Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
Artifact Repositories and the Release Process: Feeds, Container Image Tags, Hotfix Flow and Support Policy
In container registries a tag is a moving pointer by default, so tag images with the version and the commit SHA, mark their source with OCI labels and deploy by digest. On the Bookstore API we show the same tag pointing to two different images, the SDK's OCI labels and digest output, a 1.x hotfix cherry-picked onto a release branch and the trap of the publishing workflow missing from that branch, and cover artifact repository options, release cadence and a support policy template.
Publishing an Angular Library to npm: ng-packagr, peerDependencies, dist-tags and Trusted Publishing
Package an Angular library in the Angular Package Format with ng-packagr, publish the dist output rather than the source folder, and declare the Angular range you support with peerDependencies. For @bookstore/ui we set up a secondary entry point and the exports field, show ERESOLVE when the peer range is not met and npm 11 refusing a prerelease without a tag, and cover dist-tags, deprecate and a trusted publishing workflow.
Publishing a NuGet Package: dotnet pack, Package Metadata, Package Validation and nuget.org Trusted Publishing
Build a NuGet package with metadata, README, license and a symbol package, catch accidental breaking changes during pack with EnablePackageValidation against the previous version, and publish to nuget.org with trusted publishing, which issues a one-hour key through OIDC instead of a long-lived API key. On Bookstore.Contracts we show an optional parameter's binary break as CP0002, a dropped framework as PKV006 and a second push of the same version as 409 Conflict on a local server.
Changelogs and Release Notes: From Conventional Commits to an Automated CHANGELOG, and a Deprecation Policy
Generate the CHANGELOG from Conventional Commits and write release notes by hand: the tool derives the version and the list of changes mechanically, but knows nothing about deprecations, migration steps or support dates. We take Bookstore.Contracts to 1.1.0 and 2.0.0 with commit-and-tag-version, warn one release ahead with [Obsolete] and DiagnosticId, write the 2.0 migration notes, and compare the PR-based alternative with release-please manifest mode.
Deriving Versions from Git: Comparing MinVer, Nerdbank.GitVersioning and GitVersion
There are three ways to derive versions from Git: MinVer looks only at tags, Nerdbank.GitVersioning combines version.json with git height, and GitVersion calculates by branch type. We compare all three on Bookstore.Contracts with the same scenario and real output, and show the tag prefix, AssemblyVersion defaults, GitVersion 6's config changes and the shallow clone trap that requires fetch-depth: 0 in CI.
Version Info in .NET and Angular: AssemblyVersion, FileVersion, InformationalVersion, Source Link and a /version Endpoint
In .NET, provide the version once through Version, pin AssemblyVersion to the major in libraries, put the CI build number into FileVersion and leave InformationalVersion to the SDK, which has appended the commit SHA since .NET 8. We make the version visible in the Bookstore API with a /version endpoint, a log line and OpenTelemetry service.version, inject it into the Angular build with define, and test the service worker's new-version notice with Playwright.
What Does a Version Number Say? SemVer 2.0.0, Pre-release, Build Metadata and CalVer
Choose a version scheme by whom it makes a promise to: for packages SemVer 2.0.0 promises compatibility, for deployed applications CalVer plus a build number answers "what shipped, and when". We compare pre-release and build metadata ordering in NuGet.Versioning and npm semver with real output, and cover 0.x ranges, kinds of breaking changes, the .NET and Angular support policies and a decision table for Bookstore.
Monitoring Certificates and Preventing Outages: Inventory, Expiry Alerts, TLS Testing and Real Incident Examples
To prevent certificate outages you measure the certificate the client sees from the outside, not the file on disk: a lifetime-based alert on the blackbox exporter's last_chain metric, a probe_success alert, and an inventory with CT logs and CAA. In the lab we reproduce an unreloaded renewal, a missing intermediate, a wrong SAN, a cross certificate that misleads earliest_cert_expiry and clock skew, and test the alerts with promtool and the TLS config with testssl.sh.
mTLS and Internal Certificates: Client Certificate Authentication in ASP.NET Core and Running Your Own CA
In mTLS the client also proves its identity with a certificate and a signature made with its private key; because public CAs are dropping the client authentication EKU, you need your own internal CA with an offline root. In ASP.NET Core we set up AddCertificate with CustomRootTrust and issuer-and-CN partner mapping, and with real runs we see Kestrel's silent rejection at the TLS layer, revocation, and how Nginx forwarding the certificate in a header can be faked without the private key.
Enforcing HTTPS: HTTP→HTTPS Redirects, Rolling Out HSTS Gradually, Preload and Mixed Content
To enforce HTTPS you redirect at the layer where TLS terminates, reject HTTP with 400 instead of redirecting on APIs, and roll HSTS out gradually from 5 minutes to a year; a subdomain inventory is a must before includeSubDomains. With real runs we see the UseHttpsRedirection loop and the non-secure cookie behind a proxy, 301 turning a POST into a GET, HSTS locking an HTTP-only subdomain, and an absolute http:// URL in an Angular build being blocked as mixed content.
Certificates on Managed Platforms: Caddy, Azure App Service, Key Vault, Front Door and cert-manager on Kubernetes
On managed platforms the platform obtains and renews the certificate, but each has a limit that will catch you: Caddy hits rate limits without a /data volume, the App Service managed certificate has no wildcard, Front Door wants a direct CNAME, and cert-manager changes the key on every renewal. With real runs of Caddy, cert-manager and Envoy Gateway against Pebble, we watch pinning break on renewal.
Certificates in .NET and Kestrel: dev-certs, Loading PEM/PFX, SNI, Reload on Renewal and HttpClient Validation
Kestrel reloads a PEM or PFX certificate from configuration without a restart, but it watches only Path, notices the change in about five seconds and restarts the endpoint; as a non-root user it cannot read Certbot's files, so a deploy hook is needed. With real runs we look at dev-certs' SSL_CERT_DIR setting on Linux, SNI with ServerCertificateSelector, and trusting an internal CA in HttpClient with CustomRootTrust instead of turning validation off.