Libraries with hardcoded `netstandard2.0` AssemblyVersions are shipping incorrect AssemblyVersions in servicing.

[mvarblow]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

The Microsoft.AspNetCore.Authentication.Negotiate 6.0.2+ nuget packages declare a dependency on System.DirectoryServices.Protocols >= 6.0.1. However they fail with a runtime error if used versions of System.DirectoryServices.Protocols > 6.0.1.

For example, If I create a CoreWCF service application targeting .NET 6 and reference:

<PackageReference Include="CoreWCF.Primitives" Version="1.3.1" />
<PackageReference Include="CoreWCF.Http" Version="1.3.1" />
<PackageReference Include="Microsoft.AspNetCore.Authentication.Negotiate" Version="6.0.15" />

And then I enable Windows authentication using something like:

        services.AddAuthentication(NegotiateDefaults.AuthenticationScheme).AddNegotiate();

Then I get a runtime error during application startup:

crit: Microsoft.AspNetCore.Hosting.Diagnostics[6]
      Application startup exception
      System.IO.FileNotFoundException: Could not load file or assembly 'System.DirectoryServices.Protocols, Version=6.0.0.1, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'. The system cannot find the file specified.
      File name: 'System.DirectoryServices.Protocols, Version=6.0.0.1, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'
         at Microsoft.AspNetCore.Authentication.Negotiate.PostConfigureNegotiateOptions.PostConfigure(String name, NegotiateOptions options)
         at Microsoft.Extensions.Options.OptionsFactory`1.Create(String name)
         at Microsoft.Extensions.Options.OptionsMonitor`1.<>c__DisplayClass10_0.<Get>b__0()
         at System.Lazy`1.ViaFactory(LazyThreadSafetyMode mode)
         at System.Lazy`1.ExecutionAndPublication(LazyHelper executionAndPublication, Boolean useDefaultConstructor)
         at System.Lazy`1.CreateValue()
         at System.Lazy`1.get_Value()
         at Microsoft.Extensions.Options.OptionsCache`1.GetOrAdd(String name, Func`1 createOptions)
         at Microsoft.Extensions.Options.OptionsMonitor`1.Get(String name)
         at Microsoft.AspNetCore.Authentication.Negotiate.Internal.NegotiateOptionsValidationStartupFilter.<>c__DisplayClass2_0.<Configure>b__0(IApplicationBuilder builder)
         at Microsoft.AspNetCore.HostFilteringStartupFilter.<>c__DisplayClass0_0.<Configure>b__0(IApplicationBuilder app)
         at Microsoft.AspNetCore.Hosting.GenericWebHostService.StartAsync(CancellationToken cancellationToken)

See CoreWCF/CoreWCF#998

Expected Behavior

Microsoft.AspNetCore.Authentication.Negotiate should not have a fixed reference to a specific version of System.DirectoryServices.Protocols. This runtime behavior is reminiscent of DLL hell from times past. I should be able to reference both Microsoft.AspNetCore.Authentication.Negotiate and another NuGet package that depends on later versions of System.DirectoryServices.Protocols such as 7.0.0.

If that's not possible for some reason (sigh) then the Microsoft.AspNetCore.Authentication.Negotiate nuget package should accurately advertise the dependency as = 6.0.1 instead of >= 6.0.1.

Steps To Reproduce

A very simple way to reproduce this is to just create a new project from the ASP.NET Core Empty template. Add these package references:

<ItemGroup>
	<PackageReference Include="CoreWCF.Primitives" Version="1.3.1" />
	<PackageReference Include="CoreWCF.Http" Version="1.3.1" />
	<PackageReference Include="Microsoft.AspNetCore.Authentication.Negotiate" Version="6.0.15" />
</ItemGroup>

Add this into the Program.cs:

builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme).AddNegotiate();
The full Program.cs:

using Microsoft.AspNetCore.Authentication.Negotiate;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme).AddNegotiate();
var app = builder.Build();

app.MapGet("/", () => "Hello World!");

app.Run();

It will build successfully but fail at runtime with the error above.

Exceptions (if any)

System.IO.FileNotFoundException: Could not load file or assembly 'System.DirectoryServices.Protocols, Version=6.0.0.1, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'. The system cannot find the file specified.
File name: 'System.DirectoryServices.Protocols, Version=6.0.0.1, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a'
at Microsoft.AspNetCore.Authentication.Negotiate.PostConfigureNegotiateOptions.PostConfigure(String name, NegotiateOptions options)
at Microsoft.Extensions.Options.OptionsFactory1.Create(String name) at Microsoft.Extensions.Options.OptionsMonitor1.<>c__DisplayClass10_0.b__0()
at System.Lazy1.ViaFactory(LazyThreadSafetyMode mode) at System.Lazy1.ExecutionAndPublication(LazyHelper executionAndPublication, Boolean useDefaultConstructor)
at System.Lazy1.CreateValue() at System.Lazy1.get_Value()
at Microsoft.Extensions.Options.OptionsCache1.GetOrAdd(String name, Func1 createOptions)
at Microsoft.Extensions.Options.OptionsMonitor`1.Get(String name)
at Microsoft.AspNetCore.Authentication.Negotiate.Internal.NegotiateOptionsValidationStartupFilter.<>c__DisplayClass2_0.b__0(IApplicationBuilder builder)
at Microsoft.AspNetCore.HostFilteringStartupFilter.<>c__DisplayClass0_0.b__0(IApplicationBuilder app)
at Microsoft.AspNetCore.Hosting.GenericWebHostService.StartAsync(CancellationToken cancellationToken)

.NET Version

7.0.201

Anything else?

dotnet --info:

.NET SDK:
 Version:   7.0.201
 Commit:    68f2d7e7a3

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.22621
 OS Platform: Windows
 RID:         win10-x64
 Base Path:   C:\Program Files\dotnet\sdk\7.0.201\

Host:
  Version:      7.0.3
  Architecture: x64
  Commit:       0a2bda10e8

.NET SDKs installed:
  3.1.200 [C:\Program Files\dotnet\sdk]
  3.1.201 [C:\Program Files\dotnet\sdk]
  3.1.300 [C:\Program Files\dotnet\sdk]
  3.1.426 [C:\Program Files\dotnet\sdk]
  5.0.103 [C:\Program Files\dotnet\sdk]
  5.0.104 [C:\Program Files\dotnet\sdk]
  5.0.201 [C:\Program Files\dotnet\sdk]
  5.0.203 [C:\Program Files\dotnet\sdk]
  5.0.214 [C:\Program Files\dotnet\sdk]
  5.0.303 [C:\Program Files\dotnet\sdk]
  5.0.408 [C:\Program Files\dotnet\sdk]
  5.0.416 [C:\Program Files\dotnet\sdk]
  6.0.302 [C:\Program Files\dotnet\sdk]
  6.0.310 [C:\Program Files\dotnet\sdk]
  7.0.200 [C:\Program Files\dotnet\sdk]
  7.0.201 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.All 2.1.19 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.25 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.1.30 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.All 2.2.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
  Microsoft.AspNetCore.App 2.1.19 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.25 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.1.30 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 2.2.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.4 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.6 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.7 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.12 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.19 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.30 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.31 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.4 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.9 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.10 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.17 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.8 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.10 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.11 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.13 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.14 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.15 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 7.0.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 2.1.19 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.25 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.1.30 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 2.2.8 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.2 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.4 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.6 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.7 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.12 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.19 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.30 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.31 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.4 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.9 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.10 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.17 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.4 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.8 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.10 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.11 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.12 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.13 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.14 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.15 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 7.0.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.WindowsDesktop.App 3.1.4 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 3.1.12 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 3.1.19 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 3.1.30 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 3.1.31 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 5.0.3 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 5.0.4 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 5.0.9 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 5.0.10 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 5.0.17 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 6.0.8 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 6.0.10 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 6.0.11 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 6.0.13 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 6.0.14 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 6.0.15 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 7.0.3 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Other architectures found:
  arm64 [C:\Program Files\dotnet]
    registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\arm64\InstallLocation]
  x86   [C:\Program Files (x86)\dotnet]
    registered at [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation]

Environment variables:
  Not set

global.json file:
  Not found

Learn more:
  https://aka.ms/dotnet/info

Download .NET:
  https://aka.ms/dotnet/download

[Tratcher]

Nuget binding redirects should have accounted for this, we'll have to see why that's not working.

I've left some comments on the linked issue about how to make the dependency tree more compatible.

[stcpottdav]

System.DirectoryServices.Protocols appears to have an assembly version of 4.0.0.0 instead of 7.0.0.0, could this be the problem?

From deps.json:

"System.DirectoryServices.Protocols/7.0.0": { "runtime": { "lib/net6.0/System.DirectoryServices.Protocols.dll": { "assemblyVersion": "4.0.0.0", "fileVersion": "7.0.22.51805" }

[lscorcia]

+1 for this, same issue here.

[danmoseley]

@wtgodbe does this look right?

[wtgodbe]

The 4.0.0.0 version is expected apparently:

runtime/src/libraries/System.DirectoryServices.Protocols/Directory.Build.props

Lines 4 to 7 in f2db6d6

	<!-- this assembly is inbox in desktop, do not version it unless you
	plan on shipping a new desktop version out of band. Instead add API
	to a different assembly. -->
	<AssemblyVersion>4.0.0.0</AssemblyVersion>

. @ViktorHofer why do we use that 4.0.0.0 version?

In our repo, nothing has changed in Microsoft.AspNetCore.Authentication.Negotiate since we shipped 6.0.0 - there was this change to System.DirectoryServices.Protocols in the 6.0.1/6.0.2 time frame, @joperezr do you remember if there was anything weird with this change with regards to versioning? Maybe the ServicingVersion update to 1 has something to do with the 1 in the AssemblyVersion revision?

[lscorcia]

According to https://github.com/dotnet/runtime/blob/4881a639e7c3f27b5a8d2d160e234d8055333cda/docs/project/library-servicing.md#determine-serviceversion setting ServicingVersion is expected when a library is updated in a servicing release, which is what seems to have happened here.
Another reference to ServicingVersion seems to affect packaging version here:

runtime/eng/packaging.targets

Line 52 in eb044f1

<AssemblyVersion Condition="'$(_AssemblyInTargetingPack)' != 'true'">$(MajorVersion).$(MinorVersion).0.$(ServicingVersion)</AssemblyVersion>

.
Is there any way I can help troubleshoot this? We need the upstream fixes in S.DS.P v7, but we still run our software under .net 6. It is currently impossible to reference any version >= 6.0.1 in an application that uses Microsoft.AspNetCore.Authentication.Negotiate.

[ViktorHofer]

The 4.0.0.0 version is expected apparently:

runtime/src/libraries/System.DirectoryServices.Protocols/Directory.Build.props

Lines 4 to 7 in f2db6d6

	<!-- this assembly is inbox in desktop, do not version it unless you
	plan on shipping a new desktop version out of band. Instead add API
	to a different assembly. -->
	<AssemblyVersion>4.0.0.0</AssemblyVersion>

. @ViktorHofer why do we use that 4.0.0.0 version?

I need to defer to @joperezr for this specific assembly (or @ericstj) but as the comment suggests, the assembly (with the same identity) exists on .NET Framework. My guess is that by updating its version, it would be chosen when referenced in a .NET Framework application instead of the assembly in the GAC. But I might be mixing things things up here so hopefully Eric or Joe can answer this question in more detail.

[ericstj]

The reason that DirectoryServices.Protocols remains at 4.0.0.0 is because it has the same name as the .NETFramework assembly, and exposes a netstandard2.0 assembly. For that to work it must keep the netstandard2.0 assembly <= 4.0.0.0 so that the package does not try to replace the .NETFramework assembly.

In this case the bug seems to be that the 6.0.1 package version of System.DirectoryServices.Protocols accidentally shipped assembly version 6.0.0.1 then the newer package version 7.0.0 shipped the lower assembly version.

We can't go back in time and "undo" shipping that bad assembly version.

We could fix this one of two ways:

1. Fix the AssemblyVersion logic in servicing for 6.0 and move back to 4.0.0.0 for all assemblies in the package. This would require folks to rebuild to get the lower assembly reference.
2. Go back to 4.0.0.0 only for the netstandard2.0 assembly. Allow the netcoreapp and net assemblies to take on the "normal" product version.

We should review any other explicit AssemblyVersion usage in other projects to make sure it also doesn't conflict with the servicing version logic. @ViktorHofer - I suspect the same bug was just hit in System.Management in servicing.

[ViktorHofer]

Fix the AssemblyVersion logic in servicing for 6.0 and move back to 4.0.0.0 for all assemblies in the package. This would require folks to rebuild to get the lower assembly reference.

System.DirectoryServices.Protocols/7.0.0 has a net461 placeholder file. Doesn't that mean that the netstandard2.0 asset is never chosen?

[ericstj]

Correct - when targeting net461 or later. The problem is with a netstandard2.0 project (or library in a package) that's referenced by a net461 or later project. I'll move this issue to runtime since this is a versioning issue with our libraries.

Of course, there's also the "bigger" problem that this version change only happens in servicing, then gets reverted in GA (as can be seen here). Which means that someone updating a package from 6.0.1 -> 7.0.0 will see a lower assembly version.

Here's a list of potential impacted assemblies: https://github.com/search?q=AssemblyVersion+repo%3Adotnet%2Fruntime+path%3A%2Fsrc%2Flibraries+filename%3ADirectory.Build.props&type=Code&ref=advsearch&l=&l=