Update to .NET SDK 8.0.128 and Runtime 8.0.28

Resolves: RHEL-181054

.gitignore

@@ -72,3 +72,5 @@
 /dotnet-8.0.126.tar.gz.sig
 /dotnet-8.0.127.tar.gz
 /dotnet-8.0.127.tar.gz.sig
+/dotnet-8.0.128.tar.gz
+/dotnet-8.0.128.tar.gz.sig

dotnet8.0.spec

@@ -12,16 +12,16 @@
 # dotnet-host and netstandard-targeting-pack-2.1
 %global is_latest_dotnet 0
 
-%global host_version 8.0.27
-%global runtime_version 8.0.27
-%global aspnetcore_runtime_version 8.0.27
-%global sdk_version 8.0.127
+%global host_version 8.0.28
+%global runtime_version 8.0.28
+%global aspnetcore_runtime_version 8.0.28
+%global sdk_version 8.0.128
 %global sdk_feature_band_version %(echo %{sdk_version} | cut -d '-' -f 1 | sed -e 's|[[:digit:]][[:digit:]]$|00|')
 %global templates_version %{runtime_version}
 #%%global templates_version %%(echo %%{runtime_version} | awk 'BEGIN { FS="."; OFS="." } {print $1, $2, $3+1 }')
 
 # upstream can produce releases with a different tag than the SDK or Runtime version
-%global upstream_tag v8.0.127
+%global upstream_tag v8.0.128
 %global upstream_tag_without_v %(echo %{upstream_tag} | sed -e 's|^v||')
 
 %global host_rpm_version %{host_version}
@@ -99,6 +99,10 @@ Patch4:         msbuild-9449-exec-stop-setting-a-locale.patch
 # digests used for the signature are not treated as fatal errors.
 # https://issues.redhat.com/browse/RHEL-25254
 Patch5:         runtime-openssl-sha1.patch
+# Backport of https://github.com/dotnet/runtime/pull/110554
+# Fixes apphost hash duplication under compiler optimizations
+# https://github.com/dotnet/runtime/issues/109611
+Patch6:         runtime-apphost-compare-noopt.patch
 
 
 ExclusiveArch:  aarch64 ppc64le s390x x86_64
@@ -780,6 +784,10 @@ export COMPlus_LTTng=0
 
 
 %changelog
+* Wed Jun 10 2026 Tom Deseyn <tdeseyn@redhat.com> - 8.0.128-2
+- Update to .NET SDK 8.0.128 and Runtime 8.0.28
+- Resolves: RHEL-181054
+
 * Thu May 28 2026 Omair Majid <omajid@redhat.com> - 8.0.127-2
 - Update to .NET SDK 8.0.127 and Runtime 8.0.27
 - Resolves: RHEL-173922

release.json

@@ -1,10 +1,10 @@
 {
-  "release": "8.0.27",
+  "release": "8.0.28",
   "channel": "8.0",
-  "tag": "v8.0.127",
-  "sdkVersion": "8.0.127",
-  "runtimeVersion": "8.0.27",
-  "aspNetCoreVersion": "8.0.27",
+  "tag": "v8.0.128",
+  "sdkVersion": "8.0.128",
+  "runtimeVersion": "8.0.28",
+  "aspNetCoreVersion": "8.0.28",
   "sourceRepository": "https://github.com/dotnet/dotnet",
-  "sourceVersion": "56fc147a7ac76b53fb65b82756da001129b26cc4"
+  "sourceVersion": "b8c15cdca7da2fa00c82bc2ee538bd88af758b8f"
 }

runtime-apphost-compare-noopt.patch

@@ -0,0 +1,46 @@
+From: Tom Deseyn <tdeseyn@redhat.com>
+Subject: [PATCH] Avoid compiler optimization on embedded apphost hash
+
+Backport of https://github.com/dotnet/runtime/pull/110554 to .NET 8.0.
+---
+ src/runtime/src/native/corehost/corehost.cpp | 24 +++++++++++++++++-------
+ 1 file changed, 17 insertions(+), 7 deletions(-)
+
+--- a/src/runtime/src/native/corehost/corehost.cpp
++++ b/src/runtime/src/native/corehost/corehost.cpp
+@@ -40,6 +40,19 @@
+ #define EMBED_HASH_LO_PART_UTF8 "74e592c2fa383d4a3960714caef0c4f2"
+ #define EMBED_HASH_FULL_UTF8    (EMBED_HASH_HI_PART_UTF8 EMBED_HASH_LO_PART_UTF8) // NUL terminated
+ 
++// This avoids compiler optimization which cause EMBED_HASH_HI_PART_UTF8 EMBED_HASH_LO_PART_UTF8
++// to be placed adjacent causing them to match EMBED_HASH_FULL_UTF8 when searched for replacing.
++// See https://github.com/dotnet/runtime/issues/109611 for more details.
++static bool compare_memory_nooptimization(volatile const char* a, volatile const char* b, size_t length)
++{
++    for (size_t i = 0; i < length; i++)
++    {
++        if (*a++ != *b++)
++            return false;
++    }
++    return true;
++}
++
+ bool is_exe_enabled_for_execution(pal::string_t* app_dll)
+ {
+     constexpr int EMBED_SZ = sizeof(EMBED_HASH_FULL_UTF8) / sizeof(EMBED_HASH_FULL_UTF8[0]);
+@@ -63,11 +76,10 @@
+     // So use two parts of the string that will be unaffected by the edit.
+     size_t hi_len = (sizeof(hi_part) / sizeof(hi_part[0])) - 1;
+     size_t lo_len = (sizeof(lo_part) / sizeof(lo_part[0])) - 1;
+-
+-    std::string binding(&embed[0]);
+-    if ((binding.size() >= (hi_len + lo_len)) &&
+-        binding.compare(0, hi_len, &hi_part[0]) == 0 &&
+-        binding.compare(hi_len, lo_len, &lo_part[0]) == 0)
++    size_t embed_len = strlen(&embed[0]);
++    if (embed_len >= (hi_len + lo_len)
++        && compare_memory_nooptimization(&embed[0], hi_part, hi_len)
++        && compare_memory_nooptimization(&embed[hi_len], lo_part, lo_len))
+     {
+         trace::error(_X("This executable is not bound to a managed DLL to execute. The binding value is: '%s'"), app_dll->c_str());
+         return false;

sources

@@ -1,2 +1,2 @@
-SHA512 (dotnet-8.0.127.tar.gz) = ba4d00aa416feed87f72fd0474ed4857e33f5ddd8903be139e159ac643fef6016b3f5e502d729db922451d701ce842fd5c33e059a7b98ad31985d58770db78c2
-SHA512 (dotnet-8.0.127.tar.gz.sig) = 5406f055bd8a4733fea8adc0b45ce939a229aa05db5e5ea4e0d528e73cdbd30b79347c3d9ee7f8547a2485494b496106ab563a71cb0a355b1e4fd8fc20bf82b2
+SHA512 (dotnet-8.0.128.tar.gz) = 6d405965f8d4c9afda7ac2ce33d7af7f9b6a316cf00951a447498ecf2152e2e1d6b5e4561d6535592e9fe1c5f18636547e754a00ad73ab230c8ac803f7f8b56f
+SHA512 (dotnet-8.0.128.tar.gz.sig) = 1e0a506faaa7a9dfa92f9abaca33b0bc11407f1f1fc41777a7b49f55ba7305050f9611845ce4f688fd64d5874226dc00843982c2842905710036017c20fba6b0