From 763d34b15c9bfc2a5bc99a91894561fb8b4d68bf Mon Sep 17 00:00:00 2001
From: Vikash Yadav <95463767+v-viyada@users.noreply.github.com>
Date: Fri, 29 Nov 2024 22:34:46 -0500
Subject: [PATCH] chore: update binskim to optout 4.3.1 version (#1077)

This is new pre release version used in 1ES pipeline templates. But our
TSA upload task still uses the older version (1.9.5) so this conflict is
resulting into pipeline failure.

For now updating pipeline to optout for new version.

There will be separate work item to update binskim to 4.3.1 version as
new rules in 4.3.1 might discover issues which also need to be resolved
so that pipeline does not break.

Co-authored-by: Bill Dengler <codeofdusk@gmail.com>
---
 build/signedbuild.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/build/signedbuild.yml b/build/signedbuild.yml
index 2e64c2ac6..bd2b924ca 100644
--- a/build/signedbuild.yml
+++ b/build/signedbuild.yml
@@ -34,6 +34,8 @@ extends:
       name: MSEngSS-MicroBuild2022-1ES
     sdl:
       binskim:
+        # #1077: Hold BinSkim back at 4.3.1 to resolve a pipeline incompatibility
+        preReleaseVersion: ''
         # If you modify this list, you also need to modify the list in the Run BinSkim task in Signed Release Job or vice-versa to keep them in sync
         analyzeTargetGlob: "$(System.DefaultWorkingDirectory)\\src\\CI\\bin\\**\\*.dll;\
                             $(System.DefaultWorkingDirectory)\\src\\Actions\\bin\\**\\*.dll;\