Support Sourcelink and Deterministic Build

[304NotModified]

This PR enables Source Link and Deterministic Builds.

Why

• Source Link so that users could debug the library from their Visual Studio
• Deterministic Build to be sure that the produced binary on nuget.org is really made from this Github Source

Most of the top NuGet packages has enabled Source Link. Also some are using Deterministic Build.

E.g. Newtonsoft.Json

I've also configured deterministic builds for other open-source projects, e.g. nunit/nunit#3810, App-vNext/Polly#839

More info

• https://learn.microsoft.com/en-us/dotnet/standard/library-guidance/sourcelink
• https://github.com/clairernovotny/DeterministicBuilds

Before

(Checked with https://github.com/NuGetPackageExplorer/NuGetPackageExplorer)

After

Note, no signature because this is from local. You could also see this by downloading the .nugpkg and .snupkg from the artifacts from AppVeyor

Note! the .snukpg should be published to nuget.org, otherwise the source link won't work

[dtchepak]

Thanks very much for this! 🙇

Have left some newbie questions for you before I merge.

[304NotModified]

This one is still on draft as it isn't tested yet.

I have applied many of these changes in the past, but every build pipeline is somewhat different.

[304NotModified]

@dtchepak how is nuget package publish process organized?

• Is it automatically?
• Is it from AppVeyor/Azure Devops/Travis (there is a Travis badge)/Github Actions?

[304NotModified]

@dtchepak this is ready, I also updated the description of this PR.

Please note:

Note! the .snukpg should be published to nuget.org, otherwise the source link won't work

[alexandrnikitin]

@304NotModified Thank you for the PR!
I have one question. How is Deterministic compiler option related to that. Do we want to enable it?

[304NotModified]

Good question, I don't this this is needed:

While deterministic builds are enabled by default in .NET SDK projects, there is an extra property, ContinuousIntegrationBuild, to set on the build server to normalize stored file paths.

https://devblogs.microsoft.com/dotnet/producing-packages-with-source-link/

[304NotModified]

polite bump @dtchepak :)

[dtchepak]

@dtchepak how is nuget package publish process organized?

• Is it automatically?
• Is it from AppVeyor/Azure Devops/Travis (there is a Travis badge)/Github Actions?

It's done manually, normally I use AppVeyor build. (Release procedure).

I'd love to have this automated at some point.

[dtchepak]

Thanks @304NotModified !

[304NotModified]

@dtchepak could we please release this? :)

[dtchepak]

@dtchepak could we please release this? :)

I was going to just have this bundled in next feature release. Is there something this provides that is blocking you?
What semantic version bump would you suggest for this?

[304NotModified]

5.2 or 5.1.1 are both fine to me. I prefer 5.2 as it isnt a bugfix.

[304NotModified]

Hi @dtchepak, as Source Link could help with better bug reports and deterministic build in security, I still hope to see a release of this.

I like to contribute more but the delay of the releases is holding me back.

[dtchepak]

@304NotModified MR for release 5.2 here: #791

I'll release it once I get core team approval 👍
cc: @alexandrnikitin