Preview 5 has two identical copies of System.Security.Cryptography.Cng.dll

[ericsink]

In .NET 6 preview 5, there are identical copies of System.​Security.​Cryptography.​Cng.dll in two different targeting packs, one in Microsoft.​NETCore.​App.Ref and another in Microsoft.​AspNetCore.​App.Ref.

I first mentioned this in a Tweet:

https://twitter.com/eric_sink/status/1405727524194242566

to which @davidfowl replied "That sounds like a bug...", so I figured it should be logged, and hopefully this is the right place.

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[davidfowl]

cc @dougbu @ericstj

[ericstj]

Confirmed this is the case. @dougbu, this needs to be removed from ASP.NET ref-pack. Looks like it's no longer in runtime pack/shared-fx but still present in ref-pack.

[dougbu]

Was this assembly added to Microsoft.NETCore.App.* while we weren't looking❔ We've long (at least since 3.1.0) had a weird case where Cryptography.Cng was in our targeting packs but not our runtimes (and visa-versa for Cryptography.Pkcs).

The Microsoft.NETCore.App.Ref content changed between preview 4 and 5, adding Cryptography.Cng (and Cryptograph.OpenSsl). Was that change intentional @ericstj❔ If it matters, I don't see any changes in that period between the runtimes.

[dougbu]

In any case, something odd is happening.

https://github.com/dotnet/aspnetcore/blob/1ead7696c823ca9d96a7bea65760d7fc03f375ce/src/Framework/App.Ref/src/Microsoft.AspNetCore.App.Ref.csproj#L147

in our App.Ref exclusions should mean we don't duplicate anything from Microsoft.NETCore.App.Ref in our Microsoft.AspNetCore.App.Ref.

[dougbu]

@ericstj if Cryptography.Cng was intentionally added to Microsoft.NETCore.App.Ref, the bug here is leaving System.Security.Cryptography.Cng in Microsoft.AspNetCore.Internal.Transport. Our repo expects the transport package to contain only additional ref/ assemblies we need. The duplication between Microsoft.AspNetCore.Internal.Transport and Microsoft.NETCore.App.Ref can't be correct and special-casing it to avoid this bug seems Just Wrong:tm:

(Side note: We still don't need implementation assemblies in Microsoft.AspNetCore.Internal.Transport)

[ericstj]

Yes it was exposed with #51853. Cc @ViktorHofer

[ericstj]

To remove from the transport package we need to remove

runtime/src/libraries/System.Security.Cryptography.Cng/Directory.Build.props

Line 5 in cff5854

<IsAspNetCoreApp>true</IsAspNetCoreApp>

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @GrabYourPitchforks
See info in area-owners.md if you want to be subscribed.

Issue Details

---

In .NET 6 preview 5, there are identical copies of System.​Security.​Cryptography.​Cng.dll in two different targeting packs, one in Microsoft.​NETCore.​App.Ref and another in Microsoft.​AspNetCore.​App.Ref.

I first mentioned this in a Tweet:

https://twitter.com/eric_sink/status/1405727524194242566

to which @davidfowl replied "That sounds like a bug...", so I figured it should be logged, and hopefully this is the right place.

Author:	ericsink
Assignees:	-
Labels:	area-System.Security, untriaged
Milestone:	-

[dougbu]

I like one line fixes 😃