Dll's packed as contentFiles can be referenced in a consumer project

[noahmarcus]

Details about Problem

NuGet product used: dotnet.exe NuGet version: 4.5.1.4879 dotnet.exe --version: 2.1.402 OS version: win10 v1809 (17763.134)

Dll's packed as content with build action content or none can be referenced by consumer projects. My use case is packing a self-contained health checking application for a process which runs on Docker. I can't deliver the application as a NuGet package, as the application which is including it will reference the dlls from the self contained application and fails to build as they are incompatible.

Repro Steps

1. Pack netcore2.1 system dll's as contentFiles (build action none or content). I've been using System.Core.dll

2. Include the package in a project. targeting net47.

3. The packaged dlls will be referenced by the project if it would have a reference to the net47 version of the dll.

OR

1. Download and build attached Consumer.csproj.

If you take a look at a binlog, the System.Core.dll from the package is being chosen as a reference. The uploaded System.Core.dll is for netcore2.1

Sample Project

NugetRepro.zip

There are two projects here - Package.csproj, from which I created a package using dotnet pack, and Consumer.csproj, which I build using dotnet build. If you generate a binlog, the packed dll is being used as a reference.

[toconnorcdx]

I am encountering this same issue:

• I have a self-contained netcore1.1 application whose dlls are packed as contentFiles in a nuget package.
• I have a net462 WPF application that consumes this nuget package, which results in an ambiguous assembly reference to mscorlib.dll due to the copy in the contentFiles of of the downloaded nuget package

Unsurprisingly, the issue only arose after switching the netcore1.1 app to self-contained app .

For the interim, I have to

• set the target in the file nuspec element to target="contentFiles\none\any\Drop" to avoid the build referencing the assemblies, and
• use a post-build script to xcopy the binaries from .nuget\packages\<package_name>\<version>\contentFiles\none\any\Drop to the build output

NuGet's contentFiles should not be a legitimate path for referencing assemblies