search

dotnet / source-build

A repository to track efforts to produce a source tarball of the .NET Core SDK and all its components
MIT License
265 stars 130 forks source link

9.0 Stage 2 Builds Failing in Arcade due to `System.Security.Cryptography.Pkcs` Package Downgrade #4601

Open ellahathaway opened 6 days ago

ellahathaway commented 6 days ago

The 9.0 builds are encountering the following error when attempting to arcade build:

##[error]/vmr/src/arcade/src/Microsoft.DotNet.SourceBuild/tasks/Microsoft.DotNet.SourceBuild.Tasks.csproj(0,0): error NU1605: (NETCORE_ENGINEERING_TELEMETRY=Restore) Warning As Error: Detected package downgrade: System.Security.Cryptography.Pkcs from 9.0.0-rc.2.24459.11 to 7.0.2. Reference the package directly from the project to select a different version.

This error occurs in more than one place in the arcade, including /vmr/src/arcade/src/Microsoft.DotNet.PackageTesting/Microsoft.DotNet.PackageTesting.csproj and /vmr/src/arcade/src/Microsoft.DotNet.Build.Tasks.TargetFramework/src/Microsoft.DotNet.Build.Tasks.TargetFramework.csproj, so I suspect that this is due to a package version change in the arcade versions props file.

The Stage 1 builds have no prebuilts in their prebuilt packages directories.

dotnet-issue-labeler[bot] commented 6 days ago

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

dotnet-issue-labeler[bot] commented 6 days ago

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

ellahathaway commented 6 days ago

I've confirmed that System.Security.Cryptography.Pkcs.9.0.0-rc.2.24459.11 is in the PSB artifacts from the stage 1 leg. The stack shows that the downgrade is because Microsoft.Build.Tasks.Core 17.8.3 references System.Security.Cryptography.Pkcs >= 7.0.2. This reference is also defined in arcade's Version.Details.

ellahathaway commented 6 days ago

Testing a fix in this pipeline run https://dev.azure.com/dnceng/internal/_build/results?buildId=2536490&view=results

I've also checked MSBuild (which is pulling in this dependency), and the repo has System.Security.Cryptography.Pkcs in it's version details: https://github.com/dotnet/msbuild/blob/a4064f193ed0c581834112f876e88aa3e94840ac/eng/Version.Details.xml#L46, so the version should be being lifted.

MichaelSimons commented 13 hours ago

@ellahathaway - is there remaining work here or can this be closed?