ITADN

aspnet-runtime:latest Incorrectly Reports .NET 10.0.0 but Contains .NET 7.0.20

#3033Closedpayerset-ag 创建于 2025-11-17
needs-triage
P
payerset-agcommented
### Which image/versions are related to this issue/feature request? - **Image**: `cgr.dev/chainguard/aspnet-runtime:latest` - **Multi-arch Index SHA**: `sha256:ab70fb7027ac2e0fb31dcfa4d2611ad3ed3e4aab8f1247a4fdcde208d392aefe` - **AMD64 Manifest SHA**: `sha256:f2bec2f4ed7f87675fcb54fc415d134beef29ffbfa90d9f18bcfea597572addf` - **Verification Date**: 2025-11-17 - This does **_NOT_** appear to impact the `cgr.dev/chainguard/dotnet-runtime` which reports the correct version in the SBOM ### Issue/Feature description The `cgr.dev/chainguard/aspnet-runtime:latest` image has a mismatch between its `DOTNET_VERSION` and `ASPNET_VERSION` environment variable (which reports 10.0.0) and the actual installed runtime (which is 7.0.20). This causes .NET 10 applications to fail at runtime with "Framework not found" errors. ``` $ cosign download attestation --platform linux/amd64 cgr.dev/chainguard/aspnet-runtime:latest | \ jq -r '.payload' | base64 -d | \ jq '.predicate.packages[] | select(.name | contains("dotnet") or contains("aspnet"))' ``` ``` { "name": "dotnet-7", "versionInfo": "7.0.120-r3" } { "name": "dotnet-7-runtime", "versionInfo": "7.0.120-r3" } { "name": "aspnet-7-runtime", "versionInfo": "7.0.120-r3" } { "name": "aspnet-7-runtime-default", "versionInfo": "7.0.120-r3" } ```
关闭于 2025-11-21 10 条评论