We can validate closure of our shared framework transport packages

[ericstj]

Today we publish a shared framework package for ASP.NET and include an arbitrary set of files:

runtime/src/libraries/Microsoft.AspNetCore.Internal.Transport/pkg/Microsoft.AspNetCore.Internal.Transport.pkgproj

Lines 12 to 13 in 4e2e990

	<File Include="$(ASPNETCoreAppPackageRefPath)\*.*;@(_libDocs)" TargetPath="ref\$(NetCoreAppCurrent)" />
	<File Include="$(ASPNETCoreAppPackageRuntimePath)\*.*" Exclude="@(_libDocs)" TargetPath="lib\$(NetCoreAppCurrent)" />

Nothing guarantees that we aren't omitting dependencies here, and that isn't validated until the transport package reaches ASP.NET.

We do validate dependencies for our own shared framework:
https://github.com/dotnet/arcade/blob/44324e2d3563921f60b1522fccf3fef45dcfe636/src/Microsoft.DotNet.SharedFramework.Sdk/targets/sharedfx.targets#L437-L464

We could do this for the ASP.NET transport package as well, ensuring we pass the files that are part of the base shared framework as candidates. We could do the same for a WindowsDesktop transport package, should we produce one in the future.

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

Tagging subscribers to this area: @Anipik, @safern, @ViktorHofer
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Today we publish a shared framework package for ASP.NET and include an arbitrary set of files:

runtime/src/libraries/Microsoft.AspNetCore.Internal.Transport/pkg/Microsoft.AspNetCore.Internal.Transport.pkgproj

Lines 12 to 13 in 4e2e990

	<File Include="$(ASPNETCoreAppPackageRefPath)\*.*;@(_libDocs)" TargetPath="ref\$(NetCoreAppCurrent)" />
	<File Include="$(ASPNETCoreAppPackageRuntimePath)\*.*" Exclude="@(_libDocs)" TargetPath="lib\$(NetCoreAppCurrent)" />

Nothing guarantees that we aren't omitting dependencies here, and that isn't validated until the transport package reaches ASP.NET.

We do validate dependencies for our own shared framework:
https://github.com/dotnet/arcade/blob/44324e2d3563921f60b1522fccf3fef45dcfe636/src/Microsoft.DotNet.SharedFramework.Sdk/targets/sharedfx.targets#L437-L464

We could do this for the ASP.NET transport package as well, ensuring we pass the files that are part of the base shared framework as candidates. We could do the same for a WindowsDesktop transport package, should we produce one in the future.

Author:	ericstj
Assignees:	-
Labels:	area-Infrastructure-libraries, untriaged
Milestone:	-

[ViktorHofer]

Today we publish a shared framework package for ASP.NET and include an arbitrary set of files

Since this was opened another transport package for WindowsDesktop was added and there underlying infrastructure was changed from binplacing and pkgproj to NuGet Pack Task and ProjectReferences. Based on the P2P protocol what you describe is now probably less of an issue but it would still be great to add closure validation at some point.

Definitely not a high prio IMO.