dotnet / reproducible-builds

Contains the DotNet.ReproducibleBuilds package
MIT License
168 stars 18 forks source link

Should I Use This Package? #18

Closed RehanSaeed closed 1 year ago

RehanSaeed commented 1 year ago

I've followed this post a year or more ago to add source link like so:

  <PropertyGroup Label="Build">
    <GenerateDocumentationFile>true</GenerateDocumentationFile>
    <SymbolPackageFormat>snupkg</SymbolPackageFormat>
  </PropertyGroup>

  <PropertyGroup Label="Source Link">
    <!-- Optional: Declare that the Repository URL can be published to NuSpec -->
    <PublishRepositoryUrl>true</PublishRepositoryUrl>
    <!-- Optional: Embed source files that are not tracked by the source control manager to the PDB -->
    <EmbedUntrackedSources>true</EmbedUntrackedSources>
    <!-- Optional: Include PDB in the built .nupkg -->
    <AllowedOutputExtensionsInPackageBuildOutputFolder>$(AllowedOutputExtensionsInPackageBuildOutputFolder);.pdb</AllowedOutputExtensionsInPackageBuildOutputFolder>
  </PropertyGroup>

  <ItemGroup Label="Package References">
    <PackageReference Include="Microsoft.SourceLink.GitHub" PrivateAssets="All" Version="1.1.1" />
  </ItemGroup>

I also use Cake build to set the ContinuousIntegrationBuild variable based on !BuildSystem.IsLocalBuild.

I'm trying to understand if I should switch over to DotNet.ReproducibleBuilds. There seem to be two differences:

  1. The package sets DebugType to embedded which I believe would stop generating a snupkg file. I don't currently set DebugType, so the default must be coming from SymbolPackageFormat above. Why was embedded chosen as the default?
  2. Do the source link packages also set AllowedOutputExtensionsInPackageBuildOutputFolder? https://github.com/ctaggart/SourceLink/pull/291 makes it pretty unclear.
baronfel commented 1 year ago

Embedded is much simpler distribution-wise than a separate snupkg - it does increase DLL size a bit but for many customers (especially smaller OSS projects) it is a more sane default (in my opinion). You can of course override it to use whatever DebugType your prefer.

The SourceLink packages don't set AllowedOutputExtensionsInPackageBuildOutputFolder, because those packages don't express an opinion on the matter of where the PDBs should go, only what SourceLink content should be written to them.