aspnet-runtime:latest Incorrectly Reports .NET 10.0.0 but Contains .NET 7.0.20
needs-triage
### Which image/versions are related to this issue/feature request?
- **Image**: `cgr.dev/chainguard/aspnet-runtime:latest`
- **Multi-arch Index SHA**: `sha256:ab70fb7027ac2e0fb31dcfa4d2611ad3ed3e4aab8f1247a4fdcde208d392aefe`
- **AMD64 Manifest SHA**: `sha256:f2bec2f4ed7f87675fcb54fc415d134beef29ffbfa90d9f18bcfea597572addf`
- **Verification Date**: 2025-11-17
- This does **_NOT_** appear to impact the `cgr.dev/chainguard/dotnet-runtime` which reports the correct version in the SBOM
### Issue/Feature description
The `cgr.dev/chainguard/aspnet-runtime:latest` image has a mismatch between its `DOTNET_VERSION` and `ASPNET_VERSION` environment variable (which reports 10.0.0) and the actual installed runtime (which is 7.0.20). This causes .NET 10 applications to fail at runtime with "Framework not found" errors.
```
$ cosign download attestation --platform linux/amd64 cgr.dev/chainguard/aspnet-runtime:latest | \
jq -r '.payload' | base64 -d | \
jq '.predicate.packages[] | select(.name | contains("dotnet") or contains("aspnet"))'
```
```
{
"name": "dotnet-7",
"versionInfo": "7.0.120-r3"
}
{
"name": "dotnet-7-runtime",
"versionInfo": "7.0.120-r3"
}
{
"name": "aspnet-7-runtime",
"versionInfo": "7.0.120-r3"
}
{
"name": "aspnet-7-runtime-default",
"versionInfo": "7.0.120-r3"
}
```
关闭于 2025-11-21 10 条评论