Morphir.SDK 0.5.0-alpha.3

• net10.0

  • Morphir.SDK.FSharp (= 0.5.0-alpha.3)

### Added

- `morphir extension install nuget:<package-id>[@<version>] --home <abs-home> --no-probe` installs an extension from a NuGet feed: nuget.org, a private V3 feed such as Azure Artifacts, or a folder feed. It reads the sources, package source mapping, credentials (`packageSourceCredentials` and credential provider plugins) and signature policy of `nuget.config`, as `dotnet tool install` does, through the Microsoft NuGet client packages. `--source` names one source (a configured name, a V3 `index.json` URL or a folder), `--configfile` names the `nuget.config`, and `--interactive` lets a credential provider prompt; the three options apply only to a `nuget:` source. No version selects the highest stable listed version. The main package carries `morphir/release.json`; a process artifact is the subtree under its `root` of the main package (one package) or of a package whose id extends the main id (one package per platform, such as the RID packages of a self-contained .NET tool), pinned by its tree digest. A framework-dependent .NET tool is refused. Signatures are checked as the dotnet CLI checks them on each operating system. The command writes only to the Home: no NuGet HTTP cache, global packages folder or NuGet temporary folder. New codes: `extension.nuget_not_found`, `extension.nuget_unreachable`, `extension.nuget_unauthorized`, `extension.nuget_signature_invalid`. See [Publish an extension as a NuGet package](docs/content/docs/guides/publish-extension-nuget.md).
- `morphir extension install` installs WASM extensions from every provider: a local declaration, a GitHub release asset, or the entry `morphir/<filename>` of a NuGet main package. The module is checked against its descriptor `sha256` (`extension.digest_mismatch`) and stored in the single-file store; the lock records `runtime` `wasm` and the claims stay unchecked. The guest does not run during installation. `morphir compile` and `morphir generate` with `--extension-id` run an installed WASM extension through the host's WASM runtime, with the loader that configured modules use: they rehash the stored module against the lock first, and check the session against the installed claims. A host without a WASM runtime fails with `extension.runtime_unavailable`.
- On Linux and macOS, NuGet signature checks use the code signing and timestamping trust lists of the .NET SDK, which `Morphir.Extensions.Installation` carries, as the dotnet CLI does. Without them, NuGet on Linux has no trusted root, and a `require` policy refused every nuget.org package.
- `NuGetPackageProvider` in `Morphir.Extensions.Installation`, and `ExtensionSourceRequest.WithNuGetOptions`. `ExtensionSources.ProviderFor(request, http, home)` takes the Home for a NuGet source. The package ships `buildTransitive/Morphir.Extensions.Installation.props`, which sets the `NuGet.UseSystemTextJsonDeserialization` feature switch in each application that references it.
- `morphir extension install github:<owner>/<repo>[@<version-or-tag>] --home <abs-home> --no-probe` installs an extension package from a GitHub release ([#493](https://github.com/finos/morphir-dotnet/issues/493)). The release carries the extensions-family `release.json` as an asset; the command picks the artifact for this platform, streams the asset into a private stage and checks its SHA-256 against the descriptor before the installer reads it. `@<version>` selects the tag `v<version>`, else `<version>`; no `@` selects the latest release. It uses the anonymous GitHub API, or `GITHUB_TOKEN` or `GH_TOKEN` when set, and reports a rate limit as `extension.github_rate_limited`. `--local-developer` does not apply to a named release; `--no-probe` is still required. The installed extension then runs with `--extension-id`, with no network.
- Source providers in `Morphir.Extensions.Installation`: `IExtensionSourceProvider` (`Scheme`, `ResolveAsync`, `FetchAsync`), with `GitHubReleaseProvider` and `LocalRepositoryProvider`. A provider only resolves and fetches; validation, the package tree, and the catalog, lock and journal writes stay in one installer. A new source (a plain HTTPS URL, OCI, a registry index) is one more provider.

### Changed

- The extension installer writes and reads the extension family `0.1.0-preview.3` ([finos/morphir#1176](https://github.com/finos/morphir/pull/1176), merged as `65bbbc96`): the package format `nupkg` (a NuGet package, pinned by its tree digest only), the provenance `nuget-package` and the source `nuget-package-entry`. Catalogs, locks, journals, repositories and release descriptors of `0.1.0-preview.2` are refused and not converted: install again into a new Home, and publish `release.json` with the preview.3 `$schema`. A release descriptor may now offer `process` and `wasm` artifacts; the installer selects the `process` artifact for the platform, else a `wasm` artifact, and the lock records the selection.
- Build: the Native AOT publish of `morphir` fails on any trim or AOT warning from `NuGet.*` or `Newtonsoft.Json`. `morphir` and `dotnet-morphir` set `NuGet.UseSystemTextJsonDeserialization`, with which NuGet.Protocol has no such warning.
- The extension installer writes and reads the extension family `0.1.0-preview.2` ([finos/morphir#1173](https://github.com/finos/morphir/pull/1173)), where an artifact `source` and an `index` provenance are provider-tagged unions (`local-file` or `github-release-asset`, `local-directory` or `github-release`). Catalogs, locks, journals, repositories and release descriptors of `0.1.0-preview.1` are refused and not converted: install again into a new Home, and publish `release.json` with the preview.2 `$schema`. The package tree manifest format is unchanged.
- The install scripts `scripts/install-morphirup.sh` and `scripts/install-morphirup.ps1` install `morphirup` from the [finos/morphir releases](https://github.com/finos/morphir/releases): they download `morphirup` and `morphirup-v<version>.sha256` from `https://github.com/finos/morphir/releases/download/v<version>/`; the scripts stay hosted here. `morphirup` is on finos/morphir from `0.5.0-alpha.2` on; earlier `morphirup` releases stay on the [finos/morphir-dotnet releases](https://github.com/finos/morphir-dotnet/releases). With no version, the scripts take the newest finos/morphir release that has `morphirup` for the machine and skip the others, such as `v0.5.0-alpha.1` (the CLI only) and the releases of the earlier Rust CLI (`v0.4.0-beta.*` and older), in the release list (up to 100 releases from the GitHub API) and in the release feed `https://github.com/finos/morphir/releases.atom`. A given version whose release has no `morphirup` for the machine is refused with "finos/morphir release v<version> has no morphirup-<rid>; morphirup releases before 0.5.0-alpha.2 are on finos/morphir-dotnet": the `sh` script reads the HTTP status of the download instead of letting `curl -f` report a 404 as a network error, and the PowerShell script reads the status of the failed request. The line `downloading <file> <version> from <url>` names the download, and `MORPHIRUP_DOWNLOAD_URL` mirrors `https://github.com/finos/morphir/releases/download`. Two testing hooks, `MORPHIRUP_RELEASES_FILE` and `MORPHIRUP_FEED_FILE`, read the release list and the release feed from local files; the end-to-end scenarios of `InstallScripts.feature` use them with a local release mirror to check, with no network, that the script of the machine skips the releases without `morphirup` in both and refuses a Rust release given by version.
- mise installs `morphirup` with `mise use -g 'github:finos/morphir[matching=morphirup,version_prefix=v,prerelease=true]'`. mise also lists the releases without `morphirup`; with one of those it stops with "No matching asset found" and installs nothing, so name a release that has `morphirup`, such as `@0.5.0-alpha.2`.
- The proto plugin downloads the `morphir` CLI from `https://github.com/finos/morphir/releases/download/v<version>/`. The plugin itself is still released here.
- The manual workflows `install-scripts.yml` and `morphirup-release-journey.yml` use the finos/morphir releases. The pinned version of `install-scripts.yml` is `0.5.0-alpha.2`, each of its runs checks that the download comes from finos/morphir, and a run of the Rust release `0.4.0-beta.12` must be refused by name.