Re:Excellent succinct breakdown of the xz mess, from an Open...
by neonsunset on Friday April 05, 2024 @04:12PM
(#39946642)
In .NET specifically it's not an issue because taking on a dependency means you always get the source code in the form of IL assemblies with (usually) symbols (either way these trivially decompile back to readable-ish C#).
The actual final product you get is when publishing (building) the application itself, similar to Rust the way crates participate in the build process.
Nuget packages still can and do ship pre-compiled native dependencies but ideally you want to either provide your own (think sourcing libsodium separately and just getting the bindings from nuget) or instrument the corresponding .NET project to build a native dependency alongside it (very easy with <Exec Command="..." /> properties in csproj).
The actual final product you get is when publishing (building) the application itself, similar to Rust the way crates participate in the build process.
Nuget packages still can and do ship pre-compiled native dependencies but ideally you want to either provide your own (think sourcing libsodium separately and just getting the bindings from nuget) or instrument the corresponding .NET project to build a native dependency alongside it (very easy with <Exec Command="..." /> properties in csproj).