FSharp.Core version 7.0.0 has multiple content hashes

[petteripoyhtari]

We have now currently this same issue with the 7.0.0 package and we have trouble to pass our Azure ci/cd pipeline builds through. Some machines will get the same hash and other won't.

"Package content hash validation failed for FSharp.Core.7.0.0. The package is different than the last restore."

Could you change the package version number when you change the package contents / code, please.

Same issue has apparently been before: NuGet/Home#11610

Originally posted by @petteripoyhtari in #13678 (comment)

[cmeeren]

As a "workaround" (I do this permanently), could you try adding <DisableImplicitLibraryPacksFolder>true</DisableImplicitLibraryPacksFolder> to your project files (or to a Directory.Build.props)?

[vzarytovskii]

This is due to SDK insertions and package publishing are two different events and can be desynchronized.

Not entirely sure how should we deal with it.

@KevinRansom thoughts?

[KevinRansom]

Okay, I know what happened. We serviced VS2017.3 without revising it's fsharp.core package version number. That was because no APIs changed. However, the FSharp.Core nuget package was rebuilt, and the rebuilt package was inserted into the SDK which caused the hashes to differ.

So this means that we need to ensure that we rev the fsharp.core and FSharp.Compiler.Service package numbers whenever we service a released branch.

and ideally --- not service released branches unless absolutely necessary.

This check would have caught it: #14591

[cmeeren]

If it's rebuilt without changes, and the hash is different, doesn't that mean you are not using deterministic builds? If so, have you checked out e.g. DotNet.ReproducibleBuilds?

[vzarytovskii]

If it's rebuilt without changes, and the hash is different, doesn't that mean you are not using deterministic builds? If so, have you checked out e.g. DotNet.ReproducibleBuilds?

It's not about determinism, it's about different packages end up published to nuget and to SDK (or rather one doesn't get republished since version wasn't bumped).