[release/8.0] Update MicrosoftBuildVersion to latest #100595
Conversation
|
@ViktorHofer @MichaelSimons do we need a corresponding SBRP change in servicing to take this? I know we needed changes in I think the SBRP changes were |
|
Yes those will need to be backported. Because of all the infrastructure changes made in 9.0, a simple |
|
Source build leg is failing because it needs dotnet/source-build-reference-packages#932. |
…raphy.XML component governance alert.
1678a6f to
b5223b0
Compare
I retract this statement after seeing that 4.8.3 is targeting net8.0. Instead, I think we should build with n-1 in source-build (currently 4.8.5). To do this, we would need to add this dependency in the Version.Detail.xml in order to allow source-build to lift it. See https://github.com/dotnet/runtime/blob/release/8.0/eng/Version.Details.xml#L403. |
|
So it sounds like we need a |
Yes.
Sorry I mixed up the version numbers. I meant 17.8.3 and 17.8.5. It is fine to use 17.8.3. To conclude, I think the following toolset dependencies should be added. The second is to prevent prebuilts from being reported in the runtime's source-build leg. |
|
I see - so simply adding those to VersionDetails.xml is enough? Because we're already using |
That's correct. The VersionDetails.xml entry signals to source-build to use the current version which it does by overriding the Version.props property. |
|
@MichaelSimons -- looks like this MSBuild version did bring some new prebuilts: Should we resurrect the SBRP change for just those? |
|
Looks like if we move to |
|
@steveisok -- is there any reason to fast-track this into May release, or is it ok to go in June? |
|
It resolves a cg alert so taking it now would be preferred. |
|
/backport to release/8.0 |
|
Started backporting to release/8.0: https://github.com/dotnet/runtime/actions/runs/8712642220 |
* Update MicrosoftBuildVersion to latest to fix System.Security.Cryptography.XML component governance alert. * Add info to VersionDetails to allow sourcebuild to update the MSBuild dependency * Update SourceBuildPrebuiltBaseline.xml --------- Co-authored-by: Parker Bibus <parkerbibus@microsoft.com> Co-authored-by: Eric StJohn <ericstj@microsoft.com> Co-authored-by: Michael Simons <msimons@microsoft.com>
* Update MicrosoftBuildVersion to latest to fix System.Security.Cryptography.XML component governance alert. * Add info to VersionDetails to allow sourcebuild to update the MSBuild dependency * Update SourceBuildPrebuiltBaseline.xml --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Parker Bibus <parkerbibus@microsoft.com> Co-authored-by: Eric StJohn <ericstj@microsoft.com> Co-authored-by: Michael Simons <msimons@microsoft.com>
Fixes: dotnet/source-build#4344 dotnet/runtime#100595 introduced two issues: - Lower MSBuild version dependency - 17.8.3, instead of 17.8.5. This caused transitive package downgrade errors. - Source-build dependency for MSBuild, in runtime repo. This caused downgrade of MSBuild repo in VMR, from 17.8.5 to 17.8.3. Besides removing direct package references, the fix is to add a direct MSBuild source-build dependency in `installer` repo. I'm also adding the missing MSBuild dependencies to runtime, for proper PVP flow. Without the explicit dependencies, my validation build was hitting an issue with `Microsoft.Build.Framework` package downgrade in `src/tasks/Microsoft.NET.Sdk.WebAssembly.Pack.Tasks/Microsoft.NET.Sdk.WebAssembly.Pack.Tasks.csproj`: ``` /vmr/src/runtime/artifacts/source-build/self/src/src/tasks/Microsoft.NET.Sdk.WebAssembly.Pack.Tasks/Microsoft.NET.Sdk.WebAssembly.Pack.Tasks.csproj : error NU1605: Warning As Error: Detected package downgrade: Microsoft.Build.Framework from 17.8.5 to 17.8.3. Reference the package directly from the project to select a different version. [/vmr/src/runtime/artifacts/source-build/self/src/Build.proj] /vmr/src/runtime/artifacts/source-build/self/src/src/tasks/Microsoft.NET.Sdk.WebAssembly.Pack.Tasks/Microsoft.NET.Sdk.WebAssembly.Pack.Tasks.csproj : error NU1605: Microsoft.NET.Sdk.WebAssembly.Pack.Tasks -> Microsoft.Build 17.8.5 -> Microsoft.Build.Framework (>= 17.8.5) [/vmr/src/runtime/artifacts/source-build/self/src/Build.proj] /vmr/src/runtime/artifacts/source-build/self/src/src/tasks/Microsoft.NET.Sdk.WebAssembly.Pack.Tasks/Microsoft.NET.Sdk.WebAssembly.Pack.Tasks.csproj : error NU1605: Microsoft.NET.Sdk.WebAssembly.Pack.Tasks -> Microsoft.Build.Framework (>= 17.8.3) [/vmr/src/runtime/artifacts/source-build/self/src/Build.proj] ``` Fully validated with an internal pipeline run: https://dev.azure.com/dnceng/internal/_build/results?buildId=2436369&view=results
Backport of #98006 to release/8.0
/cc @ericstj @LoopedBard3
Customer Impact
Component governance issue in runtime, due to dependencies MSBuild tasks built in repo.
Regression
Testing
Built in main.
Risk
Low - build only dependency. Package version does not appear in shipping assets, nor is binary redistributed.