $sources) {
+if ($sources -eq $null) {
    $sources = $doc.CreateElement("packageSources")
    $doc.DocumentElement.AppendChild($sources) | Out-Null
 }

-# Check for disabledPackageSources; we'll enable any darc-int ones we find there
-$disabledSources = $doc.DocumentElement.SelectSingleNode("disabledPackageSources")
-if ($null -ne $disabledSources) {
-    Write-Host "Checking for any darc-int disabled package sources in the disabledPackageSources node"
-    EnableInternalPackageSources -DisabledPackageSources $disabledSources
+$creds = $null
+if ($Password) {
+    # Looks for a <PackageSourceCredentials> node. Create it if none is found.
+    $creds = $doc.DocumentElement.SelectSingleNode("packageSourceCredentials")
+    if ($creds -eq $null) {
+        $creds = $doc.CreateElement("packageSourceCredentials")
+        $doc.DocumentElement.AppendChild($creds) | Out-Null
+    }
 }

-if ($Password) {
-    InsertMaestroInternalFeedCredentials -Sources $sources -pwd $Password
+# Check for disabledPackageSources; we'll enable any darc-int ones we find there
+$disabledSources = $doc.DocumentElement.SelectSingleNode("disabledPackageSources")
+if ($disabledSources -ne $null) {
+    Write-Host "Checking for any darc-int disabled package sources in the disabledPackageSources node"
+    EnablePrivatePackageSources -DisabledPackageSources $disabledSources
 }

+$userName = "dn-bot"
+
+# Insert credential nodes for Maestro's private feeds
+InsertMaestroPrivateFeedCredentials -Sources $sources -Creds $creds -Username $userName -pwd $Password
+
 # 3.1 uses a different feed url format so it's handled differently here
 $dotnet31Source = $sources.SelectSingleNode("add[@key='dotnet3.1']")
-if ($null -ne $dotnet31Source) {
-    AddPackageSource -Sources $sources -SourceName "dotnet3.1-internal" -SourceEndPoint "https://pkgs.dev.azure.com/dnceng/_packaging/dotnet3.1-internal/nuget/v3/index.json" -pwd $Password
-    AddPackageSource -Sources $sources -SourceName "dotnet3.1-internal-transport" -SourceEndPoint "https://pkgs.dev.azure.com/dnceng/_packaging/dotnet3.1-internal-transport/nuget/v3/index.json" -pwd $Password
+if ($dotnet31Source -ne $null) {
+    AddPackageSource -Sources $sources -SourceName "dotnet3.1-internal" -SourceEndPoint "https://pkgs.dev.azure.com/dnceng/_packaging/dotnet3.1-internal/nuget/v2" -Creds $creds -Username $userName -pwd $Password
+    AddPackageSource -Sources $sources -SourceName "dotnet3.1-internal-transport" -SourceEndPoint "https://pkgs.dev.azure.com/dnceng/_packaging/dotnet3.1-internal-transport/nuget/v2" -Creds $creds -Username $userName -pwd $Password
 }

 $dotnetVersions = @('5','6','7','8')
@ -133,18 +162,10 @@ $dotnetVersions = @('5','6','7','8')
 foreach ($dotnetVersion in $dotnetVersions) {
    $feedPrefix = "dotnet" + $dotnetVersion;
    $dotnetSource = $sources.SelectSingleNode("add[@key='$feedPrefix']")
-    if ($dotnetSource) {
-        AddPackageSource -Sources $sources -SourceName "$feedPrefix-internal" -SourceEndPoint "https://pkgs.dev.azure.com/dnceng/internal/_packaging/$feedprefix-internal/nuget/v3/index.json" -pwd $Password
-        AddPackageSource -Sources $sources -SourceName "$feedPrefix-internal-transport" -SourceEndPoint "https://pkgs.dev.azure.com/dnceng/internal/_packaging/$feedPrefix-internal-transport/nuget/v3/index.json" -pwd $Password
+    if ($dotnetSource -ne $null) {
+        AddPackageSource -Sources $sources -SourceName "$feedPrefix-internal" -SourceEndPoint "https://pkgs.dev.azure.com/dnceng/internal/_packaging/$feedPrefix-internal/nuget/v2" -Creds $creds -Username $userName -pwd $Password
+        AddPackageSource -Sources $sources -SourceName "$feedPrefix-internal-transport" -SourceEndPoint "https://pkgs.dev.azure.com/dnceng/internal/_packaging/$feedPrefix-internal-transport/nuget/v2" -Creds $creds -Username $userName -pwd $Password
    }
 }

 $doc.Save($filename)
-
-# If any credentials were added or altered, update the VSS_NUGET_EXTERNAL_FEED_ENDPOINTS environment variable
-if ($null -ne $feedEndpoints) {
-    # ci is set to true so vso logging commands will be used.
-    $ci = $true
-    Write-PipelineSetVariable -Name 'VSS_NUGET_EXTERNAL_FEED_ENDPOINTS' -Value $($feedEndpoints | ConvertTo-Json) -IsMultiJobVariable $false
-    Write-PipelineSetVariable -Name 'NUGET_CREDENTIALPROVIDER_SESSIONTOKENCACHE_ENABLED' -Value "False" -IsMultiJobVariable $false
-}
--- a/eng/common/SetupNugetSources.sh
+++ b/eng/common/SetupNugetSources.sh
@ -1,6 +1,6 @@
 #!/usr/bin/env bash

-# This script adds internal feeds required to build commits that depend on intenral package sources. For instance,
+# This script adds internal feeds required to build commits that depend on internal package sources. For instance,
 # dotnet6-internal would be added automatically if dotnet6 was found in the nuget.config file. In addition also enables
 # disabled internal Maestro (darc-int*) feeds.
 # 
--- a/eng/common/core-templates/job/publish-build-assets.yml
+++ b/eng/common/core-templates/job/publish-build-assets.yml
@ -87,13 +87,15 @@ jobs:
    
    - task: NuGetAuthenticate@1

-    - task: PowerShell@2
+    - task: AzureCLI@2
      displayName: Publish Build Assets
      inputs:
-        filePath: eng\common\sdk-task.ps1
+        azureSubscription: "Darc: Maestro Production"
+        scriptType: ps
+        scriptLocation: scriptPath
+        scriptPath: $(Build.SourcesDirectory)/eng/common/sdk-task.ps1
        arguments: -task PublishBuildAssets -restore -msbuildEngine dotnet
          /p:ManifestsPath='$(Build.StagingDirectory)/Download/AssetManifests'
-          /p:BuildAssetRegistryToken=$(MaestroAccessToken)
          /p:MaestroApiEndpoint=https://maestro.dot.net
          /p:PublishUsingPipelines=${{ parameters.publishUsingPipelines }}
          /p:OfficialBuildId=$(Build.BuildNumber)
@ -160,7 +162,6 @@ jobs:
          arguments: -BuildId $(BARBuildId) 
            -PublishingInfraVersion 3
            -AzdoToken '$(publishing-dnceng-devdiv-code-r-build-re)'
-            -MaestroToken '$(MaestroApiAccessToken)'
            -WaitPublishingFinish true
            -ArtifactsPublishingAdditionalParameters '${{ parameters.artifactsPublishingAdditionalParameters }}'
            -SymbolPublishingAdditionalParameters '${{ parameters.symbolPublishingAdditionalParameters }}'
--- a/eng/common/core-templates/post-build/common-variables.yml
+++ b/eng/common/core-templates/post-build/common-variables.yml
@ -8,8 +8,6 @@ variables:
  # Default Maestro++ API Endpoint and API Version
  - name: MaestroApiEndPoint
    value: "https://maestro.dot.net"
-  - name: MaestroApiAccessToken
-    value: $(MaestroAccessToken)
  - name: MaestroApiVersion
    value: "2020-02-20"

--- a/eng/common/core-templates/post-build/post-build.yml
+++ b/eng/common/core-templates/post-build/post-build.yml
@ -300,14 +300,16 @@ stages:

        - task: NuGetAuthenticate@1

-        - task: PowerShell@2
+        - task: AzureCLI@2
          displayName: Publish Using Darc
          inputs:
-            filePath: $(Build.SourcesDirectory)/eng/common/post-build/publish-using-darc.ps1
+            azureSubscription: "Darc: Maestro Production"
+            scriptType: ps
+            scriptLocation: scriptPath
+            scriptPath: $(Build.SourcesDirectory)/eng/common/post-build/publish-using-darc.ps1
            arguments: -BuildId $(BARBuildId) 
              -PublishingInfraVersion ${{ parameters.publishingInfraVersion }}
              -AzdoToken '$(publishing-dnceng-devdiv-code-r-build-re)'
-              -MaestroToken '$(MaestroApiAccessToken)'
              -WaitPublishingFinish true
              -ArtifactsPublishingAdditionalParameters '${{ parameters.artifactsPublishingAdditionalParameters }}'
              -SymbolPublishingAdditionalParameters '${{ parameters.symbolPublishingAdditionalParameters }}'
--- a/eng/common/core-templates/post-build/setup-maestro-vars.yml
+++ b/eng/common/core-templates/post-build/setup-maestro-vars.yml
@ -15,19 +15,20 @@ steps:
        artifactName: ReleaseConfigs
        checkDownloadedFiles: true

-  - task: PowerShell@2
+  - task: AzureCLI@2
    name: setReleaseVars
    displayName: Set Release Configs Vars
    inputs:
-      targetType: inline
-      pwsh: true
-      script: |
+      azureSubscription: "Darc: Maestro Production"
+      scriptType: pscore
+      scriptLocation: inlineScript
+      inlineScript: |
        try {
          if (!$Env:PromoteToMaestroChannels -or $Env:PromoteToMaestroChannels.Trim() -eq '') {
            $Content = Get-Content $(Build.StagingDirectory)/ReleaseConfigs/ReleaseConfigs.txt

            $BarId = $Content | Select -Index 0
-            $Channels = $Content | Select -Index 1             
+            $Channels = $Content | Select -Index 1
            $IsStableBuild = $Content | Select -Index 2

            $AzureDevOpsProject = $Env:System_TeamProject
@ -35,15 +36,16 @@ steps:
            $AzureDevOpsBuildId = $Env:Build_BuildId
          }
          else {
-            $buildApiEndpoint = "${Env:MaestroApiEndPoint}/api/builds/${Env:BARBuildId}?api-version=${Env:MaestroApiVersion}"
+            . $(Build.SourcesDirectory)\eng\common\tools.ps1
+            $darc = Get-Darc
+            $buildInfo = & $darc get-build `
+              --id ${{ parameters.BARBuildId }} `
+              --extended `
+              --output-format json `
+              --ci `
+              | convertFrom-Json

-            $apiHeaders = New-Object 'System.Collections.Generic.Dictionary[[String],[String]]'
-            $apiHeaders.Add('Accept', 'application/json')
-            $apiHeaders.Add('Authorization',"Bearer ${Env:MAESTRO_API_TOKEN}")
-
-            $buildInfo = try { Invoke-WebRequest -Method Get -Uri $buildApiEndpoint -Headers $apiHeaders | ConvertFrom-Json } catch { Write-Host "Error: $_" }
-            
-            $BarId = $Env:BARBuildId
+            $BarId = ${{ parameters.BARBuildId }}
            $Channels = $Env:PromoteToMaestroChannels -split ","
            $Channels = $Channels -join "]["
            $Channels = "[$Channels]"
@ -69,6 +71,4 @@ steps:
          exit 1
        }
    env:
-      MAESTRO_API_TOKEN: $(MaestroApiAccessToken)
-      BARBuildId: ${{ parameters.BARBuildId }}
      PromoteToMaestroChannels: ${{ parameters.PromoteToChannelIds }}
--- a/eng/common/core-templates/steps/component-governance.yml
+++ b/eng/common/core-templates/steps/component-governance.yml
@ -2,7 +2,8 @@ parameters:
  disableComponentGovernance: false
  componentGovernanceIgnoreDirectories: ''
  is1ESPipeline: false
-  
+  displayName: 'Component Detection'
+
 steps:
 - ${{ if eq(parameters.disableComponentGovernance, 'true') }}:
  - script: echo "##vso[task.setvariable variable=skipComponentGovernanceDetection]true"
@ -10,5 +11,6 @@ steps:
 - ${{ if ne(parameters.disableComponentGovernance, 'true') }}:
  - task: ComponentGovernanceComponentDetection@0
    continueOnError: true
+    displayName: ${{ parameters.displayName }}
    inputs:
      ignoreDirectories: ${{ parameters.componentGovernanceIgnoreDirectories }}
--- a/eng/common/core-templates/steps/enable-internal-sources.yml
+++ b/eng/common/core-templates/steps/enable-internal-sources.yml
@ -6,30 +6,42 @@ parameters:
 - name: is1ESPipeline
  type: boolean
  default: false
+# Legacy parameters to allow for PAT usage
+- name: legacyCredential
+  type: string
+  default: ''

 steps:
 - ${{ if ne(variables['System.TeamProject'], 'public') }}:
+  - ${{ if ne(parameters.legacyCredential, '') }}:
+    - task: PowerShell@2
+      displayName: Setup Internal Feeds
+      inputs:
+        filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.ps1
+        arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config -Password $Env:Token
+      env:
+        Token: ${{ parameters.legacyCredential }}
  # If running on dnceng (internal project), just use the default behavior for NuGetAuthenticate.
  # If running on DevDiv, NuGetAuthenticate is not really an option. It's scoped to a single feed, and we have many feeds that
  # may be added. Instead, we'll use the traditional approach (add cred to nuget.config), but use an account token.
-  - ${{ if eq(variables['System.TeamProject'], 'internal') }}:
-    - task: PowerShell@2
-      displayName: Setup Internal Feeds
-      inputs:
-        filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.ps1
-        arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config
-    - task: NuGetAuthenticate@1
  - ${{ else }}:
-    - template: /eng/common/templates/steps/get-federated-access-token.yml
-      parameters:
-        federatedServiceConnection: ${{ parameters.nugetFederatedServiceConnection }}
-        outputVariableName: 'dnceng-artifacts-feeds-read-access-token'
-    - task: PowerShell@2
-      displayName: Setup Internal Feeds
-      inputs:
-        filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.ps1
-        arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config -Password $(dnceng-artifacts-feeds-read-access-token)
-    # This is required in certain scenarios to install the ADO credential provider.
-    # It installed by default in some msbuild invocations (e.g. VS msbuild), but needs to be installed for others
-    # (e.g. dotnet msbuild).
-    - task: NuGetAuthenticate@1
+    - ${{ if eq(variables['System.TeamProject'], 'internal') }}:
+      - task: PowerShell@2
+        displayName: Setup Internal Feeds
+        inputs:
+          filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.ps1
+          arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config
+    - ${{ else }}:
+      - template: /eng/common/templates/steps/get-federated-access-token.yml
+        parameters:
+          federatedServiceConnection: ${{ parameters.nugetFederatedServiceConnection }}
+          outputVariableName: 'dnceng-artifacts-feeds-read-access-token'
+      - task: PowerShell@2
+        displayName: Setup Internal Feeds
+        inputs:
+          filePath: $(Build.SourcesDirectory)/eng/common/SetupNugetSources.ps1
+          arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config -Password $(dnceng-artifacts-feeds-read-access-token)
+  # This is required in certain scenarios to install the ADO credential provider.
+  # It installed by default in some msbuild invocations (e.g. VS msbuild), but needs to be installed for others
+  # (e.g. dotnet msbuild).
+  - task: NuGetAuthenticate@1
--- a/eng/common/core-templates/steps/source-build.yml
+++ b/eng/common/core-templates/steps/source-build.yml
@ -121,7 +121,9 @@ steps:
 # a nupkg cache of input packages (a local feed).
 # This path must match the upstream cache path in property 'CurrentRepoSourceBuiltNupkgCacheDir'
 # in src\Microsoft.DotNet.Arcade.Sdk\tools\SourceBuild\SourceBuildArcade.targets
- task: ComponentGovernanceComponentDetection@0
-  displayName: Component Detection (Exclude upstream cache)
-  inputs:
-    ignoreDirectories: '$(Build.SourcesDirectory)/artifacts/sb/src/artifacts/obj/source-built-upstream-cache'
+- template: /eng/common/core-templates/steps/component-governance.yml
+  parameters:
+    displayName: Component Detection (Exclude upstream cache)
+    is1ESPipeline: ${{ parameters.is1ESPipeline }}
+    componentGovernanceIgnoreDirectories: '$(Build.SourcesDirectory)/artifacts/sb/src/artifacts/obj/source-built-upstream-cache'
+    disableComponentGovernance: ${{ eq(variables['System.TeamProject'], 'public') }}
--- a/eng/common/cross/arm/sources.list.bionic
+++ b/eng/common/cross/arm/sources.list.bionic
@ -1,11 +0,0 @@
-deb http://ports.ubuntu.com/ubuntu-ports/ bionic main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ bionic main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ bionic-updates main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ bionic-updates main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ bionic-backports main restricted
-deb-src http://ports.ubuntu.com/ubuntu-ports/ bionic-backports main restricted
-
-deb http://ports.ubuntu.com/ubuntu-ports/ bionic-security main restricted universe multiverse
-deb-src http://ports.ubuntu.com/ubuntu-ports/ bionic-security main restricted universe multiverse
--- a/eng/common/cross/arm/sources.list.focal
+++ b/eng/common/cross/arm/sources.list.focal
@ -1,11 +0,0 @@
-deb http://ports.ubuntu.com/ubuntu-ports/ focal main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ focal main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ focal-updates main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ focal-updates main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ focal-backports main restricted
-deb-src http://ports.ubuntu.com/ubuntu-ports/ focal-backports main restricted
-
-deb http://ports.ubuntu.com/ubuntu-ports/ focal-security main restricted universe multiverse
-deb-src http://ports.ubuntu.com/ubuntu-ports/ focal-security main restricted universe multiverse
--- a/eng/common/cross/arm/sources.list.jammy
+++ b/eng/common/cross/arm/sources.list.jammy
@ -1,11 +0,0 @@
-deb http://ports.ubuntu.com/ubuntu-ports/ jammy main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ jammy main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ jammy-updates main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ jammy-updates main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ jammy-backports main restricted
-deb-src http://ports.ubuntu.com/ubuntu-ports/ jammy-backports main restricted
-
-deb http://ports.ubuntu.com/ubuntu-ports/ jammy-security main restricted universe multiverse
-deb-src http://ports.ubuntu.com/ubuntu-ports/ jammy-security main restricted universe multiverse
--- a/eng/common/cross/arm/sources.list.jessie
+++ b/eng/common/cross/arm/sources.list.jessie
@ -1,3 +0,0 @@
-# Debian (sid)   # UNSTABLE
-deb http://ftp.debian.org/debian/ sid main contrib non-free
-deb-src http://ftp.debian.org/debian/ sid main contrib non-free
--- a/eng/common/cross/arm/sources.list.xenial
+++ b/eng/common/cross/arm/sources.list.xenial
@ -1,11 +0,0 @@
-deb http://ports.ubuntu.com/ubuntu-ports/ xenial main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ xenial main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ xenial-updates main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ xenial-updates main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ xenial-backports main restricted
-deb-src http://ports.ubuntu.com/ubuntu-ports/ xenial-backports main restricted
-
-deb http://ports.ubuntu.com/ubuntu-ports/ xenial-security main restricted universe multiverse
-deb-src http://ports.ubuntu.com/ubuntu-ports/ xenial-security main restricted universe multiverse
--- a/eng/common/cross/arm/sources.list.zesty
+++ b/eng/common/cross/arm/sources.list.zesty
@ -1,11 +0,0 @@
-deb http://ports.ubuntu.com/ubuntu-ports/ zesty main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ zesty main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ zesty-updates main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ zesty-updates main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ zesty-backports main restricted
-deb-src http://ports.ubuntu.com/ubuntu-ports/ zesty-backports main restricted
-
-deb http://ports.ubuntu.com/ubuntu-ports/ zesty-security main restricted universe multiverse
-deb-src http://ports.ubuntu.com/ubuntu-ports/ zesty-security main restricted universe multiverse
--- a/eng/common/cross/arm64/sources.list.bionic
+++ b/eng/common/cross/arm64/sources.list.bionic
@ -1,11 +0,0 @@
-deb http://ports.ubuntu.com/ubuntu-ports/ bionic main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ bionic main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ bionic-updates main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ bionic-updates main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ bionic-backports main restricted
-deb-src http://ports.ubuntu.com/ubuntu-ports/ bionic-backports main restricted
-
-deb http://ports.ubuntu.com/ubuntu-ports/ bionic-security main restricted universe multiverse
-deb-src http://ports.ubuntu.com/ubuntu-ports/ bionic-security main restricted universe multiverse
--- a/eng/common/cross/arm64/sources.list.buster
+++ b/eng/common/cross/arm64/sources.list.buster
@ -1,11 +0,0 @@
-deb http://deb.debian.org/debian buster main
-deb-src http://deb.debian.org/debian buster main
-
-deb http://deb.debian.org/debian-security/ buster/updates main
-deb-src http://deb.debian.org/debian-security/ buster/updates main
-
-deb http://deb.debian.org/debian buster-updates main
-deb-src http://deb.debian.org/debian buster-updates main
-
-deb http://deb.debian.org/debian buster-backports main contrib non-free
-deb-src http://deb.debian.org/debian buster-backports main contrib non-free
--- a/eng/common/cross/arm64/sources.list.focal
+++ b/eng/common/cross/arm64/sources.list.focal
@ -1,11 +0,0 @@
-deb http://ports.ubuntu.com/ubuntu-ports/ focal main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ focal main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ focal-updates main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ focal-updates main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ focal-backports main restricted
-deb-src http://ports.ubuntu.com/ubuntu-ports/ focal-backports main restricted
-
-deb http://ports.ubuntu.com/ubuntu-ports/ focal-security main restricted universe multiverse
-deb-src http://ports.ubuntu.com/ubuntu-ports/ focal-security main restricted universe multiverse
--- a/eng/common/cross/arm64/sources.list.jammy
+++ b/eng/common/cross/arm64/sources.list.jammy
@ -1,11 +0,0 @@
-deb http://ports.ubuntu.com/ubuntu-ports/ jammy main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ jammy main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ jammy-updates main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ jammy-updates main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ jammy-backports main restricted
-deb-src http://ports.ubuntu.com/ubuntu-ports/ jammy-backports main restricted
-
-deb http://ports.ubuntu.com/ubuntu-ports/ jammy-security main restricted universe multiverse
-deb-src http://ports.ubuntu.com/ubuntu-ports/ jammy-security main restricted universe multiverse
--- a/eng/common/cross/arm64/sources.list.stretch
+++ b/eng/common/cross/arm64/sources.list.stretch
@ -1,12 +0,0 @@
-deb http://deb.debian.org/debian stretch main
-deb-src http://deb.debian.org/debian stretch main
-
-deb http://deb.debian.org/debian-security/ stretch/updates main
-deb-src http://deb.debian.org/debian-security/ stretch/updates main
-
-deb http://deb.debian.org/debian stretch-updates main
-deb-src http://deb.debian.org/debian stretch-updates main
-
-deb http://deb.debian.org/debian stretch-backports main contrib non-free
-deb-src http://deb.debian.org/debian stretch-backports main contrib non-free
-
--- a/eng/common/cross/arm64/sources.list.xenial
+++ b/eng/common/cross/arm64/sources.list.xenial
@ -1,11 +0,0 @@
-deb http://ports.ubuntu.com/ubuntu-ports/ xenial main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ xenial main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ xenial-updates main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ xenial-updates main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ xenial-backports main restricted
-deb-src http://ports.ubuntu.com/ubuntu-ports/ xenial-backports main restricted
-
-deb http://ports.ubuntu.com/ubuntu-ports/ xenial-security main restricted universe multiverse
-deb-src http://ports.ubuntu.com/ubuntu-ports/ xenial-security main restricted universe multiverse
--- a/eng/common/cross/arm64/sources.list.zesty
+++ b/eng/common/cross/arm64/sources.list.zesty
@ -1,11 +0,0 @@
-deb http://ports.ubuntu.com/ubuntu-ports/ zesty main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ zesty main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ zesty-updates main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ zesty-updates main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ zesty-backports main restricted
-deb-src http://ports.ubuntu.com/ubuntu-ports/ zesty-backports main restricted
-
-deb http://ports.ubuntu.com/ubuntu-ports/ zesty-security main restricted universe multiverse
-deb-src http://ports.ubuntu.com/ubuntu-ports/ zesty-security main restricted universe multiverse
--- a/eng/common/cross/armel/sources.list.jessie
+++ b/eng/common/cross/armel/sources.list.jessie
@ -1,3 +0,0 @@
-# Debian (jessie)   # Stable
-deb http://ftp.debian.org/debian/ jessie main contrib non-free
-deb-src http://ftp.debian.org/debian/ jessie main contrib non-free
--- a/eng/common/cross/armv6/sources.list.bookworm
+++ b/eng/common/cross/armv6/sources.list.bookworm
@ -1,2 +0,0 @@
-deb http://raspbian.raspberrypi.org/raspbian/ bookworm main contrib non-free rpi
-deb-src http://raspbian.raspberrypi.org/raspbian/ bookworm main contrib non-free rpi
--- a/eng/common/cross/armv6/sources.list.buster
+++ b/eng/common/cross/armv6/sources.list.buster
@ -1,2 +0,0 @@
-deb http://raspbian.raspberrypi.org/raspbian/ buster main contrib non-free rpi
-deb-src http://raspbian.raspberrypi.org/raspbian/ buster main contrib non-free rpi
--- a/eng/common/cross/build-rootfs.sh
+++ b/eng/common/cross/build-rootfs.sh
@ -30,7 +30,8 @@ __IllumosArch=arm7
 __HaikuArch=arm
 __QEMUArch=arm
 __UbuntuArch=armhf
-__UbuntuRepo="http://ports.ubuntu.com/"
+__UbuntuRepo=
+__UbuntuSuites="updates security backports"
 __LLDB_Package="liblldb-3.9-dev"
 __SkipUnmount=0

@ -129,6 +130,7 @@ __AlpineKeys='
 616db30d:MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAnpUpyWDWjlUk3smlWeA0\nlIMW+oJ38t92CRLHH3IqRhyECBRW0d0aRGtq7TY8PmxjjvBZrxTNDpJT6KUk4LRm\na6A6IuAI7QnNK8SJqM0DLzlpygd7GJf8ZL9SoHSH+gFsYF67Cpooz/YDqWrlN7Vw\ntO00s0B+eXy+PCXYU7VSfuWFGK8TGEv6HfGMALLjhqMManyvfp8hz3ubN1rK3c8C\nUS/ilRh1qckdbtPvoDPhSbTDmfU1g/EfRSIEXBrIMLg9ka/XB9PvWRrekrppnQzP\nhP9YE3x/wbFc5QqQWiRCYyQl/rgIMOXvIxhkfe8H5n1Et4VAorkpEAXdsfN8KSVv\nLSMazVlLp9GYq5SUpqYX3KnxdWBgN7BJoZ4sltsTpHQ/34SXWfu3UmyUveWj7wp0\nx9hwsPirVI00EEea9AbP7NM2rAyu6ukcm4m6ATd2DZJIViq2es6m60AE6SMCmrQF\nwmk4H/kdQgeAELVfGOm2VyJ3z69fQuywz7xu27S6zTKi05Qlnohxol4wVb6OB7qG\nLPRtK9ObgzRo/OPumyXqlzAi/Yvyd1ZQk8labZps3e16bQp8+pVPiumWioMFJDWV\nGZjCmyMSU8V6MB6njbgLHoyg2LCukCAeSjbPGGGYhnKLm1AKSoJh3IpZuqcKCk5C\n8CM1S15HxV78s9dFntEqIokCAwEAAQ==
 '
 __Keyring=
+__KeyringFile="/usr/share/keyrings/ubuntu-archive-keyring.gpg"
 __SkipSigCheck=0
 __UseMirror=0

@ -162,6 +164,7 @@ while :; do
            __UbuntuArch=armel
            __UbuntuRepo="http://ftp.debian.org/debian/"
            __CodeName=jessie
+            __KeyringFile="/usr/share/keyrings/debian-archive-keyring.gpg"
            ;;
        armv6)
            __BuildArch=armv6
@ -169,10 +172,12 @@ while :; do
            __QEMUArch=arm
            __UbuntuRepo="http://raspbian.raspberrypi.org/raspbian/"
            __CodeName=buster
+            __KeyringFile="/usr/share/keyrings/raspbian-archive-keyring.gpg"
            __LLDB_Package="liblldb-6.0-dev"
+            __UbuntuSuites=

-            if [[ -e "/usr/share/keyrings/raspbian-archive-keyring.gpg" ]]; then
-                __Keyring="--keyring /usr/share/keyrings/raspbian-archive-keyring.gpg"
+            if [[ -e "$__KeyringFile" ]]; then
+                __Keyring="--keyring $__KeyringFile"
            fi
            ;;
        riscv64)
@ -181,13 +186,8 @@ while :; do
            __AlpinePackages="${__AlpinePackages// lldb-dev/}"
            __QEMUArch=riscv64
            __UbuntuArch=riscv64
-            __UbuntuRepo="http://deb.debian.org/debian"
            __UbuntuPackages="${__UbuntuPackages// libunwind8-dev/}"
            unset __LLDB_Package
-
-            if [[ -e "/usr/share/keyrings/debian-archive-keyring.gpg" ]]; then
-                __Keyring="--keyring /usr/share/keyrings/debian-archive-keyring.gpg --include=debian-archive-keyring"
-            fi
            ;;
        ppc64le)
            __BuildArch=ppc64le
@ -288,8 +288,17 @@ while :; do
                __CodeName=jammy
            fi
            ;;
+        noble) # Ubuntu 24.04
+            if [[ "$__CodeName" != "jessie" ]]; then
+                __CodeName=noble
+            fi
+            if [[ -n "$__LLDB_Package" ]]; then
+                __LLDB_Package="liblldb-18-dev"
+            fi
+            ;;
        jessie) # Debian 8
            __CodeName=jessie
+            __KeyringFile="/usr/share/keyrings/debian-archive-keyring.gpg"

            if [[ -z "$__UbuntuRepo" ]]; then
                __UbuntuRepo="http://ftp.debian.org/debian/"
@ -298,6 +307,7 @@ while :; do
        stretch) # Debian 9
            __CodeName=stretch
            __LLDB_Package="liblldb-6.0-dev"
+            __KeyringFile="/usr/share/keyrings/debian-archive-keyring.gpg"

            if [[ -z "$__UbuntuRepo" ]]; then
                __UbuntuRepo="http://ftp.debian.org/debian/"
@ -306,6 +316,7 @@ while :; do
        buster) # Debian 10
            __CodeName=buster
            __LLDB_Package="liblldb-6.0-dev"
+            __KeyringFile="/usr/share/keyrings/debian-archive-keyring.gpg"

            if [[ -z "$__UbuntuRepo" ]]; then
                __UbuntuRepo="http://ftp.debian.org/debian/"
@ -313,6 +324,7 @@ while :; do
            ;;
        bullseye) # Debian 11
            __CodeName=bullseye
+            __KeyringFile="/usr/share/keyrings/debian-archive-keyring.gpg"

            if [[ -z "$__UbuntuRepo" ]]; then
                __UbuntuRepo="http://ftp.debian.org/debian/"
@ -320,6 +332,7 @@ while :; do
            ;;
        bookworm) # Debian 12
            __CodeName=bookworm
+            __KeyringFile="/usr/share/keyrings/debian-archive-keyring.gpg"

            if [[ -z "$__UbuntuRepo" ]]; then
                __UbuntuRepo="http://ftp.debian.org/debian/"
@ -327,6 +340,7 @@ while :; do
            ;;
        sid) # Debian sid
            __CodeName=sid
+            __KeyringFile="/usr/share/keyrings/debian-archive-keyring.gpg"

            if [[ -z "$__UbuntuRepo" ]]; then
                __UbuntuRepo="http://ftp.debian.org/debian/"
@ -436,6 +450,10 @@ fi

 __UbuntuPackages+=" ${__LLDB_Package:-}"

+if [[ -z "$__UbuntuRepo" ]]; then
+    __UbuntuRepo="http://ports.ubuntu.com/"
+fi
+
 if [[ -n "$__LLVM_MajorVersion" ]]; then
    __UbuntuPackages+=" libclang-common-${__LLVM_MajorVersion}${__LLVM_MinorVersion:+.$__LLVM_MinorVersion}-dev"
 fi
@ -732,8 +750,18 @@ elif [[ -n "$__CodeName" ]]; then
    fi

    # shellcheck disable=SC2086
+    echo running debootstrap "--variant=minbase" $__Keyring --arch "$__UbuntuArch" "$__CodeName" "$__RootfsDir" "$__UbuntuRepo"
    debootstrap "--variant=minbase" $__Keyring --arch "$__UbuntuArch" "$__CodeName" "$__RootfsDir" "$__UbuntuRepo"
-    cp "$__CrossDir/$__BuildArch/sources.list.$__CodeName" "$__RootfsDir/etc/apt/sources.list"
+
+    mkdir -p "$__RootfsDir/etc/apt/sources.list.d/"
+    cat > "$__RootfsDir/etc/apt/sources.list.d/$__CodeName.sources" <<EOF
+Types: deb
+URIs: $__UbuntuRepo
+Suites: $__CodeName $(echo $__UbuntuSuites | xargs -n 1 | xargs -I {} echo -n "$__CodeName-{} ")
+Components: main universe
+Signed-By: $__KeyringFile
+EOF
+
    chroot "$__RootfsDir" apt-get update
    chroot "$__RootfsDir" apt-get -f -y install
    # shellcheck disable=SC2086
--- a/eng/common/cross/ppc64le/sources.list.bionic
+++ b/eng/common/cross/ppc64le/sources.list.bionic
@ -1,11 +0,0 @@
-deb http://ports.ubuntu.com/ubuntu-ports/ bionic main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ bionic main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ bionic-updates main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ bionic-updates main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ bionic-backports main restricted
-deb-src http://ports.ubuntu.com/ubuntu-ports/ bionic-backports main restricted
-
-deb http://ports.ubuntu.com/ubuntu-ports/ bionic-security main restricted universe multiverse
-deb-src http://ports.ubuntu.com/ubuntu-ports/ bionic-security main restricted universe multiverse
--- a/eng/common/cross/riscv64/sources.list.sid
+++ b/eng/common/cross/riscv64/sources.list.sid
@ -1 +0,0 @@
-deb http://deb.debian.org/debian sid main
--- a/eng/common/cross/s390x/sources.list.bionic
+++ b/eng/common/cross/s390x/sources.list.bionic
@ -1,11 +0,0 @@
-deb http://ports.ubuntu.com/ubuntu-ports/ bionic main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ bionic main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ bionic-updates main restricted universe
-deb-src http://ports.ubuntu.com/ubuntu-ports/ bionic-updates main restricted universe
-
-deb http://ports.ubuntu.com/ubuntu-ports/ bionic-backports main restricted
-deb-src http://ports.ubuntu.com/ubuntu-ports/ bionic-backports main restricted
-
-deb http://ports.ubuntu.com/ubuntu-ports/ bionic-security main restricted universe multiverse
-deb-src http://ports.ubuntu.com/ubuntu-ports/ bionic-security main restricted universe multiverse
--- a/eng/common/cross/x64/sources.list.bionic
+++ b/eng/common/cross/x64/sources.list.bionic
@ -1,11 +0,0 @@
-deb http://archive.ubuntu.com/ubuntu/ bionic main restricted universe
-deb-src http://archive.ubuntu.com/ubuntu/ bionic main restricted universe
-
-deb http://archive.ubuntu.com/ubuntu/ bionic-updates main restricted universe
-deb-src http://archive.ubuntu.com/ubuntu/ bionic-updates main restricted universe
-
-deb http://archive.ubuntu.com/ubuntu/ bionic-backports main restricted
-deb-src http://archive.ubuntu.com/ubuntu/ bionic-backports main restricted
-
-deb http://archive.ubuntu.com/ubuntu/ bionic-security main restricted universe multiverse
-deb-src http://archive.ubuntu.com/ubuntu/ bionic-security main restricted universe multiverse
--- a/eng/common/cross/x64/sources.list.xenial
+++ b/eng/common/cross/x64/sources.list.xenial
@ -1,11 +0,0 @@
-deb http://archive.ubuntu.com/ubuntu/ xenial main restricted universe
-deb-src http://archive.ubuntu.com/ubuntu/ xenial main restricted universe
-
-deb http://archive.ubuntu.com/ubuntu/ xenial-updates main restricted universe
-deb-src http://archive.ubuntu.com/ubuntu/ xenial-updates main restricted universe
-
-deb http://archive.ubuntu.com/ubuntu/ xenial-backports main restricted
-deb-src http://archive.ubuntu.com/ubuntu/ xenial-backports main restricted
-
-deb http://archive.ubuntu.com/ubuntu/ xenial-security main restricted universe multiverse
-deb-src http://archive.ubuntu.com/ubuntu/ xenial-security main restricted universe multiverse
--- a/eng/common/cross/x86/sources.list.bionic
+++ b/eng/common/cross/x86/sources.list.bionic
@ -1,11 +0,0 @@
-deb http://archive.ubuntu.com/ubuntu/ bionic main restricted universe
-deb-src http://archive.ubuntu.com/ubuntu/ bionic main restricted universe
-
-deb http://archive.ubuntu.com/ubuntu/ bionic-updates main restricted universe
-deb-src http://archive.ubuntu.com/ubuntu/ bionic-updates main restricted universe
-
-deb http://archive.ubuntu.com/ubuntu/ bionic-backports main restricted
-deb-src http://archive.ubuntu.com/ubuntu/ bionic-backports main restricted
-
-deb http://archive.ubuntu.com/ubuntu/ bionic-security main restricted universe multiverse
-deb-src http://archive.ubuntu.com/ubuntu/ bionic-security main restricted universe multiverse
--- a/eng/common/cross/x86/sources.list.focal
+++ b/eng/common/cross/x86/sources.list.focal
@ -1,11 +0,0 @@
-deb http://archive.ubuntu.com/ubuntu/ focal main restricted universe
-deb-src http://archive.ubuntu.com/ubuntu/ focal main restricted universe
-
-deb http://archive.ubuntu.com/ubuntu/ focal-updates main restricted universe
-deb-src http://archive.ubuntu.com/ubuntu/ focal-updates main restricted universe
-
-deb http://archive.ubuntu.com/ubuntu/ focal-backports main restricted
-deb-src http://archive.ubuntu.com/ubuntu/ focal-backports main restricted
-
-deb http://archive.ubuntu.com/ubuntu/ focal-security main restricted universe multiverse
-deb-src http://archive.ubuntu.com/ubuntu/ focal-security main restricted universe multiverse
--- a/eng/common/cross/x86/sources.list.jammy
+++ b/eng/common/cross/x86/sources.list.jammy
@ -1,11 +0,0 @@
-deb http://archive.ubuntu.com/ubuntu/ jammy main restricted universe
-deb-src http://archive.ubuntu.com/ubuntu/ jammy main restricted universe
-
-deb http://archive.ubuntu.com/ubuntu/ jammy-updates main restricted universe
-deb-src http://archive.ubuntu.com/ubuntu/ jammy-updates main restricted universe
-
-deb http://archive.ubuntu.com/ubuntu/ jammy-backports main restricted
-deb-src http://archive.ubuntu.com/ubuntu/ jammy-backports main restricted
-
-deb http://archive.ubuntu.com/ubuntu/ jammy-security main restricted universe multiverse
-deb-src http://archive.ubuntu.com/ubuntu/ jammy-security main restricted universe multiverse
--- a/eng/common/cross/x86/sources.list.xenial
+++ b/eng/common/cross/x86/sources.list.xenial
@ -1,11 +0,0 @@
-deb http://archive.ubuntu.com/ubuntu/ xenial main restricted universe
-deb-src http://archive.ubuntu.com/ubuntu/ xenial main restricted universe
-
-deb http://archive.ubuntu.com/ubuntu/ xenial-updates main restricted universe
-deb-src http://archive.ubuntu.com/ubuntu/ xenial-updates main restricted universe
-
-deb http://archive.ubuntu.com/ubuntu/ xenial-backports main restricted
-deb-src http://archive.ubuntu.com/ubuntu/ xenial-backports main restricted
-
-deb http://archive.ubuntu.com/ubuntu/ xenial-security main restricted universe multiverse
-deb-src http://archive.ubuntu.com/ubuntu/ xenial-security main restricted universe multiverse
--- a/eng/common/dotnet-install.sh
+++ b/eng/common/dotnet-install.sh
@ -71,6 +71,9 @@ case $cpuname in
  i[3-6]86)
    buildarch=x86
    ;;
+  riscv64)
+    buildarch=riscv64
+    ;;
  *)
    echo "Unknown CPU $cpuname detected, treating it as x64"
    buildarch=x64
--- a/eng/common/native/CommonLibrary.psm1
+++ b/eng/common/native/CommonLibrary.psm1
@ -277,7 +277,8 @@ function Get-MachineArchitecture {
  if (($ProcessorArchitecture -Eq "AMD64") -Or
      ($ProcessorArchitecture -Eq "IA64") -Or
      ($ProcessorArchitecture -Eq "ARM64") -Or
-      ($ProcessorArchitecture -Eq "LOONGARCH64")) {
+      ($ProcessorArchitecture -Eq "LOONGARCH64") -Or
+      ($ProcessorArchitecture -Eq "RISCV64")) {
    return "x64"
  }
  return "x86"
--- a/eng/common/post-build/nuget-validation.ps1
+++ b/eng/common/post-build/nuget-validation.ps1
@ -5,6 +5,13 @@ param(
  [Parameter(Mandatory=$true)][string] $PackagesPath # Path to where the packages to be validated are
 )

+# `tools.ps1` checks $ci to perform some actions. Since the post-build
+# scripts don't necessarily execute in the same agent that run the
+# build.ps1/sh script this variable isn't automatically set.
+$ci = $true
+$disableConfigureToolsetImport = $true
+. $PSScriptRoot\..\tools.ps1
+
 try {
  & $PSScriptRoot\nuget-verification.ps1 ${PackagesPath}\*.nupkg
 } 
--- a/eng/common/post-build/publish-using-darc.ps1
+++ b/eng/common/post-build/publish-using-darc.ps1
@ -2,7 +2,6 @@ param(
  [Parameter(Mandatory=$true)][int] $BuildId,
  [Parameter(Mandatory=$true)][int] $PublishingInfraVersion,
  [Parameter(Mandatory=$true)][string] $AzdoToken,
-  [Parameter(Mandatory=$true)][string] $MaestroToken,
  [Parameter(Mandatory=$false)][string] $MaestroApiEndPoint = 'https://maestro.dot.net',
  [Parameter(Mandatory=$true)][string] $WaitPublishingFinish,
  [Parameter(Mandatory=$false)][string] $ArtifactsPublishingAdditionalParameters,
@ -36,14 +35,13 @@ try {
  }

  & $darc add-build-to-channel `
-  --id $buildId `
-  --publishing-infra-version $PublishingInfraVersion `
-  --default-channels `
-  --source-branch main `
-  --azdev-pat $AzdoToken `
-  --bar-uri $MaestroApiEndPoint `
-  --password $MaestroToken `
-  --ci `
+    --id $buildId `
+    --publishing-infra-version $PublishingInfraVersion `
+    --default-channels `
+    --source-branch main `
+    --azdev-pat "$AzdoToken" `
+    --bar-uri "$MaestroApiEndPoint" `
+    --ci `
 	@optionalParams

  if ($LastExitCode -ne 0) {
--- a/global.json
+++ b/global.json
@ -1,11 +1,11 @@
 {
  "sdk": {
-    "version": "9.0.100-preview.4.24267.66",
+    "version": "9.0.100-preview.5.24307.3",
    "allowPrerelease": true,
    "rollForward": "major"
  },
  "tools": {
-    "dotnet": "9.0.100-preview.4.24267.66",
+    "dotnet": "9.0.100-preview.5.24307.3",
    "runtimes": {
      "dotnet": [
        "3.1.15",
@ -14,6 +14,6 @@
    }
  },
  "msbuild-sdks": {
-    "Microsoft.DotNet.Arcade.Sdk": "9.0.0-beta.24312.1"
+    "Microsoft.DotNet.Arcade.Sdk": "9.0.0-beta.24325.3"
  }
 }