Arch Linux User Repository

@Sharparam I tested on my machine and it's working, even in a clean environment. Do you have any weird setttings in your dotnet config that could be overriding my ignore lines?

@mhegreberg The PKGBUILD is already supposed to suppress that advisory as far as I can tell though?

If I put the same suppression directly in the project file for Omnisharp.MSBuild it complains about a duplicate suppression, so it seems the suppression is ignored for some reason. If so, this is maybe a bug with the SDK itself rather than this package/project.

@sharparam

Only the newer versions of the sdk turn vulnerability warnings on by default. I think that particular package is tricky to update without the rest, but I'll take a look . Worst case you can instruct dotnet to ignore the advisory until upstream can patch to he compatible. If you look in the PKGBUILD I did this for one advisory

Currently fails during build() in the PublishNet6Builds step:

========================================
PublishNet6Builds
========================================
Publishing OmniSharp.Stdio.Driver.csproj for linux-x64...
/home/sharparam/.cache/aurutils/sync/omnisharp-roslyn/src/omnisharp-roslyn/src/OmniSharp.MSBuild/OmniSharp.MSBuild.csproj : error NU1901: Warning As Error: Package 'Microsoft.Build.Tasks.Core' 17.3.2 has a known low severity vulnerability, https://github.com/advisories/GHSA-h4j7-5rxr-p4wc
Failed to publish OmniSharp.Stdio.Driver for linux-x64
An error occurred when executing task 'PublishNet6Builds'.

Upgrading the affected package to 17.8.29 makes it work. (see https://github.com/advisories/GHSA-h4j7-5rxr-p4wc)

Although curiously, if built in a clean chroot it doesn't complain about the vulnerability, not sure why that is (perhaps it's only raised in a newer SDK? Outside chroot will use the newer SDK on my system compared to inside the chroot I think).

Additionally, it seems to have problems with GitVersion:

ERROR [05/24/25 18:47:42:34] An unexpected error occurred:
System.TypeInitializationException: The type initializer for 'LibGit2Sharp.Core.NativeMethods' threw an exception. ---> System.DllNotFoundException: lib/linux-x64/libgit2-572e4d8.so assembly:<unknown assembly> type:<unknown type> member:(null)
GitVersion failed. Setting default version 1.39.13

It can still continue as the message shows by setting a fallback version, but probably something that should be looked into. If built in chroot, GitVersion still fails but without any detail of the error (just says it failed and uses a default version instead).

since this was disowned I'll take this package. there are a few upstream packages that are out of date and causing vulnerability issues. If patching these works without issue, I may just do that and update.

EDIT: the build failure issue should be fixed for now until Microsoft updates the upstream package. let me know if you encounter any issues

Build fails with vulnerability warnings

/home/user/.cache/pikaur/build/omnisharp-roslyn/src/omnisharp-roslyn/src/OmniSharp.LanguageServerProtocol/OmniSharp.LanguageServerProtocol.csproj : error NU1903: Warning As Error: Package 'Microsoft.Extensions.Caching.Memory' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-qj66-m88j-hmgj [/home/user/.cache/pikaur/build/omnisharp-roslyn/src/omnisharp-roslyn/src/OmniSharp.Stdio.Driver/OmniSharp.Stdio.Driver.csproj]

and

/home/user/.cache/pikaur/build/omnisharp-roslyn/src/omnisharp-roslyn/src/OmniSharp.LanguageServerProtocol/OmniSharp.LanguageServerProtocol.csproj : error NU1903: Warning As Error: Package 'System.Text.Json' 8.0.4 has a known high severity vulnerability, https://github.com/advisories/GHSA-8g4q-xg66-9fp4 [/home/user/.cache/pikaur/build/omnisharp-roslyn/src/omnisharp-roslyn/src/OmniSharp.Stdio.Driver/OmniSharp.Stdio.Driver.csproj]

Fails with

~/.cache/paru/clone/omnisharp-roslyn/src/omnisharp-roslyn-1.39.11/src/OmniSharp.LanguageServerProtocol/OmniSharp.LanguageServerProtocol.csproj : error NU1903: Warning As Error: Package 'System.Text.Json' 8.0.0 has a known high severity vulnerability, https://github.com/advisories/GHSA-hh2w-p6rv-4g7w [~/.cache/paru/clone/omnisharp-roslyn/src/omnisharp-roslyn-1.39.11/src/OmniSharp.Stdio.Driver/OmniSharp.Stdio.Driver.csproj]

EDIT: After upgrading from .NET 6 to 7 today, This doesn't seem to be happening anymore

after a reinstall, I am no longer able to build. I get the following errors repeated throughout the build. I suspect it may have to do with openSSL3?

System.TypeInitializationException: The type initializer for 'LibGit2Sharp.Core.NativeMethods' threw an exception. ---> System.DllNotFoundException: lib/linux-x64/libgit2-572e4d8.so assembly:<unknown assembly> type:<unknown type> member:(null)

/usr/share/dotnet/sdk/6.0.110/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.CrossGen.targets(463,5): error : Cannot get required symbol EVP_MD_size from libssl [/home/user/.cache/yay/omnisharp-roslyn/src/omnisharp-roslyn-1.39.2/src/OmniSharp.Stdio.Driver/OmniSharp.Stdio.Driver.csproj

 /home/user/.nuget/packages/microsoft.sourcelink.common/1.0.0/build/Microsoft.SourceLink.Common.targets(52,5): warning : Source control information is not available - the generated source link is empty. [/home/user/.cache/yay/omnisharp-roslyn/src/omnisharp-roslyn-1.39.2/src/OmniSharp.LanguageServerProtocol/OmniSharp.LanguageServerProtocol.csproj]

System.TypeInitializationException: The type initializer for 'LibGit2Sharp.Core.NativeMethods' threw an exception. ---> System.DllNotFoundException: lib/linux-x64/libgit2-572e4d8.so assembly:<unknown assembly> type:<unknown type> member:(null)System.TypeInitializationException: The type initializer for 'LibGit2Sharp.Core.NativeMethods' threw an exception. ---> System.DllNotFoundException: lib/linux-x64/libgit2-572e4d8.so assembly:<unknown assembly> type:<unknown type> member:(null)/home/user/.nuget/packages/microsoft.sourcelink.common/1.0.0/build

Microsoft.SourceLink.Common.targets(52,5): warning : Source control information is not available - the generated source link is empty. [/home/user/.cache/yay/omnisharp-roslyn/src/omnisharp-roslyn-1.39.2/src/OmniSharp.Abstractions/OmniSharp.Abstractions.csproj]/usr/share/dotnet/sdk/6.0.110/Sdks/Microsoft.NET.Sdk/targets/Microsoft.NET.CrossGen.targets(463,5): error : Cannot get required symbol EVP_MD_size from libssl [/home/user/.cache/yay/omnisharp-roslyn/src/omnisharp-roslyn-1.39.2/src/OmniSharp.Stdio.Driver/OmniSharp.Stdio.Driver.csproj]/home/user/.nuget/packages/microsoft.sourcelink.common/1.0.0/build/Microsoft.SourceLink.Common.targets(52,5): warning : Source control information is not available - the generated source link is empty. [/home/user/.cache/yay/omnisharp-roslyn/src/omnisharp-roslyn-1.39.2/src/OmniSharp.LanguageServerProtocol/OmniSharp.LanguageServerProtocol.csproj]