HTTP Strict Transport Security (HSTS) is a security feature that indicates a client to only connect to a website over HTTPS. Websites can set the Strict-Transport-Security header to inform the client to always use HTTPS. ASP.NET Core can easily set the header, but there is no built-in feature to enable HSTS for an HttpClient. In this post, I describe how to create an HttpClient that supports HSTS,… [read more]

Unlike ConcurrentDictionary, Dictionary does not have a GetOrAdd method. This method is useful when you want to add a key-value pair to the dictionary if the key does not exist, or return the value if the key already exists. The naive implementation of this method looks like this: public static TValue GetOrAdd<TKey, TValue>(this Dictionary<TKey, TValue> dict, TKey key, TValue value) where TKey : notnull {… [read more]

Signing commits in Git is a way to verify the authenticity and integrity of your commits. This ensures that the commits are indeed made by you and have not been tampered with. On Windows, it's easy to set up SSH-Agent for easy signature. Here's how you can do it. First, you need to install SSH on Windows. Open a PowerShell window as an administrator and run the following command to install the OpenSSH… [read more]

If you want to detect when a file is created, modified, or deleted, you can use the FileSystemWatcher class in .NET. However, this is only available when the application is running. What if you want to detect changes that occurred while the application was not running? The USN Journal is a feature of the NTFS and ReFS file systems that keeps track of changes to files and directories. It allows… [read more]

A Software Bill of Materials (SBOM) is a list of components in a piece of software. It is a critical part of the software supply chain, as it helps to identify and track the components used in a software project. In this post, I describe how to easily generate a Software Bill of Materials (SBOM) for NuGet packages. To generate an SBOM for NuGet packages, you can use the Microsoft.Sbom.Targets package.… [read more]

Understanding where a dependency comes from can be tedious. This is especially true when you have a large project with many dependencies. Recently, .NET brings a new tool dotnet nuget why to help you understand why a package is installed in your project. However, there is a better way to do it, and it doesn't requires a recent SDK. dotnet nuget why can explain why a package is included in your project:… [read more]

NuGet packages offer a convenient way to share code, but many developers download them without reviewing the contents or verifying updates when new versions are released. When you install a NuGet package, you are: Downloading code from unknown authors that has likely not been thoroughly reviewed by others Running it with full permissions on your local machine, potentially exposing your personal data… [read more]

While nuspec files are not as common as they used to be, they are still used in some projects when you have special needs. For instance, Meziantou.DotNet.CodingStandard uses a nuspec file to create a package that supports all TFMs. Renovate is a tool to keep your dependencies up-to-date. It supports many package managers, including NuGet. It's more configurable than Dependabot and provides good… [read more]

In a recent post, I shared how to highlight C# code in string values. Roslyn provides more built-in highlighters / code-completions in string values. Most of the supported languages are available as constants of the StringSyntaxAttribute class. To indicate the language, you can use the lang or language comment or the [StringSyntax] attribute. The languages mentioned in this post are handled by Roslyn (VS,… [read more]

On CI, some projects use the msbuild diagnostic verbosity to get more information about the build. This is useful to troubleshoot build issues. However, this verbosity level has some drawbacks. In this post, I describe how to use the binary log feature of MSBuild to get the same information in a more efficient way. Diagnostic verbosity vs binary log The msbuild diagnostic verbosity is the most verbose… [read more]