UE 5.6.1 build failure on VS2022 due to NugetAudit warnings treated as errors

[george-zubrienko]

Hi :)

I've been trying to build myself an UE windows container to ship test builds for Windows testers - UE4 Docker is the savior. However, MS strikes again! My build of 5.6.1 engine with 2022 VS consistently failed at AutomationTool build. After some digging I found that this is due to relatively new enforcement of security audit during Nuget restore stage that also defaults to turning warnings into errors.

I cloned UE repo and tried to build it outside the container and got the same issue. After inspecting the logs I found that version of https://github.com/dlemstra/Magick.NET used by some UE components triggers security audit warnings (errors) and fails the build. I've modified the following project files:

• .\Engine\Source\Programs\AutomationTool\AutomationTool.csproj
• .\Engine\Source\Programs\AutomationTool\AutomationUtils\AutomationUtils.Automation.csproj
• .\Engine\Source\Programs\AutomationTool\Gauntlet\Gauntlet.Automation.csproj

with:

  <ItemGroup>
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3q9-fxm7-j8fq" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-fh55-q5pj-pxgw" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-6hgw-6x87-578x" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-qp29-wxp5-wh82" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-mxvv-97wh-cfmm" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-9pp9-cfwx-54rm" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-9ccg-6pjw-x645" />
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-cjc8-g9w8-chfw" />
  </ItemGroup>

and the engine is happily compiling now. I am wondering what is the best way to integrate this in ue4-docker - happy to contribute with some guidance.

Reference: https://learn.microsoft.com/en-us/nuget/concepts/auditing-packages

[Shevchenko-Alexander]

Same issue for the 5.6.0 branch with VS 2022

[slonopotamus]

You need these commits:

https://github.com/EpicGames/UnrealEngine/commit/467f8b31124c89b61c00ba73c26229897cafd7bd
https://github.com/EpicGames/UnrealEngine/commit/cdda65cecacd9a1278020925c357bf4cc0b17e8c

[Shevchenko-Alexander]

I took the dev-5.6 branch where these changes are already presented but unfortunately got the same result...

14.39 /home/ue4/UnrealEngine/Engine/Source/Programs/Shared/EpicGames.MsBuild/EpicGames.MsBuild.csproj : warning NU1903: Package 'Microsoft.Build' 17.11.4 has a known high severity vulnerability, GHSA-w3q9-fxm7-j8fq [/home/ue4/UnrealEngine/Engine/Source/Programs/AutomationTool/AutomationTool.csproj]
14.39 /home/ue4/UnrealEngine/Engine/Source/Programs/AutomationTool/AutomationTool.csproj : warning NU1902: Package 'Magick.NET-Q16-HDRI-AnyCPU' 14.8.1 has a known moderate severity vulnerability, GHSA-9pp9-cfwx-54rm
14.39 /home/ue4/UnrealEngine/Engine/Source/Programs/AutomationTool/AutomationTool.csproj : warning NU1903: Package 'Microsoft.Build' 17.11.4 has a known high severity vulnerability, GHSA-w3q9-fxm7-j8fq
14.39 /home/ue4/UnrealEngine/Engine/Source/Programs/AutomationTool/AutomationTool.csproj : warning NU1902: Package 'Magick.NET-Q16-HDRI-AnyCPU' 14.8.1 has a known moderate severity vulnerability, GHSA-9pp9-cfwx-54rm
14.39 /home/ue4/UnrealEngine/Engine/Source/Programs/AutomationTool/AutomationTool.csproj : warning NU1903: Package 'Microsoft.Build' 17.11.4 has a known high severity vulnerability, GHSA-w3q9-fxm7-j8fq
14.39 /home/ue4/UnrealEngine/Engine/Source/Programs/Shared/EpicGames.MsBuild/EpicGames.MsBuild.csproj : warning NU1903: Package 'Microsoft.Build' 17.11.4 has a known high severity vulnerability, GHSA-w3q9-fxm7-j8fq