Microsoft Announces Critical Change to .NET Installer Distribution Domains

Microsoft’s .NET team, led by Product Manager Richard Lander, has announced a major change in how .NET installers and archives are distributed. This unexpected update, necessitated by the imminent shutdown of one of Microsoft’s Content Delivery Network (CDN) providers, edg.io, could impact developers, CI/CD pipelines, and production environments. While Microsoft assures that most users will not face disruptions, it is imperative for all stakeholders to validate their exposure and prepare for potential outages.

The affected domains, dotnetcli.azureedge.net and dotnetbuilds.azureedge.net, are hosted by edg.io, which is ceasing operations due to bankruptcy. According to the announcement, “It is possible that azureedge.net domains will have downtime in the near-term. We expect that these domains will be permanently retired in the first few months of 2025.” To ensure uninterrupted access to .NET resources, Microsoft has migrated its distribution to new domains:

• Official builds: builds.dotnet.microsoft.com
• CI builds: ci.dot.net

Microsoft has implemented several measures to minimize disruptions and streamline the transition for users:

1. Updated Installation Scripts
   The dotnet-install script now defaults to the new domains, ensuring compatibility and reliability. “The install script now uses the new domains,” the team noted, emphasizing that the changes are already reflected in official script locations.
2. GitHub Actions and Azure DevOps Updates
   Popular CI tools like GitHub Actions have been updated to point to the new domains, with further updates planned for Azure DevOps in January 2025. Microsoft is prioritizing infrastructure updates to mitigate downtime risks.
3. Traffic Management
   To ensure a smooth transition, Microsoft is leveraging Azure Traffic Manager to split traffic between the old and new domains while maintaining operational reliability during the migration.

Microsoft urges all users to take immediate action to avoid disruptions:

1. Audit Your Code and Scripts
   Search for references to the affected domains (dotnetcli.azureedge.net, dotnetbuilds.azureedge.net) and replace them with the new domains. The team also recommends checking for uses of dotnetcli.blob.core.windows.net, though this domain is unaffected, for performance improvements.
2. Update Installers and Scripts
   Ensure you’re using the latest versions of installation scripts, GitHub Actions, and Azure DevOps Tasks. Copies of older scripts in your infrastructure must be replaced with updated ones.
3. Check Firewall Rules
   Validate that firewall rules allow access to the new CDNs to prevent connectivity issues.
4. Stay Informed
   Keep track of updates on dotnet/core #9671, where Microsoft is maintaining the most up-to-date status.

Microsoft acknowledged the timing and impact of this change, stating, “We are sorry that we are making changes that affect running infrastructure and asking you to react to them during a holiday period.” The team emphasized that the need for these changes was unexpected, and they are working to ensure the smoothest possible transition.

Microsoft is committed to improving public documentation for .NET installation-related resources to enhance reliability, security, and productivity. “With every crisis, there are opportunities for learning,” Lander said, adding that new documentation will be a focus in the new year.

Related Posts:

• Researchers Detail CVE-2024-38014 0-Day Vulnerability in Windows MSI Installers Exploited in the Wild
• Malicious KMSPico installers is stealing users’ encrypted wallets
• FakeBat Malware Surge Exposes the Dangers of Evolving Malvertising Campaigns
• New Malvertising Campaign Leads to Ransomware Through Trojanized Installers of WinSCP and PuTTY