NET6 CVE-2019-0980 CVE-2019-0981 - possible bug in .deps.json trans deps resolution #4282

jkone27 · 2022-08-15T12:33:37Z

jkone27
Aug 15, 2022

Hi,

we are running NET6 images , but we get this 2019 vulnerability reported when running our trivy scans.

is this actually expected or could it be a false positive?

atm we added

CVE-2019-0980
CVE-2019-0981

but we cannot detect the source of the vulnerability after we updated all our packages

System.Private.Uri │ CVE-2019-0980 │ HIGH     │ 4.3.0             │ 4.3.2

i am not sure we actually use this package, i see it not appearing at all after running

dotnet build
and then
dotnet publish
and checking the .deps.json file

i think the recently introduced support for .deps.json might be buggy?

jkone27 · 2022-08-15T13:06:29Z

jkone27
Aug 15, 2022
Author

dotnet list package --include-transitive 

   > System.Numerics.Vectors                                                            4.5.0   
   > System.ObjectModel                                                                 4.3.0   
   > System.Private.DataContractSerialization                                           4.3.0   
   > System.Private.Uri                                                                 4.3.2   
   > System.Reflection                                                                  4.3.0   
   > System.Reflection.Emit                                                             4.3.0   
   > System.Reflection.Emit.ILGeneration                                                4.3.0

so seems we already run the latest System.Private.Uri: 4.3.2, so it's kind of weird.

coudl you provide a trivy switch by selecting e.g. only NET6 ? maybe some scans are running for other deployments target that we dont run in production?

0 replies

JoostvdB94 · 2022-08-30T07:53:10Z

JoostvdB94
Aug 30, 2022

We have the same issue. Is there a way to exclude all packages that use the installed runtime (and thus are not really packages)?

0 replies

jkone27 · 2022-09-13T13:53:40Z

jkone27
Sep 13, 2022
Author

pls if you also experience a similar issue add a 👍 on top!

0 replies

plaisted · 2022-10-01T16:35:32Z

plaisted
Oct 1, 2022

I agree, the method of scanning deps.json for vulnerabilities is not valid, or at least needs some tweaking. We're using the latest versions of System.Private.Uri included with .net 6 but aqua is flagging these containers as vulnerable:

/app $ cat <redacted>.deps.json | grep Uri
          "System.Private.Uri": "4.3.0"
      "runtime.unix.System.Private.Uri/4.3.0": {
          "System.Private.Uri": "4.3.0",
      "System.Private.Uri/4.3.0": {
          "runtime.unix.System.Private.Uri": "4.3.0"
    "runtime.unix.System.Private.Uri/4.3.0": {
    "System.Private.Uri/4.3.0": {

/app $ find / -name "*Uri*"
/usr/share/dotnet/shared/Microsoft.NETCore.App/6.0.9/System.Private.Uri.dll

/app $ exiftool /usr/share/dotnet/shared/Microsoft.NETCore.App/6.0.9/System.Private.Uri.dll | grep -w Version
ExifTool Version Number         : 12.40
Linker Version                  : 11.0
OS Version                      : 4.0
Image Version                   : 0.0
Subsystem Version               : 4.0
File Version Number             : 6.0.922.41905
Product Version Number          : 0.0.0.0
File Version                    : 6.0.922.41905
Product Version                 : 6.0.9-servicing.22419.5+163a63591cf9e9b682063cf3995948c2b885a042
Assembly Version                : 6.0.0.0

0 replies

DmitriyLewen · 2022-11-03T07:17:26Z

DmitriyLewen
Nov 3, 2022
Maintainer

Hello @jkone27 , @JoostvdB94
Thanks for your reports!

@jkone27 i looked your screen shoot - if i understand correctly - this *.deps.json file doesn't contain System.Private.Uri, right?
This is very strange... Can you use --format json --list-all-pkgs flags and scan again?
You can see filepath in Target field. e.g.:

trivy -d image -f json --list-all-pkgs -o result.json mcr.microsoft.com/dotnet/sdk
...
    {
      "Target": "usr/share/dotnet/sdk/6.0.402/Microsoft.TestPlatform.PlatformAbstractions.deps.json",
      "Class": "lang-pkgs",
      "Type": "dotnet-core",
      "Packages": [
        {
          "Name": "Microsoft.CodeAnalysis.PublicApiAnalyzers",
          "Version": "3.3.4-beta1.21554.2",
          "Layer": {
            "DiffID": "sha256:299937ab7d353b110721d6c2a7a0ea9943290e18a6899aaf43f197458e1785f9"
          }
        },
...

Perhaps another *deps.json file contains System.Private.Uri.

@plaisted your <redacted>.deps.json contains "System.Private.Uri": "4.3.0". if i understand correctly - it is not lastest version(https://www.nuget.org/packages/System.Private.Uri).
CVE-2019-0980 and CVE-2019-0981have fixed version == "4.3.2".
It looks like Trivy works correctly.

Tell me if i am wrong (I don't write in c# and I might be missing something)
I also tried to find information about changes in *deps.json files in NET 6, but couldn't find it.
Please tell me if there are differences in deps.json for NET 5 and NET 6.

Best Regards, Dmitiry

0 replies

plaisted · 2022-11-03T13:56:14Z

plaisted
Nov 3, 2022

@DmitriyLewen
My example clearly shows that the container is using version 6.0.922.41905 of System.Private.Uri not 4.3.0. Just because a version is in the .deps.json does not mean it the version actually in use. The *.deps.json method used by trivy may work for directly referenced packages but can't be used universally for everything in the *.deps.json. I am not familiar enough to suggest how this should work but the existing approach is definitely incorrect.

0 replies

pmuzyka-travix · 2022-11-03T15:50:04Z

pmuzyka-travix
Nov 3, 2022

@DmitriyLewen - @jkone27 's situation is actually quite simillar to what @plaisted described. In his code he already uses latest of version of System.Private.Uri not 4.3.0. The 4.3.0 is coming from .deps.json due to the transitive dependency.

+1 to what @plaisted wrote, it would possibly better if trivy did filter out results coming from .deps.json inclusion to return the results tied to directly referenced packages.

0 replies

DmitriyLewen · 2022-11-07T05:40:24Z

DmitriyLewen
Nov 7, 2022
Maintainer

okay, thanks! i understand what do you meant.

But what confuses me is that the *deps.json file does not include System.Private.Uri 6.0.922.41905.
Looks like NET6 includes this package as system and doesn't include this package to *.deps.json.
If it is true:
I am not sure if NET6 overwrite system packages from other dependencies.
i mean:
NET6 contains System.Private.Uri 6.0.922.41905
examplePackage uses System.Private.Uri 4.3
in this case: i am not sure if System.Private.Uri from examplePackage will be overwritten to 6.0.922.41905.
If examplePackage will still use System.Private.Uri 4.3 then examplePackage is vulnerable, because the wrong System.Private.Uri 4.3 package is used.

@pmuzyka-travix @plaisted What do you think about this?

0 replies

plaisted · 2022-11-07T17:37:49Z

plaisted
Nov 7, 2022

@DmitriyLewen I don't know enough about the deps.json to suggest the best way to do this. You would need to get feedback from someone on the dotnet team.

A potential improvement to the current would be to check the if the file exists in the same folder as the deps.json file. That would let you know the file is being provided by the app instead of the runtime (although not foolproof as the loading behavior can be customized). I did experiment and published the same app using a self-contained deployment the assembly version of System.Private.Uri in the deps.json file was set to 6.0.0.0 and file version to 6.0.422.16404 so it appears that it will show the correct version if it is including it in the deployment. For assemblies the runtime is supposed to provide (non self-contained) it must put the lowest compatible version or something similar into the deps.json which is what is triggering the false positive from aqua.

I also noticed it tags a fileVersion to anything it includes under the targets section of the deps.json so that may be able to be used to filter out assemblies provided by the runtime (if no fileVersion given) and shouldn't be included in scans (assuming aqua validates the runtime version has no vulns).

0 replies

JoostvdB94 · 2022-11-10T08:24:30Z

JoostvdB94
Nov 10, 2022

There is an vulnerability reported by Microsoft (that is also discovered by Trivy) that explains how to detect if you need to update a transitive dependency:

https://github.com/advisories/GHSA-8g2p-5pqh-5jmc#:~:text=Discovering%20and%20fixing,the%20transitive%20dependency.

0 replies

DmitriyLewen · 2022-11-10T08:40:29Z

DmitriyLewen
Nov 10, 2022
Maintainer

Thanks a look @JoostvdB94
I will check this.

0 replies

DmitriyLewen · 2022-11-11T04:37:52Z

DmitriyLewen
Nov 11, 2022
Maintainer

Thanks @JoostvdB94 for this link.
I investigated this and i have some thoughts:
Perhaps your projects have multiple (more then one) dependencies with System.Private.Uri transitive dependency.
for example:
pkgA -> System.Private.Uri v4.3.0
pkgB -> System.Private.Uri v6.0.0
We think that NET 6 uses System.Private.Uri from pkgB but it uses lower version from pkgA (https://learn.microsoft.com/en-us/nuget/concepts/dependency-resolution#lowest-applicable-version).

@plaisted can i ask you to send me both of your test *.deps.json files?
Also can you enable lock file and send me both lock files?(https://learn.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files#enabling-the-lock-file)
I want to explore these files. It will help me a lot.

0 replies

JoostvdB94 · 2022-11-11T07:48:32Z

JoostvdB94
Nov 11, 2022

Hey @DmitriyLewen thank you for investigating this.

I enabled the lock file and did not find any reference to System.Private.Uri. I did however find out that, although my application targets net6.0, it resolved the Microsoft.NETCore.App to 1.1.2 in the lockfile.

"Microsoft.NETCore.App": {
    "type": "Transitive",
    "resolved": "1.1.2",
    "contentHash": "fcN0Ob6rjY7Zu0770cA5l9wRJvj7+ltJPPdryUidejkkhao+y2AYrtezBTlP9nCSFXLmYR9BtaknORT17x8reA==",
    "dependencies": {...}
}

Microsoft.NETCore.App=1.1.2 was a dependency of another package:

"JsonDiffPatch": {
    "type": "Transitive",
    "resolved": "2.0.61",
    "contentHash": "nZ4QtcU3jR+CBT69qcJBvCcWi5uKgPRrrvSMm4V8Z76ljJ/MFo1P55qXk/nQY0q0WC4v94m5qH4SDhovFfci+Q==",
    "dependencies": {
      "Microsoft.NETCore.App": "1.1.2",
      "Newtonsoft.Json": "10.0.3"
    }
},

When I build normally here is no System.Private.Uri.dll inside the output bin-folder. So I assume it uses the one that is installed globally on my machine.
However, when using a self-contained build (where all runtime dll's are included in the build result) I do see a System.Private.Uri file in the build output folder. That seems to be the 6.0.11 version.

0 replies

DmitriyLewen · 2022-11-11T08:12:11Z

DmitriyLewen
Nov 11, 2022
Maintainer

hello @JoostvdB94
Thanks for your information

What about *.deps.json file?
Does it contain System.Private.Uri?
If yes, what version is used?

summary:

build type	*deps.json contains System.Private.Uri	lock file contains System.Private.Uri	app folder contains System.Private.Uri.dll
normal	+	-	-
self-contained	+	-	+

Is this summary right?

0 replies

JoostvdB94 · 2022-11-11T08:38:11Z

JoostvdB94
Nov 11, 2022

That's correct. It appears multiple times (in a self contained build output)

I've tried to isolate the JSON structure that's relevant. These are all occurrences of the search (search term was Private.Uri)

{
    "targets": {
        ".NETCoreApp,Version=v6.0": {
            "runtime.any.System.Runtime/4.3.0": {
                "dependencies": {
                    "System.Private.Uri": "4.3.0"
                }
            },
            "runtime.unix.System.Private.Uri/4.3.0": {
                "dependencies": {
                    "runtime.native.System": "4.3.0"
                }
            },
            "runtime.unix.System.Runtime.Extensions/4.3.0": {
                "dependencies": {
                    "System.Private.Uri": "4.3.0",
                    "runtime.native.System": "4.3.0",
                    "runtime.native.System.Security.Cryptography.OpenSsl": "4.3.2"
                }
            },
            "System.Private.Uri/4.3.0": {
                "dependencies": {
                    "Microsoft.NETCore.Platforms": "5.0.0",
                    "Microsoft.NETCore.Targets": "1.1.3",
                    "runtime.unix.System.Private.Uri": "4.3.0"
                }
            },
        },
        ".NETCoreApp,Version=v6.0/alpine-x64": {
            "runtimepack.Microsoft.NETCore.App.Runtime.linux-musl-x64/6.0.11": {
                "runtime": {
                    "System.Private.Uri.dll": {
                        "assemblyVersion": "6.0.0.0",
                        "fileVersion": "6.0.1122.52304"
                    }
                }
            },
            "runtime.any.System.Runtime/4.3.0": {
                "dependencies": {
                  "System.Private.Uri": "4.3.0"
                }
            },
            "runtime.unix.System.Private.Uri/4.3.0": {
                "dependencies": {
                  "runtime.native.System": "4.3.0"
                }
            },
            "runtime.unix.System.Runtime.Extensions/4.3.0": {
                "dependencies": {
                  "System.Private.Uri": "4.3.0",
                  "runtime.native.System": "4.3.0",
                  "runtime.native.System.Security.Cryptography.OpenSsl": "4.3.2"
                }
            },
            "System.Private.Uri/4.3.0": {
                "dependencies": {
                  "Microsoft.NETCore.Platforms": "5.0.0",
                  "Microsoft.NETCore.Targets": "1.1.3",
                  "runtime.unix.System.Private.Uri": "4.3.0"
                }
            },  
        }
    },
    "libraries": {
        "runtime.unix.System.Private.Uri/4.3.0": {
            "type": "package",
            "serviceable": true,
            "sha512": "sha512-ooWzobr5RAq34r9uan1r/WPXJYG1XWy9KanrxNvEnBzbFdQbMG7Y3bVi4QxR7xZMNLOxLLTAyXvnSkfj5boZSg==",
            "path": "runtime.unix.system.private.uri/4.3.0",
            "hashPath": "runtime.unix.system.private.uri.4.3.0.nupkg.sha512"
        },
        "System.Private.Uri/4.3.0": {
            "type": "package",
            "serviceable": true,
            "sha512": "sha512-I4SwANiUGho1esj4V4oSlPllXjzCZDE+5XXso2P03LW2vOda2Enzh8DWOxwN6hnrJyp314c7KuVu31QYhRzOGg==",
            "path": "system.private.uri/4.3.0",
            "hashPath": "system.private.uri.4.3.0.nupkg.sha512"
          },
    }
}

0 replies

jkone27 · 2022-11-23T15:23:37Z

jkone27
Nov 23, 2022
Author

big question, why doesnt trivy use just dotnet for checking package vulnerabilities, isn't dotnet commands based on framework more reliable?

dotnet list package --vulnerable --include-transitive

it looks like this gives more results or different results than trivy scans? shoudln't they give the same result all times

frameworks can be found from .csproj file but maybe it could also be passed as a parameter if that's easier?
dotnet-sdk images to run that command, or maybe version could be passed by mantainers on a scan like --framework=NET6 https://hub.docker.com/_/microsoft-dotnet-sdk/.

0 replies

plaisted · 2022-11-23T18:15:58Z

plaisted
Nov 23, 2022

big question, why doesnt trivy use just dotnet for checking package vulnerabilities, isn't dotnet commands based on framework more reliable?

Trivy is used to scan containers that primarily contain already published applications. dotnet list package only works on a project / solution not the published artifacts.

0 replies

DmitriyLewen · 2022-11-24T03:29:44Z

DmitriyLewen
Nov 24, 2022
Maintainer

Trivy doesn't run commands. We only parse individual files (in this case *.deps.json).

dotnet commands based on framework more reliable?

This option is not available at the moment.

0 replies

2023-02-08T00:05:29Z

github-actions[bot]
bot Feb 8, 2023

This issue is stale because it has been labeled with inactivity.

0 replies

ben-page · 2023-02-23T16:49:36Z

ben-page
Feb 23, 2023

Bump. Until Trivy understands how .NET resolves transitive dependencies, Trivy is unusable for .NET projects.

0 replies

DmitriyLewen · 2023-03-06T06:53:11Z

DmitriyLewen
Mar 6, 2023
Maintainer

Hello @ben-page

Maybe you can send some examples to help us understand how .Net stores dependencies?

0 replies

cspwizard · 2023-04-19T13:41:55Z

cspwizard
Apr 19, 2023

Hi! Have a similar issue:
Trivy reports

System.Text.Encodings.Web │ CVE-2021-26701 │ CRITICAL │ 4.5.0             │ 5.0.1, 4.7.2, 4.5.1 │ dotnet: System.Text.Encodings.Web Remote Code Execution │ https://avd.aquasec.com/nvd/cve-2021-26701

However this library version is not used. It appears in dependencies, but there is another one (6.0) actually installed and used.

"System.Text.Encodings.Web": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "Vg8eB5Tawm1IFqj4TVK1czJX89rhFxJo9ELqc/Eiq0eXy13RK00eubyU6TJE6y+GQXjyV5gSfiewDUZjQgSE0w==",
      "dependencies": {
        "System.Runtime.CompilerServices.Unsafe": "6.0.0"
      }
    }

So this looks like a bug in the trivy.

Scan is running in trivy docker container:

docker run --pull=always -v $HOME/.trivy/cache:/root/.cache/ -v "$HOME/sources/project:/src" aquasec/trivy fs --exit-code 1 --severity CRITICAL /src

packages.lock.json

{
"version": 1,
"dependencies": {
  "net7.0": {
    "ApacheThrift": {
      "type": "Direct",
      "requested": "[0.18.1, )",
      "resolved": "0.18.1",
      "contentHash": "bFZOkBgcFx6lf1hTy5s3ld/C0EoQUnod0quX9ZKe8W7fIUHmNclPxfgSNkM0WTJxa9ZIsNw7XIgP/cGVkOfFmg==",
      "dependencies": {
        "Microsoft.AspNetCore.Http.Abstractions": "2.2.0",
        "Microsoft.Extensions.Logging": "6.0.0",
        "Microsoft.Extensions.Logging.Console": "6.0.0",
        "Microsoft.Extensions.Logging.Debug": "6.0.0",
        "System.IO.Pipes": "4.3.0",
        "System.IO.Pipes.AccessControl": "5.0.0",
        "System.Net.Http.WinHttpHandler": "6.0.0",
        "System.Net.NameResolution": "4.3.0",
        "System.Net.Requests": "4.3.0",
        "System.Net.Security": "4.3.2",
        "System.Threading.Tasks.Extensions": "4.5.4"
      }
    },
    "Castle.Core": {
      "type": "Direct",
      "requested": "[5.1.1, )",
      "resolved": "5.1.1",
      "contentHash": "rpYtIczkzGpf+EkZgDr9CClTdemhsrwA/W5hMoPjLkRFnXzH44zDLoovXeKtmxb1ykXK9aJVODSpiJml8CTw2g==",
      "dependencies": {
        "System.Diagnostics.EventLog": "6.0.0"
      }
    },
    "Castle.Core.AsyncInterceptor": {
      "type": "Direct",
      "requested": "[2.1.0, )",
      "resolved": "2.1.0",
      "contentHash": "1vOovJnbjjoCFbPPNLvLTeiqJwoA+aRXkhXcgCQY0pi1eejGqCegJwl58pIIPH/uKDfUXnPIo7aqSrcXEyEH1Q==",
      "dependencies": {
        "Castle.Core": "4.4.0"
      }
    },
    "Nerdbank.Streams": {
      "type": "Direct",
      "requested": "[2.9.112, )",
      "resolved": "2.9.112",
      "contentHash": "SEEoiRbeDZ/FoPmAEgVWIngdM1PCqeZd61P5P/7jVn16k/ObjTxhiMozajlYoQftL/yYTYkH/MqaE1XGMssazw==",
      "dependencies": {
        "Microsoft.Bcl.AsyncInterfaces": "6.0.0",
        "Microsoft.VisualStudio.Threading": "17.1.46",
        "Microsoft.VisualStudio.Validation": "17.0.53",
        "System.IO.Pipelines": "6.0.3",
        "System.Runtime.CompilerServices.Unsafe": "6.0.0"
      }
    },
    "OpenTracing": {
      "type": "Direct",
      "requested": "[0.12.1, )",
      "resolved": "0.12.1",
      "contentHash": "8i/Vnx/lbWzqqJ6J5lofguT4wBS99rfqKujWrFrTGAclQBZ5h1CgBlzGOTqsNjmMsxSTLpC+Ns6/f1RB0c4O/g=="
    },
    "Polly": {
      "type": "Direct",
      "requested": "[7.2.3, )",
      "resolved": "7.2.3",
      "contentHash": "DeCY0OFbNdNxsjntr1gTXHJ5pKUwYzp04Er2LLeN3g6pWhffsGuKVfMBLe1lw7x76HrPkLxKEFxBlpRxS2nDEQ=="
    },
    "prometheus-net.AspNetCore": {
      "type": "Direct",
      "requested": "[8.0.0, )",
      "resolved": "8.0.0",
      "contentHash": "XNeeTpq9DMWOQC9t4yu4sYRE7WqRn9CrHi916gV8n4Zwe5kzFqGt5H2FnIm7LLGw2edndU2AtdlYs9bJ2AmVuQ==",
      "dependencies": {
        "prometheus-net": "8.0.0"
      }
    },
    "System.Net.Http": {
      "type": "Direct",
      "requested": "[4.3.4, )",
      "resolved": "4.3.4",
      "contentHash": "aOa2d51SEbmM+H+Csw7yJOuNZoHkrP2XnAurye5HWYgGVVU54YZDvsLUYRv6h18X3sPnjNCANmN7ZhIPiqMcjA==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.1",
        "System.Collections": "4.3.0",
        "System.Diagnostics.Debug": "4.3.0",
        "System.Diagnostics.DiagnosticSource": "4.3.0",
        "System.Diagnostics.Tracing": "4.3.0",
        "System.Globalization": "4.3.0",
        "System.Globalization.Extensions": "4.3.0",
        "System.IO": "4.3.0",
        "System.IO.FileSystem": "4.3.0",
        "System.Net.Primitives": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Extensions": "4.3.0",
        "System.Runtime.Handles": "4.3.0",
        "System.Runtime.InteropServices": "4.3.0",
        "System.Security.Cryptography.Algorithms": "4.3.0",
        "System.Security.Cryptography.Encoding": "4.3.0",
        "System.Security.Cryptography.OpenSsl": "4.3.0",
        "System.Security.Cryptography.Primitives": "4.3.0",
        "System.Security.Cryptography.X509Certificates": "4.3.0",
        "System.Text.Encoding": "4.3.0",
        "System.Threading": "4.3.0",
        "System.Threading.Tasks": "4.3.0",
        "runtime.native.System": "4.3.0",
        "runtime.native.System.Net.Http": "4.3.0",
        "runtime.native.System.Security.Cryptography.OpenSsl": "4.3.2"
      }
    },
    "Microsoft.AspNetCore.Http.Abstractions": {
      "type": "Transitive",
      "resolved": "2.2.0",
      "contentHash": "Nxs7Z1q3f1STfLYKJSVXCs1iBl+Ya6E8o4Oy1bCxJ/rNI44E/0f6tbsrVqAWfB7jlnJfyaAtIalBVxPKUPQb4Q==",
      "dependencies": {
        "Microsoft.AspNetCore.Http.Features": "2.2.0",
        "System.Text.Encodings.Web": "4.5.0"
      }
    },
    "Microsoft.AspNetCore.Http.Features": {
      "type": "Transitive",
      "resolved": "2.2.0",
      "contentHash": "ziFz5zH8f33En4dX81LW84I6XrYXKf9jg6aM39cM+LffN9KJahViKZ61dGMSO2gd3e+qe5yBRwsesvyqlZaSMg==",
      "dependencies": {
        "Microsoft.Extensions.Primitives": "2.2.0"
      }
    },
    "Microsoft.Bcl.AsyncInterfaces": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "UcSjPsst+DfAdJGVDsu346FX0ci0ah+lw3WRtn18NUwEqRt70HaOQ7lI72vy3+1LxtqI3T5GWwV39rQSrCzAeg=="
    },
    "Microsoft.Extensions.Configuration": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "tq2wXyh3fL17EMF2bXgRhU7JrbO3on93MRKYxzz4JzzvuGSA1l0W3GI9/tl8EO89TH+KWEymP7bcFway6z9fXg==",
      "dependencies": {
        "Microsoft.Extensions.Configuration.Abstractions": "6.0.0",
        "Microsoft.Extensions.Primitives": "6.0.0"
      }
    },
    "Microsoft.Extensions.Configuration.Abstractions": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "qWzV9o+ZRWq+pGm+1dF+R7qTgTYoXvbyowRoBxQJGfqTpqDun2eteerjRQhq5PQ/14S+lqto3Ft4gYaRyl4rdQ==",
      "dependencies": {
        "Microsoft.Extensions.Primitives": "6.0.0"
      }
    },
    "Microsoft.Extensions.Configuration.Binder": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "b3ErKzND8LIC7o08QAVlKfaEIYEvLJbtmVbFZVBRXeu9YkKfSSzLZfR1SUfQPBIy9mKLhEtJgGYImkcMNaKE0A==",
      "dependencies": {
        "Microsoft.Extensions.Configuration.Abstractions": "6.0.0"
      }
    },
    "Microsoft.Extensions.DependencyInjection": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "k6PWQMuoBDGGHOQTtyois2u4AwyVcIwL2LaSLlTZQm2CYcJ1pxbt6jfAnpWmzENA/wfrYRI/X9DTLoUkE4AsLw==",
      "dependencies": {
        "Microsoft.Extensions.DependencyInjection.Abstractions": "6.0.0",
        "System.Runtime.CompilerServices.Unsafe": "6.0.0"
      }
    },
    "Microsoft.Extensions.DependencyInjection.Abstractions": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "xlzi2IYREJH3/m6+lUrQlujzX8wDitm4QGnUu6kUXTQAWPuZY8i+ticFJbzfqaetLA6KR/rO6Ew/HuYD+bxifg=="
    },
    "Microsoft.Extensions.Http": {
      "type": "Transitive",
      "resolved": "3.1.0",
      "contentHash": "DLigdcV0nYaT6/ly0rnfP80BnXq8NNd/h8/SkfY39uio7Bd9LauVntp6RcRh1Kj23N+uf80GgL7Win6P3BCtoQ==",
      "dependencies": {
        "Microsoft.Extensions.DependencyInjection.Abstractions": "3.1.0",
        "Microsoft.Extensions.Logging": "3.1.0",
        "Microsoft.Extensions.Options": "3.1.0"
      }
    },
    "Microsoft.Extensions.Logging": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "eIbyj40QDg1NDz0HBW0S5f3wrLVnKWnDJ/JtZ+yJDFnDj90VoPuoPmFkeaXrtu+0cKm5GRAwoDf+dBWXK0TUdg==",
      "dependencies": {
        "Microsoft.Extensions.DependencyInjection": "6.0.0",
        "Microsoft.Extensions.DependencyInjection.Abstractions": "6.0.0",
        "Microsoft.Extensions.Logging.Abstractions": "6.0.0",
        "Microsoft.Extensions.Options": "6.0.0",
        "System.Diagnostics.DiagnosticSource": "6.0.0"
      }
    },
    "Microsoft.Extensions.Logging.Abstractions": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "/HggWBbTwy8TgebGSX5DBZ24ndhzi93sHUBDvP1IxbZD7FDokYzdAr6+vbWGjw2XAfR2EJ1sfKUotpjHnFWPxA=="
    },
    "Microsoft.Extensions.Logging.Configuration": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "ZDskjagmBAbv+K8rYW9VhjPplhbOE63xUD0DiuydZJwt15dRyoqicYklLd86zzeintUc7AptDkHn+YhhYkYo8A==",
      "dependencies": {
        "Microsoft.Extensions.Configuration": "6.0.0",
        "Microsoft.Extensions.Configuration.Abstractions": "6.0.0",
        "Microsoft.Extensions.Configuration.Binder": "6.0.0",
        "Microsoft.Extensions.DependencyInjection.Abstractions": "6.0.0",
        "Microsoft.Extensions.Logging": "6.0.0",
        "Microsoft.Extensions.Logging.Abstractions": "6.0.0",
        "Microsoft.Extensions.Options": "6.0.0",
        "Microsoft.Extensions.Options.ConfigurationExtensions": "6.0.0"
      }
    },
    "Microsoft.Extensions.Logging.Console": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "gsqKzOEdsvq28QiXFxagmn1oRB9GeI5GgYCkoybZtQA0IUb7QPwf1WmN3AwJeNIsadTvIFQCiVK0OVIgKfOBGg==",
      "dependencies": {
        "Microsoft.Extensions.DependencyInjection.Abstractions": "6.0.0",
        "Microsoft.Extensions.Logging": "6.0.0",
        "Microsoft.Extensions.Logging.Abstractions": "6.0.0",
        "Microsoft.Extensions.Logging.Configuration": "6.0.0",
        "Microsoft.Extensions.Options": "6.0.0",
        "System.Text.Json": "6.0.0"
      }
    },
    "Microsoft.Extensions.Logging.Debug": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "M9g/JixseSZATJE9tcMn9uzoD4+DbSglivFqVx8YkRJ7VVPmnvCEbOZ0AAaxsL1EKyI4cz07DXOOJExxNsUOHw==",
      "dependencies": {
        "Microsoft.Extensions.DependencyInjection.Abstractions": "6.0.0",
        "Microsoft.Extensions.Logging": "6.0.0",
        "Microsoft.Extensions.Logging.Abstractions": "6.0.0"
      }
    },
    "Microsoft.Extensions.ObjectPool": {
      "type": "Transitive",
      "resolved": "7.0.0",
      "contentHash": "udvKco0sAVgYGTBnHUb0tY9JQzJ/nPDiv/8PIyz69wl1AibeCDZOLVVI+6156dPfHmJH7ws5oUJRiW4ZmAvuuA=="
    },
    "Microsoft.Extensions.Options": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "dzXN0+V1AyjOe2xcJ86Qbo233KHuLEY0njf/P2Kw8SfJU+d45HNS2ctJdnEnrWbM9Ye2eFgaC5Mj9otRMU6IsQ==",
      "dependencies": {
        "Microsoft.Extensions.DependencyInjection.Abstractions": "6.0.0",
        "Microsoft.Extensions.Primitives": "6.0.0"
      }
    },
    "Microsoft.Extensions.Options.ConfigurationExtensions": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "bXWINbTn0vC0FYc9GaQTISbxhQLAMrvtbuvD9N6JelEaIS/Pr62wUCinrq5bf1WRBGczt1v4wDhxFtVFNcMdUQ==",
      "dependencies": {
        "Microsoft.Extensions.Configuration.Abstractions": "6.0.0",
        "Microsoft.Extensions.Configuration.Binder": "6.0.0",
        "Microsoft.Extensions.DependencyInjection.Abstractions": "6.0.0",
        "Microsoft.Extensions.Options": "6.0.0",
        "Microsoft.Extensions.Primitives": "6.0.0"
      }
    },
    "Microsoft.Extensions.Primitives": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "9+PnzmQFfEFNR9J2aDTfJGGupShHjOuGw4VUv+JB044biSHrnmCIMD+mJHmb2H7YryrfBEXDurxQ47gJZdCKNQ==",
      "dependencies": {
        "System.Runtime.CompilerServices.Unsafe": "6.0.0"
      }
    },
    "Microsoft.NETCore.Platforms": {
      "type": "Transitive",
      "resolved": "5.0.0",
      "contentHash": "VyPlqzH2wavqquTcYpkIIAQ6WdenuKoFN0BdYBbCWsclXacSOHNQn66Gt4z5NBqEYW0FAPm5rlvki9ZiCij5xQ=="
    },
    "Microsoft.NETCore.Targets": {
      "type": "Transitive",
      "resolved": "1.1.0",
      "contentHash": "aOZA3BWfz9RXjpzt0sRJJMjAscAUm3Hoa4UWAfceV9UTYxgwZ1lZt5nO2myFf+/jetYQo4uTP7zS8sJY67BBxg=="
    },
    "Microsoft.VisualStudio.Threading": {
      "type": "Transitive",
      "resolved": "17.1.46",
      "contentHash": "05zhYyjY81Zizs5pqVr5MRm0ALOkYNseq0EnI/jec5H223suCs9BCZYziL2FnNMbNGMgynv0VtJfOVZpjszkpg==",
      "dependencies": {
        "Microsoft.Bcl.AsyncInterfaces": "6.0.0",
        "Microsoft.VisualStudio.Threading.Analyzers": "17.1.46",
        "Microsoft.VisualStudio.Validation": "17.0.43",
        "Microsoft.Win32.Registry": "5.0.0",
        "System.Threading.Tasks.Extensions": "4.5.4"
      }
    },
    "Microsoft.VisualStudio.Threading.Analyzers": {
      "type": "Transitive",
      "resolved": "17.1.46",
      "contentHash": "7pImoMcQaWZYAwu1aDBB8yBkvgad13yjrRHQ65pwHMX757vZ49OrNaEuRSLDu2PjZGonsTkQAJK8JK4W/wW4bw=="
    },
    "Microsoft.VisualStudio.Validation": {
      "type": "Transitive",
      "resolved": "17.0.53",
      "contentHash": "YUDb/V5JpiEGRXBut8fRy1rFqDRfl5XX3MgBaLsc0YVYpRy+pXb3pnzbceL1YMQxjrOiJPn5WZEpJNSxZvPdgg=="
    },
    "Microsoft.Win32.Primitives": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "9ZQKCWxH7Ijp9BfahvL2Zyf1cJIk8XYLF6Yjzr2yi0b2cOut/HQ31qf1ThHAgCc3WiZMdnWcfJCgN82/0UunxA==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.Runtime": "4.3.0"
      }
    },
    "Microsoft.Win32.Registry": {
      "type": "Transitive",
      "resolved": "5.0.0",
      "contentHash": "dDoKi0PnDz31yAyETfRntsLArTlVAVzUzCIvvEDsDsucrl33Dl8pIJG06ePTJTI3tGpeyHS9Cq7Foc/s4EeKcg==",
      "dependencies": {
        "System.Security.AccessControl": "5.0.0",
        "System.Security.Principal.Windows": "5.0.0"
      }
    },
    "NLog": {
      "type": "Transitive",
      "resolved": "5.1.3",
      "contentHash": "rB8hwjBf1EZCfG5iPfsv3gPksLoJLr1cOrt7PBbJu6VpJgwYJchDzTUT1dhNDdPv0QakXJQJOhE59ErupcznQQ=="
    },
    "NLog.Extensions.Logging": {
      "type": "Transitive",
      "resolved": "5.2.3",
      "contentHash": "TB8zPGV2nVpvWq5C8zIVHPSmnzOHMrXppjsAwHcuJq1Ehs8sC0llnAv5Ysf5Lf/vew9amV/+01MohtRFSDzKdQ==",
      "dependencies": {
        "Microsoft.Extensions.Configuration.Abstractions": "6.0.0",
        "Microsoft.Extensions.Logging": "6.0.0",
        "NLog": "5.1.3"
      }
    },
    "NLog.Web.AspNetCore": {
      "type": "Transitive",
      "resolved": "5.2.3",
      "contentHash": "uP0KekbkswuMjo1dbaqu20TxH2Dc3ox2qJDIi837ob2Fq/BliZHuQY9nJdM3UArVrLrsl+xxsx0D6h8m3fOufg==",
      "dependencies": {
        "NLog.Extensions.Logging": "5.2.3"
      }
    },
    "prometheus-net": {
      "type": "Transitive",
      "resolved": "8.0.0",
      "contentHash": "tUz6ScbA4J193hT1xUxTXQuEAZj8b5YUUrdUVIEXb6yYOZZEvPzs4zqFqI2iJW6aLmldMEiUqCFq93EOLvqITA==",
      "dependencies": {
        "Microsoft.Extensions.Http": "3.1.0",
        "Microsoft.Extensions.ObjectPool": "7.0.0"
      }
    },
    "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl": {
      "type": "Transitive",
      "resolved": "4.3.2",
      "contentHash": "7VSGO0URRKoMEAq0Sc9cRz8mb6zbyx/BZDEWhgPdzzpmFhkam3fJ1DAGWFXBI4nGlma+uPKpfuMQP5LXRnOH5g=="
    },
    "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl": {
      "type": "Transitive",
      "resolved": "4.3.2",
      "contentHash": "0oAaTAm6e2oVH+/Zttt0cuhGaePQYKII1dY8iaqP7CvOpVKgLybKRFvQjXR2LtxXOXTVPNv14j0ot8uV+HrUmw=="
    },
    "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl": {
      "type": "Transitive",
      "resolved": "4.3.2",
      "contentHash": "G24ibsCNi5Kbz0oXWynBoRgtGvsw5ZSVEWjv13/KiCAM8C6wz9zzcCniMeQFIkJ2tasjo2kXlvlBZhplL51kGg=="
    },
    "runtime.native.System": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "c/qWt2LieNZIj1jGnVNsE2Kl23Ya2aSTBuXMD6V7k9KWr6l16Tqdwq+hJScEpWER9753NWC8h96PaVNY5Ld7Jw==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0"
      }
    },
    "runtime.native.System.Net.Http": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "ZVuZJqnnegJhd2k/PtAbbIcZ3aZeITq3sj06oKfMBSfphW3HDmk/t4ObvbOk/JA/swGR0LNqMksAh/f7gpTROg==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0"
      }
    },
    "runtime.native.System.Net.Security": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "M2nN92ePS8BgQ2oi6Jj3PlTUzadYSIWLdZrHY1n1ZcW9o4wAQQ6W+aQ2lfq1ysZQfVCgDwY58alUdowrzezztg==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0"
      }
    },
    "runtime.native.System.Security.Cryptography.Apple": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "DloMk88juo0OuOWr56QG7MNchmafTLYWvABy36izkrLI5VledI0rq28KGs1i9wbpeT9NPQrx/wTf8U2vazqQ3Q==",
      "dependencies": {
        "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.Apple": "4.3.0"
      }
    },
    "runtime.native.System.Security.Cryptography.OpenSsl": {
      "type": "Transitive",
      "resolved": "4.3.2",
      "contentHash": "QR1OwtwehHxSeQvZKXe+iSd+d3XZNkEcuWMFYa2i0aG1l+lR739HPicKMlTbJst3spmeekDVBUS7SeS26s4U/g==",
      "dependencies": {
        "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl": "4.3.2",
        "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl": "4.3.2",
        "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl": "4.3.2",
        "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl": "4.3.2",
        "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl": "4.3.2",
        "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl": "4.3.2",
        "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl": "4.3.2",
        "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl": "4.3.2",
        "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl": "4.3.2",
        "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl": "4.3.2"
      }
    },
    "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl": {
      "type": "Transitive",
      "resolved": "4.3.2",
      "contentHash": "I+GNKGg2xCHueRd1m9PzeEW7WLbNNLznmTuEi8/vZX71HudUbx1UTwlGkiwMri7JLl8hGaIAWnA/GONhu+LOyQ=="
    },
    "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl": {
      "type": "Transitive",
      "resolved": "4.3.2",
      "contentHash": "1Z3TAq1ytS1IBRtPXJvEUZdVsfWfeNEhBkbiOCGEl9wwAfsjP2lz3ZFDx5tq8p60/EqbS0HItG5piHuB71RjoA=="
    },
    "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.Apple": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "kVXCuMTrTlxq4XOOMAysuNwsXWpYeboGddNGpIgNSZmv1b6r/s/DPk0fYMB7Q5Qo4bY68o48jt4T4y5BVecbCQ=="
    },
    "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl": {
      "type": "Transitive",
      "resolved": "4.3.2",
      "contentHash": "6mU/cVmmHtQiDXhnzUImxIcDL48GbTk+TsptXyJA+MIOG9LRjPoAQC/qBFB7X+UNyK86bmvGwC8t+M66wsYC8w=="
    },
    "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl": {
      "type": "Transitive",
      "resolved": "4.3.2",
      "contentHash": "vjwG0GGcTW/PPg6KVud8F9GLWYuAV1rrw1BKAqY0oh4jcUqg15oYF1+qkGR2x2ZHM4DQnWKQ7cJgYbfncz/lYg=="
    },
    "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl": {
      "type": "Transitive",
      "resolved": "4.3.2",
      "contentHash": "7KMFpTkHC/zoExs+PwP8jDCWcrK9H6L7soowT80CUx3e+nxP/AFnq0AQAW5W76z2WYbLAYCRyPfwYFG6zkvQRw=="
    },
    "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl": {
      "type": "Transitive",
      "resolved": "4.3.2",
      "contentHash": "xrlmRCnKZJLHxyyLIqkZjNXqgxnKdZxfItrPkjI+6pkRo5lHX8YvSZlWrSI5AVwLMi4HbNWP7064hcAWeZKp5w=="
    },
    "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl": {
      "type": "Transitive",
      "resolved": "4.3.2",
      "contentHash": "leXiwfiIkW7Gmn7cgnNcdtNAU70SjmKW3jxGj1iKHOvdn0zRWsgv/l2OJUO5zdGdiv2VRFnAsxxhDgMzofPdWg=="
    },
    "System.Buffers": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "ratu44uTIHgeBeI0dE8DWvmXVBSo4u7ozRZZHOMmK/JPpYyo0dAfgSiHlpiObMQ5lEtEyIXA40sKRYg5J6A8uQ==",
      "dependencies": {
        "System.Diagnostics.Debug": "4.3.0",
        "System.Diagnostics.Tracing": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Threading": "4.3.0"
      }
    },
    "System.Collections": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "3Dcj85/TBdVpL5Zr+gEEBUuFe2icOnLalmEh9hfck1PTYbbyWuZgh4fmm2ysCLTrqLQw6t3TgTyJ+VLp+Qb+Lw==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.Runtime": "4.3.0"
      }
    },
    "System.Collections.Concurrent": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "ztl69Xp0Y/UXCL+3v3tEU+lIy+bvjKNUmopn1wep/a291pVPK7dxBd6T7WnlQqRog+d1a/hSsgRsmFnIBKTPLQ==",
      "dependencies": {
        "System.Collections": "4.3.0",
        "System.Diagnostics.Debug": "4.3.0",
        "System.Diagnostics.Tracing": "4.3.0",
        "System.Globalization": "4.3.0",
        "System.Reflection": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Extensions": "4.3.0",
        "System.Threading": "4.3.0",
        "System.Threading.Tasks": "4.3.0"
      }
    },
    "System.Diagnostics.Debug": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "ZUhUOdqmaG5Jk3Xdb8xi5kIyQYAA4PnTNlHx1mu9ZY3qv4ELIdKbnL/akbGaKi2RnNUWaZsAs31rvzFdewTj2g==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.Runtime": "4.3.0"
      }
    },
    "System.Diagnostics.DiagnosticSource": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "frQDfv0rl209cKm1lnwTgFPzNigy2EKk1BS3uAvHvlBVKe5cymGyHO+Sj+NLv5VF/AhHsqPIUUwya5oV4CHMUw==",
      "dependencies": {
        "System.Runtime.CompilerServices.Unsafe": "6.0.0"
      }
    },
    "System.Diagnostics.EventLog": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "lcyUiXTsETK2ALsZrX+nWuHSIQeazhqPphLfaRxzdGaG93+0kELqpgEHtwWOlQe7+jSFnKwaCAgL4kjeZCQJnw=="
    },
    "System.Diagnostics.Tracing": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "rswfv0f/Cqkh78rA5S8eN8Neocz234+emGCtTF3lxPY96F+mmmUen6tbn0glN6PMvlKQb9bPAY5e9u7fgPTkKw==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.Runtime": "4.3.0"
      }
    },
    "System.Globalization": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "kYdVd2f2PAdFGblzFswE4hkNANJBKRmsfa2X5LG2AcWE1c7/4t0pYae1L8vfZ5xvE2nK/R9JprtToA61OSHWIg==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.Runtime": "4.3.0"
      }
    },
    "System.Globalization.Calendars": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "GUlBtdOWT4LTV3I+9/PJW+56AnnChTaOqqTLFtdmype/L500M2LIyXgmtd9X2P2VOkmJd5c67H5SaC2QcL1bFA==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.Globalization": "4.3.0",
        "System.Runtime": "4.3.0"
      }
    },
    "System.Globalization.Extensions": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "FhKmdR6MPG+pxow6wGtNAWdZh7noIOpdD5TwQ3CprzgIE1bBBoim0vbR1+AWsWjQmU7zXHgQo4TWSP6lCeiWcQ==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "System.Globalization": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Extensions": "4.3.0",
        "System.Runtime.InteropServices": "4.3.0"
      }
    },
    "System.IO": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "3qjaHvxQPDpSOYICjUoTsmoq5u6QJAFRUITgeT/4gqkF1bajbSmb1kwSxEA8AHlofqgcKJcM8udgieRNhaJ5Cg==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.Runtime": "4.3.0",
        "System.Text.Encoding": "4.3.0",
        "System.Threading.Tasks": "4.3.0"
      }
    },
    "System.IO.FileSystem": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "3wEMARTnuio+ulnvi+hkRNROYwa1kylvYahhcLk4HSoVdl+xxTFVeVlYOfLwrDPImGls0mDqbMhrza8qnWPTdA==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.IO": "4.3.0",
        "System.IO.FileSystem.Primitives": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Handles": "4.3.0",
        "System.Text.Encoding": "4.3.0",
        "System.Threading.Tasks": "4.3.0"
      }
    },
    "System.IO.FileSystem.Primitives": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "6QOb2XFLch7bEc4lIcJH49nJN2HV+OC3fHDgsLVsBVBk3Y4hFAnOBGzJ2lUu7CyDDFo9IBWkSsnbkT6IBwwiMw==",
      "dependencies": {
        "System.Runtime": "4.3.0"
      }
    },
    "System.IO.Pipelines": {
      "type": "Transitive",
      "resolved": "6.0.3",
      "contentHash": "ryTgF+iFkpGZY1vRQhfCzX0xTdlV3pyaTTqRu2ETbEv+HlV7O6y7hyQURnghNIXvctl5DuZ//Dpks6HdL/Txgw=="
    },
    "System.IO.Pipes": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "wpGJuACA6r8+KRckXoI6ghGTwgPRiICI6T7kgHI/m7S5eMqV/8jH37fzAUhTwIe9RwlH/j1sWwm2Q2zyXwZGHw==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "System.Buffers": "4.3.0",
        "System.Diagnostics.Debug": "4.3.0",
        "System.IO": "4.3.0",
        "System.IO.FileSystem.Primitives": "4.3.0",
        "System.Net.Primitives": "4.3.0",
        "System.Net.Sockets": "4.3.0",
        "System.Reflection": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Extensions": "4.3.0",
        "System.Runtime.Handles": "4.3.0",
        "System.Runtime.InteropServices": "4.3.0",
        "System.Security.Principal": "4.3.0",
        "System.Text.Encoding": "4.3.0",
        "System.Threading": "4.3.0",
        "System.Threading.Overlapped": "4.3.0",
        "System.Threading.Tasks": "4.3.0",
        "runtime.native.System": "4.3.0"
      }
    },
    "System.IO.Pipes.AccessControl": {
      "type": "Transitive",
      "resolved": "5.0.0",
      "contentHash": "P0FIsXSFNL1AXlHO9zpJ9atRUzVyoPZCkcbkYGZfXXMx9xlGA2H3HOGBwIhpKhB+h0eL3hry/z0UcfJZ+yb2kQ==",
      "dependencies": {
        "System.Security.AccessControl": "5.0.0",
        "System.Security.Principal.Windows": "5.0.0"
      }
    },
    "System.Linq": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "5DbqIUpsDp0dFftytzuMmc0oeMdQwjcP/EWxsksIz/w1TcFRkZ3yKKz0PqiYFMmEwPSWw+qNVqD7PJ889JzHbw==",
      "dependencies": {
        "System.Collections": "4.3.0",
        "System.Diagnostics.Debug": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Extensions": "4.3.0"
      }
    },
    "System.Net.Http.WinHttpHandler": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "jubNN9jH4NzVrvEf4fGwESLBsfH8whWNbHMhgM6IwA8UCt6+/M19bbOHc21JhigvC2HQKCl8HKGZMcBtIpzqIg=="
    },
    "System.Net.NameResolution": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "AFYl08R7MrsrEjqpQWTZWBadqXyTzNDaWpMqyxhb0d6sGhV6xMDKueuBXlLL30gz+DIRY6MpdgnHWlCh5wmq9w==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "System.Collections": "4.3.0",
        "System.Diagnostics.Tracing": "4.3.0",
        "System.Globalization": "4.3.0",
        "System.Net.Primitives": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Extensions": "4.3.0",
        "System.Runtime.Handles": "4.3.0",
        "System.Runtime.InteropServices": "4.3.0",
        "System.Security.Principal.Windows": "4.3.0",
        "System.Threading": "4.3.0",
        "System.Threading.Tasks": "4.3.0",
        "runtime.native.System": "4.3.0"
      }
    },
    "System.Net.Primitives": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "qOu+hDwFwoZPbzPvwut2qATe3ygjeQBDQj91xlsaqGFQUI5i4ZnZb8yyQuLGpDGivEPIt8EJkd1BVzVoP31FXA==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Handles": "4.3.0"
      }
    },
    "System.Net.Requests": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "OZNUuAs0kDXUzm7U5NZ1ojVta5YFZmgT2yxBqsQ7Eseq5Ahz88LInGRuNLJ/NP2F8W1q7tse1pKDthj3reF5QA==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "System.Collections": "4.3.0",
        "System.Diagnostics.Debug": "4.3.0",
        "System.Diagnostics.Tracing": "4.3.0",
        "System.Globalization": "4.3.0",
        "System.IO": "4.3.0",
        "System.Net.Http": "4.3.0",
        "System.Net.Primitives": "4.3.0",
        "System.Net.WebHeaderCollection": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Threading": "4.3.0",
        "System.Threading.Tasks": "4.3.0"
      }
    },
    "System.Net.Security": {
      "type": "Transitive",
      "resolved": "4.3.2",
      "contentHash": "xT2jbYpbBo3ha87rViHoTA6WdvqOAW37drmqyx/6LD8p7HEPT2qgdxoimRzWtPg8Jh4X5G9BV2seeTv4x6FYlA==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.Win32.Primitives": "4.3.0",
        "System.Collections": "4.3.0",
        "System.Collections.Concurrent": "4.3.0",
        "System.Diagnostics.Tracing": "4.3.0",
        "System.Globalization": "4.3.0",
        "System.Globalization.Extensions": "4.3.0",
        "System.IO": "4.3.0",
        "System.Net.Primitives": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Extensions": "4.3.0",
        "System.Runtime.Handles": "4.3.0",
        "System.Runtime.InteropServices": "4.3.0",
        "System.Security.Claims": "4.3.0",
        "System.Security.Cryptography.Algorithms": "4.3.0",
        "System.Security.Cryptography.Encoding": "4.3.0",
        "System.Security.Cryptography.OpenSsl": "4.3.0",
        "System.Security.Cryptography.Primitives": "4.3.0",
        "System.Security.Cryptography.X509Certificates": "4.3.0",
        "System.Security.Principal": "4.3.0",
        "System.Text.Encoding": "4.3.0",
        "System.Threading": "4.3.0",
        "System.Threading.Tasks": "4.3.0",
        "System.Threading.ThreadPool": "4.3.0",
        "runtime.native.System": "4.3.0",
        "runtime.native.System.Net.Security": "4.3.0",
        "runtime.native.System.Security.Cryptography.OpenSsl": "4.3.2"
      }
    },
    "System.Net.Sockets": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "m6icV6TqQOAdgt5N/9I5KNpjom/5NFtkmGseEH+AK/hny8XrytLH3+b5M8zL/Ycg3fhIocFpUMyl/wpFnVRvdw==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.IO": "4.3.0",
        "System.Net.Primitives": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Threading.Tasks": "4.3.0"
      }
    },
    "System.Net.WebHeaderCollection": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "XZrXYG3c7QV/GpWeoaRC02rM6LH2JJetfVYskf35wdC/w2fFDFMphec4gmVH2dkll6abtW14u9Rt96pxd9YH2A==",
      "dependencies": {
        "System.Collections": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Extensions": "4.3.0"
      }
    },
    "System.Reflection": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "KMiAFoW7MfJGa9nDFNcfu+FpEdiHpWgTcS2HdMpDvt9saK3y/G4GwprPyzqjFH9NTaGPQeWNHU+iDlDILj96aQ==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.IO": "4.3.0",
        "System.Reflection.Primitives": "4.3.0",
        "System.Runtime": "4.3.0"
      }
    },
    "System.Reflection.Primitives": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "5RXItQz5As4xN2/YUDxdpsEkMhvw3e6aNveFXUn4Hl/udNTCNhnKp8lT9fnc3MhvGKh1baak5CovpuQUXHAlIA==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.Runtime": "4.3.0"
      }
    },
    "System.Resources.ResourceManager": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "/zrcPkkWdZmI4F92gL/TPumP98AVDu/Wxr3CSJGQQ+XN6wbRZcyfSKVoPo17ilb3iOr0cCRqJInGwNMolqhS8A==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.Globalization": "4.3.0",
        "System.Reflection": "4.3.0",
        "System.Runtime": "4.3.0"
      }
    },
    "System.Runtime": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "JufQi0vPQ0xGnAczR13AUFglDyVYt4Kqnz1AZaiKZ5+GICq0/1MH/mO/eAJHt/mHW1zjKBJd7kV26SrxddAhiw==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0"
      }
    },
    "System.Runtime.CompilerServices.Unsafe": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "/iUeP3tq1S0XdNNoMz5C9twLSrM/TH+qElHkXWaPvuNOt+99G75NrV0OS2EqHx5wMN7popYjpc8oTjC1y16DLg=="
    },
    "System.Runtime.Extensions": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "guW0uK0fn5fcJJ1tJVXYd7/1h5F+pea1r7FLSOz/f8vPEqbR2ZAknuRDvTQ8PzAilDveOxNjSfr0CHfIQfFk8g==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.Runtime": "4.3.0"
      }
    },
    "System.Runtime.Handles": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "OKiSUN7DmTWeYb3l51A7EYaeNMnvxwE249YtZz7yooT4gOZhmTjIn48KgSsw2k2lYdLgTKNJw/ZIfSElwDRVgg==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.Runtime": "4.3.0"
      }
    },
    "System.Runtime.InteropServices": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "uv1ynXqiMK8mp1GM3jDqPCFN66eJ5w5XNomaK2XD+TuCroNTLFGeZ+WCmBMcBDyTFKou3P6cR6J/QsaqDp7fGQ==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.Reflection": "4.3.0",
        "System.Reflection.Primitives": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Handles": "4.3.0"
      }
    },
    "System.Runtime.Numerics": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "yMH+MfdzHjy17l2KESnPiF2dwq7T+xLnSJar7slyimAkUh/gTrS9/UQOtv7xarskJ2/XDSNvfLGOBQPjL7PaHQ==",
      "dependencies": {
        "System.Globalization": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Extensions": "4.3.0"
      }
    },
    "System.Security.AccessControl": {
      "type": "Transitive",
      "resolved": "5.0.0",
      "contentHash": "dagJ1mHZO3Ani8GH0PHpPEe/oYO+rVdbQjvjJkBRNQkX4t0r1iaeGn8+/ybkSLEan3/slM0t59SVdHzuHf2jmw==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "5.0.0",
        "System.Security.Principal.Windows": "5.0.0"
      }
    },
    "System.Security.Claims": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "P/+BR/2lnc4PNDHt/TPBAWHVMLMRHsyYZbU1NphW4HIWzCggz8mJbTQQ3MKljFE7LS3WagmVFuBgoLcFzYXlkA==",
      "dependencies": {
        "System.Collections": "4.3.0",
        "System.Globalization": "4.3.0",
        "System.IO": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Extensions": "4.3.0",
        "System.Security.Principal": "4.3.0"
      }
    },
    "System.Security.Cryptography.Algorithms": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "W1kd2Y8mYSCgc3ULTAZ0hOP2dSdG5YauTb1089T0/kRcN2MpSAW1izOFROrJgxSlMn3ArsgHXagigyi+ibhevg==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "System.Collections": "4.3.0",
        "System.IO": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Extensions": "4.3.0",
        "System.Runtime.Handles": "4.3.0",
        "System.Runtime.InteropServices": "4.3.0",
        "System.Runtime.Numerics": "4.3.0",
        "System.Security.Cryptography.Encoding": "4.3.0",
        "System.Security.Cryptography.Primitives": "4.3.0",
        "System.Text.Encoding": "4.3.0",
        "runtime.native.System.Security.Cryptography.Apple": "4.3.0",
        "runtime.native.System.Security.Cryptography.OpenSsl": "4.3.0"
      }
    },
    "System.Security.Cryptography.Cng": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "03idZOqFlsKRL4W+LuCpJ6dBYDUWReug6lZjBa3uJWnk5sPCUXckocevTaUA8iT/MFSrY/2HXkOt753xQ/cf8g==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "System.IO": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Extensions": "4.3.0",
        "System.Runtime.Handles": "4.3.0",
        "System.Runtime.InteropServices": "4.3.0",
        "System.Security.Cryptography.Algorithms": "4.3.0",
        "System.Security.Cryptography.Encoding": "4.3.0",
        "System.Security.Cryptography.Primitives": "4.3.0",
        "System.Text.Encoding": "4.3.0"
      }
    },
    "System.Security.Cryptography.Csp": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "X4s/FCkEUnRGnwR3aSfVIkldBmtURMhmexALNTwpjklzxWU7yjMk7GHLKOZTNkgnWnE0q7+BCf9N2LVRWxewaA==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "System.IO": "4.3.0",
        "System.Reflection": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Extensions": "4.3.0",
        "System.Runtime.Handles": "4.3.0",
        "System.Runtime.InteropServices": "4.3.0",
        "System.Security.Cryptography.Algorithms": "4.3.0",
        "System.Security.Cryptography.Encoding": "4.3.0",
        "System.Security.Cryptography.Primitives": "4.3.0",
        "System.Text.Encoding": "4.3.0",
        "System.Threading": "4.3.0"
      }
    },
    "System.Security.Cryptography.Encoding": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "1DEWjZZly9ae9C79vFwqaO5kaOlI5q+3/55ohmq/7dpDyDfc8lYe7YVxJUZ5MF/NtbkRjwFRo14yM4OEo9EmDw==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "System.Collections": "4.3.0",
        "System.Collections.Concurrent": "4.3.0",
        "System.Linq": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Extensions": "4.3.0",
        "System.Runtime.Handles": "4.3.0",
        "System.Runtime.InteropServices": "4.3.0",
        "System.Security.Cryptography.Primitives": "4.3.0",
        "System.Text.Encoding": "4.3.0",
        "runtime.native.System.Security.Cryptography.OpenSsl": "4.3.0"
      }
    },
    "System.Security.Cryptography.OpenSsl": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "h4CEgOgv5PKVF/HwaHzJRiVboL2THYCou97zpmhjghx5frc7fIvlkY1jL+lnIQyChrJDMNEXS6r7byGif8Cy4w==",
      "dependencies": {
        "System.Collections": "4.3.0",
        "System.IO": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Extensions": "4.3.0",
        "System.Runtime.Handles": "4.3.0",
        "System.Runtime.InteropServices": "4.3.0",
        "System.Runtime.Numerics": "4.3.0",
        "System.Security.Cryptography.Algorithms": "4.3.0",
        "System.Security.Cryptography.Encoding": "4.3.0",
        "System.Security.Cryptography.Primitives": "4.3.0",
        "System.Text.Encoding": "4.3.0",
        "runtime.native.System.Security.Cryptography.OpenSsl": "4.3.0"
      }
    },
    "System.Security.Cryptography.Primitives": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "7bDIyVFNL/xKeFHjhobUAQqSpJq9YTOpbEs6mR233Et01STBMXNAc/V+BM6dwYGc95gVh/Zf+iVXWzj3mE8DWg==",
      "dependencies": {
        "System.Diagnostics.Debug": "4.3.0",
        "System.Globalization": "4.3.0",
        "System.IO": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Threading": "4.3.0",
        "System.Threading.Tasks": "4.3.0"
      }
    },
    "System.Security.Cryptography.X509Certificates": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "t2Tmu6Y2NtJ2um0RtcuhP7ZdNNxXEgUm2JeoA/0NvlMjAhKCnM1NX07TDl3244mVp3QU6LPEhT3HTtH1uF7IYw==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "System.Collections": "4.3.0",
        "System.Diagnostics.Debug": "4.3.0",
        "System.Globalization": "4.3.0",
        "System.Globalization.Calendars": "4.3.0",
        "System.IO": "4.3.0",
        "System.IO.FileSystem": "4.3.0",
        "System.IO.FileSystem.Primitives": "4.3.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Extensions": "4.3.0",
        "System.Runtime.Handles": "4.3.0",
        "System.Runtime.InteropServices": "4.3.0",
        "System.Runtime.Numerics": "4.3.0",
        "System.Security.Cryptography.Algorithms": "4.3.0",
        "System.Security.Cryptography.Cng": "4.3.0",
        "System.Security.Cryptography.Csp": "4.3.0",
        "System.Security.Cryptography.Encoding": "4.3.0",
        "System.Security.Cryptography.OpenSsl": "4.3.0",
        "System.Security.Cryptography.Primitives": "4.3.0",
        "System.Text.Encoding": "4.3.0",
        "System.Threading": "4.3.0",
        "runtime.native.System": "4.3.0",
        "runtime.native.System.Net.Http": "4.3.0",
        "runtime.native.System.Security.Cryptography.OpenSsl": "4.3.0"
      }
    },
    "System.Security.Principal": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "I1tkfQlAoMM2URscUtpcRo/hX0jinXx6a/KUtEQoz3owaYwl3qwsO8cbzYVVnjxrzxjHo3nJC+62uolgeGIS9A==",
      "dependencies": {
        "System.Runtime": "4.3.0"
      }
    },
    "System.Security.Principal.Windows": {
      "type": "Transitive",
      "resolved": "5.0.0",
      "contentHash": "t0MGLukB5WAVU9bO3MGzvlGnyJPgUlcwerXn1kzBRjwLKixT96XV0Uza41W49gVd8zEMFu9vQEFlv0IOrytICA=="
    },
    "System.Text.Encoding": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "BiIg+KWaSDOITze6jGQynxg64naAPtqGHBwDrLaCtixsa5bKiR8dpPOHA7ge3C0JJQizJE+sfkz1wV+BAKAYZw==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.Runtime": "4.3.0"
      }
    },
    "System.Text.Encodings.Web": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "Vg8eB5Tawm1IFqj4TVK1czJX89rhFxJo9ELqc/Eiq0eXy13RK00eubyU6TJE6y+GQXjyV5gSfiewDUZjQgSE0w==",
      "dependencies": {
        "System.Runtime.CompilerServices.Unsafe": "6.0.0"
      }
    },
    "System.Text.Json": {
      "type": "Transitive",
      "resolved": "6.0.0",
      "contentHash": "zaJsHfESQvJ11vbXnNlkrR46IaMULk/gHxYsJphzSF+07kTjPHv+Oc14w6QEOfo3Q4hqLJgStUaYB9DBl0TmWg==",
      "dependencies": {
        "System.Runtime.CompilerServices.Unsafe": "6.0.0",
        "System.Text.Encodings.Web": "6.0.0"
      }
    },
    "System.Threading": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "VkUS0kOBcUf3Wwm0TSbrevDDZ6BlM+b/HRiapRFWjM5O0NS0LviG0glKmFK+hhPDd1XFeSdU1GmlLhb2CoVpIw==",
      "dependencies": {
        "System.Runtime": "4.3.0",
        "System.Threading.Tasks": "4.3.0"
      }
    },
    "System.Threading.Overlapped": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "m3HQ2dPiX/DSTpf+yJt8B0c+SRvzfqAJKx+QDWi+VLhz8svLT23MVjEOHPF/KiSLeArKU/iHescrbLd3yVgyNg==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "System.Resources.ResourceManager": "4.3.0",
        "System.Runtime": "4.3.0",
        "System.Runtime.Handles": "4.3.0"
      }
    },
    "System.Threading.Tasks": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "LbSxKEdOUhVe8BezB/9uOGGppt+nZf6e1VFyw6v3DN6lqitm0OSn2uXMOdtP0M3W4iMcqcivm2J6UgqiwwnXiA==",
      "dependencies": {
        "Microsoft.NETCore.Platforms": "1.1.0",
        "Microsoft.NETCore.Targets": "1.1.0",
        "System.Runtime": "4.3.0"
      }
    },
    "System.Threading.Tasks.Extensions": {
      "type": "Transitive",
      "resolved": "4.5.4",
      "contentHash": "zteT+G8xuGu6mS+mzDzYXbzS7rd3K6Fjb9RiZlYlJPam2/hU7JCBZBVEcywNuR+oZ1ncTvc/cq0faRr3P01OVg=="
    },
    "System.Threading.ThreadPool": {
      "type": "Transitive",
      "resolved": "4.3.0",
      "contentHash": "k/+g4b7vjdd4aix83sTgC9VG6oXYKAktSfNIJUNGxPEj7ryEOfzHHhfnmsZvjxawwcD9HyWXKCXmPjX8U4zeSw==",
      "dependencies": {
        "System.Runtime": "4.3.0",
        "System.Runtime.Handles": "4.3.0"
      }
    },
    "vtbf.common.logging.nlog": {
      "type": "Project",
      "dependencies": {
        "NLog": "[5.1.3, )",
        "NLog.Web.AspNetCore": "[5.2.3, )"
      }
    }
  }
}
}

0 replies

DmitriyLewen · 2023-04-20T05:05:01Z

DmitriyLewen
Apr 20, 2023
Maintainer

Hello @cspwizard
Thanks for your report!

What version of Trivy were you using?
v0.40.0 only finds 6.0.0 version in your packages.lock.json:

What version of Trivy are you using?
v0.40.0 only finds version 6.0.0 in your packages.lock.json:

trivy -d fs -f json --list-all-pkgs . | grep '"Name": "System.Text.Encodings.Web"' -B 1 -A 1
          "ID": "System.Text.Encodings.Web@6.0.0",
          "Name": "System.Text.Encodings.Web",
          "Version": "6.0.0",

0 replies

cspwizard · 2023-04-20T09:02:24Z

cspwizard
Apr 20, 2023

@DmitriyLewen Hi! Thanks for a quick reply!

Version: 0.40.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-04-20 06:09:18.54061127 +0000 UTC
  NextUpdate: 2023-04-20 12:09:18.54061107 +0000 UTC
  DownloadedAt: 2023-04-20 08:35:09.300644769 +0000 UTC

I've triple checked and it appears that problem is in bin/Debug/net6.0/<project>.deps.json file, not in packages.lock.json, but I'm not sure why it is checked anyway? If I delete those deps.json files it works as expected

0 replies

DmitriyLewen · 2023-04-20T09:27:56Z

DmitriyLewen
Apr 20, 2023
Maintainer

Trivy parses nuget files separately.
That is why Trivy found System.Text.Encodings.Web@4.5.0.

There are questions about nuget files(you can see that in this issue).
I don't know why your .deps.json and packages.lock.json files have different deps.

0 replies

cspwizard · 2023-04-20T09:32:00Z

cspwizard
Apr 20, 2023

They have different version because we've updated to net7, and that debug folder is not updated, neither cleaned by dotnet clean ...

0 replies

DmitriyLewen · 2023-04-20T09:37:39Z

DmitriyLewen
Apr 20, 2023
Maintainer

You can skip this dir, if you can't remove it(if it will break your project or something else)

0 replies

Belorus · 2023-11-20T10:18:57Z

Belorus
Nov 20, 2023

Same here.
.NET8

If i build app locally on mac - i don't see System.Private.Uri anywhere (text search against all files in repo after build doesn't give anything)
But if i build it in docker for linux runtime - it appears out of nowhere

1 reply

DmitriyLewen Nov 20, 2023
Maintainer

it is strange. But looks like it is .NET bug

StasJS · 2023-11-30T22:44:20Z

StasJS
Nov 30, 2023

I've tried to create a minimal example to try and highlight the flaw in Trivy's current approach to interpreting the *.deps.json file
https://github.com/StasJS/TrivyDepsFalsePositive/tree/master

I really appreciate the engagement you are providing in this thread @DmitriyLewen, but I would really like to see some action come out of all the bitsy conversation. I hope my minimal example can spark more tangible discussion that leads to a clear view of the problem at hand, what misunderstanding exists, and steps forward.

0 replies

ericstj · 2024-03-18T16:22:24Z

ericstj
Mar 18, 2024

One suggestion that might help here - .NET has a model where packages can be superseded by the .NET runtime itself or other packages called "conflict resolution". When this happens the package name will still appear in the application's deps.json file, but the entry under targets will have no runtime, native, nor runtimeTargets sections - which means the host will not load it at all. When one of these assets is determined as "conflicting" with another package, or the runtime itself, it will be removed by removing each applicable asset that overlaps with the "better" one. When this removal happens the file is omitted from the output and it's entry is removed from the targets section.

You can see the explanation of how the .NET host uses the targets section here: https://github.com/dotnet/sdk/blob/main/documentation/specs/runtime-configuration-file.md#targets-section-depsjson

Today it looks to me like trivy reads the libraries section of the deps file. https://github.com/dotnet/sdk/blob/main/documentation/specs/runtime-configuration-file.md#libraries-section-depsjson
This section isn't used by the .NET host at runtime. This is a catalog of the package content that was referenced at build time and not what was deployed.

I think the fix here would be for trivy to read the targets section instead of the libraries section. It could consider a package as applicable if the package provided any content in the targets section.

1 reply

ericstj Apr 23, 2024

@knqyf263 would you consider a change as described above?

NET6 CVE-2019-0980 CVE-2019-0981 - possible bug in .deps.json trans deps resolution #4282

Replies: 47 comments · 2 replies

jkone27 Aug 15, 2022 Author

jkone27 Sep 13, 2022 Author

DmitriyLewen Nov 3, 2022 Maintainer

DmitriyLewen Nov 7, 2022 Maintainer

DmitriyLewen Nov 10, 2022 Maintainer

DmitriyLewen Nov 11, 2022 Maintainer

DmitriyLewen Nov 11, 2022 Maintainer

jkone27 Nov 23, 2022 Author

DmitriyLewen Nov 24, 2022 Maintainer

github-actions[bot] bot Feb 8, 2023

DmitriyLewen Mar 6, 2023 Maintainer

DmitriyLewen Apr 20, 2023 Maintainer

DmitriyLewen Apr 20, 2023 Maintainer

DmitriyLewen Apr 20, 2023 Maintainer

DmitriyLewen Nov 20, 2023 Maintainer

Replies: 47 comments 2 replies

jkone27
Aug 15, 2022
Author

jkone27
Sep 13, 2022
Author

DmitriyLewen
Nov 3, 2022
Maintainer

DmitriyLewen
Nov 7, 2022
Maintainer

DmitriyLewen
Nov 10, 2022
Maintainer

DmitriyLewen
Nov 11, 2022
Maintainer

DmitriyLewen
Nov 11, 2022
Maintainer

jkone27
Nov 23, 2022
Author

DmitriyLewen
Nov 24, 2022
Maintainer

github-actions[bot]
bot Feb 8, 2023

DmitriyLewen
Mar 6, 2023
Maintainer

DmitriyLewen
Apr 20, 2023
Maintainer

DmitriyLewen
Apr 20, 2023
Maintainer

DmitriyLewen
Apr 20, 2023
Maintainer

DmitriyLewen Nov 20, 2023
Maintainer