[main] Update dependencies from dotnet/source-build-reference-packages

[dotnet-maestro]

This pull request updates the following dependencies

From https://github.com/dotnet/source-build-reference-packages

• Subscription: a86f9f27-acb1-4618-eed7-08db6775ce49
• Build: 20230731.3
• Date Produced: July 31, 2023 6:18:53 PM UTC
• Commit: 5a1492557c8717b428b69fd4b7ca8c91d5d18cd3
• Branch: refs/heads/main

• Updates:
  • Microsoft.SourceBuild.Intermediate.source-build-reference-packages: from 8.0.0-alpha.1.23368.2 to 8.0.0-alpha.1.23381.3

Coherency Updates

The following updates ensure that dependencies with a CoherentParentDependency
attribute were produced in a build used as input to the parent dependency's build.
See Dependency Description Format

• Coherency Updates:
  • Microsoft.SourceLink.GitHub: from 1.1.0-beta-21480-02 to 8.0.0-beta.23211.2 (parent: Microsoft.DotNet.Arcade.Sdk)
  • Microsoft.DotNet.XliffTasks: from 1.0.0-beta.21431.1 to 1.0.0-beta.23211.1 (parent: Microsoft.DotNet.Arcade.Sdk)

[JanKrivanek]

This is addressing dotnet/source-build#3494 (and by extension our false positive CG issue: https://devdiv.visualstudio.com/DevDiv/_componentGovernance/DotNet-msbuild-Trusted/alert/7824363?typeId=7350956&pipelinesTrackingFilter=0)

[JanKrivanek]

Blocked by:

• SBRP System.Configuration.ConfigurationManager 7.0.0 missing public types sdk#33388 (comment)
• Remove package pulled by SBRP (microsoft.win32.registry) source-build#3525 - this needs update to arcade8 (Update to Arcade 8 #8672)

[JanKrivanek]

Transfering discussion from dotnet/sdk#33388, per the last comment:

While I think this issue should be fixed, I don't think the msbuild issue requires it.

msbuild references System.Configuration.ConfigurationManager 7.0.0 in it's repo source-build leg but not full product source-build because of the corresponding entry in the versions.details.xml file. In the product build, this reference cannot be satisfied by a reference package as indicated in dotnet/msbuild#8818. This is to say the repo level source-build and product source-build are referencing different versions. If this difference cannot be resolved, it would be appropriate to add the package to the prebuilt baseline. We should not be adding SBRPs that are only used in repo builds.

We should discuss in dotnet/msbuild#8893.

cc @mmitche, @oleksandr-didyk

@MichaelSimons I very appreciate your detailed look and help! I appologize, but I have hard time understanding the above message. Are you saying that MSBuild references ConfigurationManager 7.0.0, but SRBP v8 have a version 8.x, so either MSBuild should reference CM 8.x or add v 7.0.0 to it's source pre-builds? As I believe we cannot reference 8.x packages due to the need to be inserted to VS. As for the other option - I belieive this is already hapening: https://github.com/dotnet/msbuild/blob/main/eng/SourceBuildPrebuiltBaseline.xml#L19

But with my very shallow knowledge of SourceBuild and MSBuild build I might be just misunderstanding you - in such case can you try to elaborate further or point me to info source where I can learn about the rootcause of this issue?

[MichaelSimons]

Are you saying that MSBuild references ConfigurationManager 7.0.0, but SRBP v8 have a version 8.x,

The microsoft build and the repo level source-build CI references 7.0.0, but in the full product source build, the 8.x version is referenced.

so either MSBuild should reference CM 8.x or add v 7.0.0 to it's source pre-builds? As I believe we cannot reference 8.x packages due to the need to be inserted to VS.

I figured that was the case.

Since this is already in the prebuilt baseline, then there shouldn't be anything else needed for ConfigurationManager.

[JanKrivanek]

Since this is already in the prebuilt baseline, then there shouldn't be anything else needed for ConfigurationManager.

Hmm - I however still see the missing ConfigurationManager types errors in the sourcebuild binlong (/__w/1/s/artifacts/source-build/self/src/src/Shared/ToolsetElement.cs(665,10): error CS0616: 'ConfigurationProperty' is not an attribute class [/__w/1/s/artifacts/source-build/self/src/src/Build/Microsoft.Build.csproj] etc.)

I know we should update to arcade8 to tackle the other issue (clashing types from microsoft.win32.registry) - but I'd like to have the ConfigurationManager issue sorted as well, as it seems to independent on arcade version

[MichaelSimons]

Where are you seeing the CS0616 error? I am not seeing in the output of the source-build leg in this PR.

[JanKrivanek]

Where are you seeing the CS0616 error? I am not seeing in the output of the source-build leg in this PR.

Oh sorry - I haven't noticed there was a recent maestro push that resolved this. It happened only with the SBRP v 8.0.0-alpha.1.23316.2 (run https://github.com/dotnet/msbuild/runs/14343270323)
With update to 8.0.0-alpha.1.23319.4 it disappeared (run https://github.com/dotnet/msbuild/runs/14405558761)

[MichaelSimons]

With update to 8.0.0-alpha.1.23319.4 it disappeared

Thanks for clarifying, that is what I was expecting. That package was recently removed because it wasn't being referenced in the product source-build.

[JanKrivanek]

Once this is fixed - we should remove System.Security.Cryptography.Pkcs/*7.0.2* from prebuilds (added by #8903)

[YuliiaKovalova]

Once this is fixed - we should remove System.Security.Cryptography.Pkcs/*7.0.2* from prebuilds (added by #8903)

addressed in scope of 5410bf3