msbuild: ResolveAssemblyReferences does not work with PackageReference

I’ve been trying to update som of our existing projects to use the new PackageReference format to include nuget packages. One of them is a WPF application using ClickOnce. We been able to use workarounds found to make all project compile and run with the exception of projects with clickonce enabled.

The problem seems to be that libraries coming from nuget packages are marked included as “Prerequisite (auto)” in ClickOnce instead of “Include (auto)” which is problematic.

1. This prevents them from beeing automatically included in the clickonce manifest
2. This makes build fail when referencing libraries which are not strongly signed

Others seems to have this issue: I found this https://stackoverflow.com/questions/46736788/clickonce-application-with-packagereferences-auto-to-prerequisites which seems to concern the same issue.

This has previously been reported at https://github.com/NuGet/Home/issues/6116 but was closed since it was the wrong repository.

If might be possible to work around by checking the “ReferenceCopyLocalPaths” or “_ReferencesFromNuGetPackages” and mark instead of just checking the Private Flag.

It seems the Target ResolveNuGetPackageAssets is the origin of the References with Private=true which causes ResolveAssemblyReferences to fail. See https://github.com/NuGet/NuGet.BuildTasks/blob/1d8af3499f94a32c1d128a42faceade39c1f4337/src/Microsoft.NuGet.Build.Tasks/ResolveNuGetPackageAssets.cs#L791

Steps to reproduce

In VS 2017 (15.4 or earlier) build the “HttpClient.sln” solution found att https://github.com/Daniel-Svensson/OpenRiaPlayground/tree/feature/clickonce_repro/HttpClient

Build log is availible at https://github.com/Daniel-Svensson/OpenRiaPlayground/raw/feature/clickonce_repro/HttpClient/clickonce_failure.buildlog

Expected behavior

1. The solution should build successfully
2. The manifest file should include all nuget references as installd

Actual behavior

1. Nuget references are market as Prerequisite

C:\Users\crmdas\.nuget\packages\openriaservices.client.core\4.5.0\lib\net45\OpenRiaServices.DomainServices.Client.Web.dll
    AssemblyType = Managed
    CopyLocal = false
    DependencyType = Prerequisite
    FusionName = OpenRiaServices.DomainServices.Client.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=null
    ImageRuntime = v4.0.30319
    IsPrimary = true
    NuGetIsFrameworkReference = false
    NuGetPackageId = OpenRiaServices.Client.Core
    NuGetPackageVersion = 4.5.0
    NuGetSourceType = Package
    OriginalItemSpec = C:\Users\crmdas\.nuget\packages\openriaservices.client.core\4.5.0\lib\net45\OpenRiaServices.DomainServices.Client.Web.dll
    Private = false
    ReferenceAssembly = C:\Users\crmdas\.nuget\packages\openriaservices.client.core\4.5.0\lib\net45\OpenRiaServices.DomainServices.Client.Web.dll
    ReferenceSourceTarget = ResolveAssemblyReference
    ResolvedFrom = {RawFileName}
    Version = 4.0.0.0

1. Build fails if reference is not strong named

Errors
    C:\Program Files (x86)\Microsoft Visual Studio\2017\Professional\MSBuild\15.0\Bin\Microsoft.Common.CurrentVersion.targets(3743,5): error MSB3188: Assembly 'C:\Users\crmdas\.nuget\packages\openriaservices.client.core\4.5.0\lib\net45\OpenRiaServices.DomainServices.Client.Web.dll' must be strong signed in order to be marked as a prerequisite. [C:\Dev\github\Daniel-Svensson\OpenRiaPlayground\HttpClient\WpfClient\WpfClient.csproj]
    C:\Program Files (x86)\Microsoft Visual Studio\2017\Professional\MSBuild\15.0\Bin\Microsoft.Common.CurrentVersion.targets(3743,5): error MSB3188: Assembly 'C:\Users\crmdas\.nuget\packages\openriaservices.client.core\4.5.0\lib\net45\OpenRiaServices.DomainServices.Client.dll' must be strong signed in order to be marked as a prerequisite. [C:\Dev\github\Daniel-Svensson\OpenRiaPlayground\HttpClient\WpfClient\WpfClient.csproj]

Environment data

Visual Studio 2017 15.4+