sdk: Restore fails if netstandard1.x package reference is present

SDK version: 3.0.100-preview4-010963

repro:

clone https://github.com/RssBandit/RssBandit
cd source/RssBandit
dotnet restore

  Persisting no-op dg to C:\dev\RssBandit\source\ChildProjects\IEControl\obj\IEControl.csproj.nuget.dgspec.json
  Persisting no-op dg to C:\dev\RssBandit\source\RssBandit.AppServices\obj\RssBandit.AppServices.csproj.nuget.dgspec.json
  Persisting no-op dg to C:\dev\RssBandit\source\NewsComponents\obj\NewsComponents.csproj.nuget.dgspec.json
  Persisting no-op dg to C:\dev\RssBandit\source\RssBandit\obj\RssBandit.csproj.nuget.dgspec.json
  Restore completed in 22.85 ms for C:\dev\RssBandit\source\RssBandit.AppServices\RssBandit.AppServices.csproj.
  Restore completed in 22.83 ms for C:\dev\RssBandit\source\ChildProjects\IEControl\IEControl.csproj.
  Restore completed in 26.1 ms for C:\dev\RssBandit\source\NewsComponents\NewsComponents.csproj.
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605: Detected package downgrade: System.Runtime.InteropServices from 4.3.0 to 4.1.0. Reference the package directly from the project to select a different version. 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Console 4.0.0 -> runtime.win.System.Console 4.3.0 -> System.Runtime.InteropServices (>= 4.3.0) 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Runtime.InteropServices (>= 4.1.0)
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605: Detected package downgrade: System.Runtime.Extensions from 4.3.0 to 4.1.0. Reference the package directly from the project to select a different version. 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.IO.FileSystem 4.0.1 -> runtime.win.System.IO.FileSystem 4.3.0 -> System.Runtime.Extensions (>= 4.3.0) 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Runtime.Extensions (>= 4.1.0)
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605: Detected package downgrade: System.Runtime.InteropServices from 4.3.0 to 4.1.0. Reference the package directly from the project to select a different version. 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.IO.FileSystem 4.0.1 -> runtime.win.System.IO.FileSystem 4.3.0 -> System.Runtime.InteropServices (>= 4.3.0) 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Runtime.InteropServices (>= 4.1.0)
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605: Detected package downgrade: System.IO.FileSystem from 4.3.0 to 4.0.1. Reference the package directly from the project to select a different version. 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Net.Sockets 4.1.0 -> runtime.win.System.Net.Sockets 4.3.0 -> System.IO.FileSystem (>= 4.3.0) 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.IO.FileSystem (>= 4.0.1)
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605: Detected package downgrade: System.Net.NameResolution from 4.3.0 to 4.0.0. Reference the package directly from the project to select a different version. 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Net.Sockets 4.1.0 -> runtime.win.System.Net.Sockets 4.3.0 -> System.Net.NameResolution (>= 4.3.0) 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Net.NameResolution (>= 4.0.0)
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605: Detected package downgrade: System.Net.Primitives from 4.3.0 to 4.0.11. Reference the package directly from the project to select a different version. 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Net.Sockets 4.1.0 -> runtime.win.System.Net.Sockets 4.3.0 -> System.Net.Primitives (>= 4.3.0) 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Net.Sockets 4.1.0 -> System.Net.Primitives (>= 4.0.11)
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605: Detected package downgrade: System.Runtime.Extensions from 4.3.0 to 4.1.0. Reference the package directly from the project to select a different version. 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Net.Sockets 4.1.0 -> runtime.win.System.Net.Sockets 4.3.0 -> System.Runtime.Extensions (>= 4.3.0) 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Runtime.Extensions (>= 4.1.0)
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605: Detected package downgrade: System.Runtime.InteropServices from 4.3.0 to 4.1.0. Reference the package directly from the project to select a different version. 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Net.Sockets 4.1.0 -> runtime.win.System.Net.Sockets 4.3.0 -> System.Runtime.InteropServices (>= 4.3.0) 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Runtime.InteropServices (>= 4.1.0)
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605: Detected package downgrade: System.Runtime.InteropServices from 4.3.0 to 4.1.0. Reference the package directly from the project to select a different version. 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Diagnostics.Process 4.1.0 -> Microsoft.Win32.Primitives 4.0.1 -> runtime.win.Microsoft.Win32.Primitives 4.3.0 -> System.Runtime.InteropServices (>= 4.3.0) 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Runtime.InteropServices (>= 4.1.0)
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605: Detected package downgrade: System.Runtime.InteropServices from 4.3.0 to 4.1.0. Reference the package directly from the project to select a different version. 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.IO.FileSystem.Watcher 4.0.0 -> Microsoft.Win32.Primitives 4.0.1 -> runtime.win.Microsoft.Win32.Primitives 4.3.0 -> System.Runtime.InteropServices (>= 4.3.0) 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Runtime.InteropServices (>= 4.1.0)
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605: Detected package downgrade: System.Runtime.Extensions from 4.3.0 to 4.1.0. Reference the package directly from the project to select a different version. 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Net.NameResolution 4.0.0 -> System.Net.Primitives 4.0.11 -> runtime.win.System.Net.Primitives 4.3.0 -> System.Runtime.Extensions (>= 4.3.0) 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Runtime.Extensions (>= 4.1.0)
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605: Detected package downgrade: System.Runtime.InteropServices from 4.3.0 to 4.1.0. Reference the package directly from the project to select a different version. 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Net.NameResolution 4.0.0 -> System.Net.Primitives 4.0.11 -> runtime.win.System.Net.Primitives 4.3.0 -> System.Runtime.InteropServices (>= 4.3.0) 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Runtime.InteropServices (>= 4.1.0)
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605: Detected package downgrade: System.Runtime.Extensions from 4.3.0 to 4.1.0. Reference the package directly from the project to select a different version. 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Net.Requests 4.0.11 -> System.Net.Primitives 4.0.11 -> runtime.win.System.Net.Primitives 4.3.0 -> System.Runtime.Extensions (>= 4.3.0) 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Runtime.Extensions (>= 4.1.0)
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605: Detected package downgrade: System.Runtime.InteropServices from 4.3.0 to 4.1.0. Reference the package directly from the project to select a different version. 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Net.Requests 4.0.11 -> System.Net.Primitives 4.0.11 -> runtime.win.System.Net.Primitives 4.3.0 -> System.Runtime.InteropServices (>= 4.3.0) 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Runtime.InteropServices (>= 4.1.0)
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605: Detected package downgrade: System.Runtime.Extensions from 4.3.0 to 4.1.0. Reference the package directly from the project to select a different version. 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Net.Sockets 4.1.0 -> System.Net.Primitives 4.0.11 -> runtime.win.System.Net.Primitives 4.3.0 -> System.Runtime.Extensions (>= 4.3.0) 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Runtime.Extensions (>= 4.1.0)
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605: Detected package downgrade: System.Runtime.InteropServices from 4.3.0 to 4.1.0. Reference the package directly from the project to select a different version. 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Net.Sockets 4.1.0 -> System.Net.Primitives 4.0.11 -> runtime.win.System.Net.Primitives 4.3.0 -> System.Runtime.InteropServices (>= 4.3.0) 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Runtime.InteropServices (>= 4.1.0)
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605: Detected package downgrade: System.Runtime.InteropServices from 4.3.0 to 4.1.0. Reference the package directly from the project to select a different version. 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Net.NameResolution 4.0.0 -> System.Security.Principal.Windows 4.0.0 -> Microsoft.Win32.Primitives 4.0.1 -> runtime.win.Microsoft.Win32.Primitives 4.3.0 -> System.Runtime.InteropServices (>= 4.3.0) 
C:\dev\RssBandit\source\RssBandit\RssBandit.csproj : error NU1605:  RssBandit -> NewsComponents -> log4net 2.0.8 -> System.Runtime.InteropServices (>= 4.1.0)
  Restore failed in 467.8 ms for C:\dev\RssBandit\source\RssBandit\RssBandit.csproj.

EDIT by @dsplaisted: This is the workaround for this bug:

<PackageReference Include="Microsoft.NETCore.Targets" Version="2.1.0" ExcludeAssets="all" PrivateAssets="all" />

About this issue

Original URL
State: open
Created 5 years ago
Comments: 33 (20 by maintainers)

Commits related to this issue

workaround https://github.com/dotnet/sdk/issues/3044#issuecomment-476795447 — committed to RssBandit/RssBandit by deleted user 5 years ago
Add workaround for https://github.com/dotnet/sdk/issues/3044 — committed to RssBandit/RssBandit by deleted user 5 years ago
Update dependencies from https://github.com/dotnet/cli build 20191002.11 (#3044) - Microsoft.DotNet.Cli.Runtime - 5.0.100-alpha1.19502.11 — committed to dotnet/sdk by dotnet-maestro[bot] 5 years ago
Magic "Fix" for package downgrade when building self contained targetting a runtime. https://github.com/dotnet/sdk/issues/3044 https://github.com/dotnet/runtime/issues/47110#issuecomment-764887101 — committed to IgnosAs/IgnosCncSetupAgent by tthorsen 2 years ago

Most upvoted comments

A better workaround than adding a reference to Microsoft.NETCore.App is probably to reference Microsoft.NETCore.Targets:

<PackageReference Include="Microsoft.NETCore.Targets" Version="2.1.0" ExcludeAssets="all" PrivateAssets="all" />

dsplaisted on Jun 4, 2019

It’s also possible to hit this if you end up with dependencies on contracts from different “bands” of .NET Core 1.x. log4net happens to have these dependencies directly, but it could happen with other combinations of packages. These references also cause the issue:

    <PackageReference Include="System.IO.FileSystem" Version="4.0.1" />
    <PackageReference Include="System.Reflection" Version="4.3.0" />

dsplaisted on May 2, 2019

I am not even sure how exactly this fix works.

Well, Microsoft.NETCore.Targets has been almost empty since 5.0.0, hence why it was removed later.

You can use Nuget.org Package Explorer to see its contents here: https://nuget.info/packages/Microsoft.NETCore.Targets/5.0.0

It has a lib folder, which contains a netstandard1.0 folder. It used to then contain a runtimes.json file in that folder that stated the runtimes the library targeting netstandard1.0 could run against.

Can some please shed some light on it?

I can’t speak to why Microsoft stopped publishing Microsoft.NETCore.Targets, or why your particular solution works here.

What Else Can I Say?

There is no one, good explanation of how to manage dependencies in .NET. The whole system is just at least as bad as any other major ecosystem out there.

A good introduction to versioning limitations in .NET is Jon Skeet’s blog post of the same name
- But there are some things not explained in that post. For example, most widely used libraries set the assembly version so that it follows <MajorVersion>.0.0.0 to prevent runtime minor version assembly load conflicts across “diamond dependencies”. EFCore, Newtonsoft.Json and other major libraries follow this approach. This is NOT the same as the nuget package version. So, sometimes when people talk about versioning limitations, they are only referring to assembly load conflicts, and other times they are referring to linking and loading a package written for one targetFramework against another.
Another good talk on versioning is the contrarian viewpoint by Rich Hickey, titled Spec-ulation
Another good perspective is what Google does in Bazel/Blaze build system. All transitive dependencies that are actual dependencies need to be explicit.
Java developers further improve this situation with BND, which allows specifying co-constraints on versions so that versions are resolved through constraint satisfaction.

jzabroski on Nov 16, 2022

A simple repro for this is simply a .NET Core console app with a RuntimeIdentifier and a reference to the log4net package:

<Project Sdk="Microsoft.NET.Sdk">

  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>netcoreapp3.0</TargetFramework>
    <RuntimeIdentifier>win-x86</RuntimeIdentifier>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="log4net" Version="2.0.8" />
  </ItemGroup>

</Project>

The problem is that the log4net package depends on System.Runtime.Serialization.Formatters version 4.3.0, but on the 4.0.x or 4.1.x versions of a lot of other contracts. With a RID specified, RID-specific dependencies get injected which cause package downgrades such as the following:

error NU1605: Detected package downgrade: System.Runtime.InteropServices from 4.3.0 to 4.1.0. Reference the package directly from the project to select a different version. error NU1605: consoletest -> log4net 2.0.8 -> System.Console 4.0.0 -> runtime.win.System.Console 4.3.0 -> System.Runtime.InteropServices (>= 4.3.0) error NU1605: consoletest -> log4net 2.0.8 -> System.Runtime.InteropServices (>= 4.1.0)

To fix this, we may need something like https://github.com/NuGet/Home/issues/7344. We thought an “empty” Microsoft.NETCore.App package could help with this, but because it doesn’t have a runtime.json with RID-specific references to the 2.x equivalents of “runtime packs”, it didn’t fix the issue in the same way that the explicit reference to the 2.2.0 package suggested as a workaround here did.

dsplaisted on Apr 30, 2019

The design for runtime packs and targeting packs is covered by dotnet/designs#50. It is already implemented. NuGet/Home#7344 is about a very specific piece allowing a way to ask nuget to exclude packages that are overridden by platform. It is not as simple as you suggest because there is a deliberate requirement for “targeting packs” to not be so coupled to nuget.

nguerrera on Sep 23, 2019

+1 on this, still getting customer reports of this issue. I thought we agreed to fix this by bringing in the empty packages? Now I see you’ve linked this to a NuGet feature to dummy out packages. Would love that feature, don’t get me wrong, but we asked for the same thing in 2.0 and didn’t get it (and thus we have conflict resolution). What’s your plan to solve this problem in 3.0. This is a regression from 2.1.

ericstj on Aug 2, 2019

This should be fixed when we do https://github.com/dotnet/cli/issues/10105. Previously I thought that trimming previous NuGet packages would merely be a perf optimization and conflict resolution would handle selecting the right assets. However this demonstrates a case where there is a functional failure if we don’t trim previous packages an old bug can resurface with .NET Core 1.x package references when a RID is specified.

@onovotny I believe adding the following PackageReference to RssBandit.csproj should work around the issue:

<PackageReference Include="Microsoft.NETCore.App" Version="2.2.0" ExcludeAssets="all" PrivateAssets="all" />

dsplaisted on Mar 26, 2019

Im having a similar issue today. A simple repro is to create a .NET 6.0 project and add a reference to latest CloudNative.CloudEvents package.

Debug and publishing goes as expected for me (on win 11 with VS2022), but as soon as I try to build the auto-scaffolded Dockerfile, I get dozens of downgrade messages due to:

... -> Microsoft.Extensions.DependencyModel 2.1.0 -> Microsoft.DotNet.PlatformAbstractions 2.1.0 -> System.IO.FileSystem 4.0.1 -> runtime.win.System.IO.FileSystem 4.3.0

... -> Microsoft.Extensions.DependencyModel 2.1.0 -> Microsoft.DotNet.PlatformAbstractions 2.1.0 -> System.IO.FileSystem 4.0.1 -> System.IO.FileSystem.Primitives (>= 4.0.1)

Please help!

cdavernas on Apr 21, 2022

@jzabroski Exact version matching (and binding redirects to get around it) are required on .NET Framework, but not on .NET Core. So the issues you refer to (which were indeed painful) are mostly solved for .NET Core.

dsplaisted on Apr 30, 2019

Referencing current HEAD in case it moves between now and repro investigation: https://github.com/RssBandit/RssBandit/commit/628bd5ce8bac111f3a9d7000355b8ca70b94b7b2

nguerrera on Mar 26, 2019