Home: packages.config package.lock.json uses an incorrect target framework

[fabio-muramatsu]

Details about Problem

NuGet product used (NuGet.exe | VS UI | Package Manager Console | dotnet.exe): nuget.exe

NuGet version (x.x.x.xxx): 5.8.0.6930

OS version (i.e. win10 v1607 (14393.321)): Windows 10 v20H2

Worked before? If so, with which NuGet version: Yes, in version 5.5.1.6542

Detailed repro steps so we can see the same problem

1. Create an empty console application targetting .NET Framework 4.7.2
2. Install a nuget package (like Newtonsoft.Json)
3. Enable package restore using lock file in csproj

<PropertyGroup>
  <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
</PropertyGroup>

1. Get the nuget.exe client for both versions listed above (5.5.1.6542 and 5.8.0.6930). Run nuget restore in the solution. The packages.lock.json files generated will be different.

For 5.5.1.6542, I get this:

{
  "version": 1,
  "dependencies": {
    ".NETFramework,Version=v4.7.2": {
      "Newtonsoft.Json": {
        "type": "Direct",
        "requested": "[12.0.3, 12.0.3]",
        "resolved": "12.0.3",
        "contentHash": "6mgjfnRB4jKMlzHSl+VD+oUc1IebOZabkbyWj2RiTgWwYPPuaK1H97G1sHqGwPlS5npiF5Q0OrxN1wni2n5QWg=="
      }
    }
  }
}

For 5.8.0.6930, I get this:

{
  "version": 1,
  "dependencies": {
    "Any,Version=v0.0": {
      "Newtonsoft.Json": {
        "type": "Direct",
        "requested": "[12.0.3, 12.0.3]",
        "resolved": "12.0.3",
        "contentHash": "6mgjfnRB4jKMlzHSl+VD+oUc1IebOZabkbyWj2RiTgWwYPPuaK1H97G1sHqGwPlS5npiF5Q0OrxN1wni2n5QWg=="
      }
    }
  }
}

As a consequence, restoring an existing project using locked mode in 5.8.0.6930 is resulting in failures, which broke our Azure Devops pipelines.

[nkolev92]

@fabio-muramatsu

Are you using a legacy project or an SDK based one?

[nkolev92]

Synced-up offline.

The project is legacy.

@dominoFire Can you take a quick look and verify this issue?
This sounds like a potential regression.

[dominoFire]

In my local devbox, I have the same result with both nuget.exe versions. Note that I'm using MSBuild 16.8 to run both versions.

Sample line

.\nuget.5.5.exe restore -verbosity detailed -MSBuildVersion 16.8 .\consoleapp1.sln

Output:

{
  "version": 1,
  "dependencies": {
    ".NETFramework,Version=v4.7.2": {
      "Newtonsoft.Json": {
        "type": "Direct",
        "requested": "[12.0.3, 12.0.3]",
        "resolved": "12.0.3",
        "contentHash": "6mgjfnRB4jKMlzHSl+VD+oUc1IebOZabkbyWj2RiTgWwYPPuaK1H97G1sHqGwPlS5npiF5Q0OrxN1wni2n5QWg=="
      }
    },
    ".NETFramework,Version=v4.7.2/win": {},
    ".NETFramework,Version=v4.7.2/win-x64": {},
    ".NETFramework,Version=v4.7.2/win-x86": {}
  }
}

Use repro.ps1 to run the sample project.

ConsoleApp2.zip

@fabio-muramatsu Could you please provide a sample repro case?

[dominoFire]

Confirmed offline with @fabio-muramatsu . I can repro by using a Console App with packages installed using packages.config

[dominoFire]

Also happens when restoring with MSBuild 16.7:

.\nuget.5.8.exe restore -verbosity detailed -MSBuildVersion 16.7 .\TestRestore.sln

Thus, the bug might be on nuget.exe 5.8

[zkat]

@dominoFire could you also try this with nuget.exe 5.7?

[dominoFire]

@zkat This issue does not happen in nuget.exe 5.7

[aortiz-msft]

@nkolev92 - Would you please investigate based on @dominoFire's results?

[nkolev92]

Quick investigation:

I can confirm the problem. nuget.exe 5.7 works differently from nuget.exe 5.8.

I found a few other issues on the way.

Here are the 3 issues I am aware of:

• nuget.exe restore modifies the lock file. This is normal in PackageReference but should never happen in packages.config. Only install/uninstall/update should modify the lock file afaik. Furthermore restore modifies the lock file and exits with 0.
• msbuild.exe restore /p:RestorePackagesConfig=true does not consider the lock files at all. This has never worked.
• The TFM is incorrectly detected with 5.8 to 5.7, which is the root problem @fabio-muramatsu is hitting.

[nkolev92]

PR out in https://github.com/NuGet/NuGet.Client/pull/3763.

Revisiting the above 2 issues(3rd one is the customer report):

• nuget.exe restore modifies the lock file. - Turns out this is by design, although if you ask me a bad one, but it is what it is :) https://github.com/NuGet/Home/wiki/Packages.config-SHA-Validation#generating-the-lock-file

• msbuild.exe restore /p:RestorePackagesConfig=true does not consider the lock files at all. - https://github.com/NuGet/Home/issues/10268

[nkolev92]

Hey @fabio-muramatsu

If possible, we'd appreciate it you can help us confirm that your issue is addresed by testing out https://dist.nuget.org/win-x86-commandline/v5.9.0-preview.2/nuget.exe

[vweevers]

I had the same issue (Any,Version=v0.0) with nuget 5.8.0.6930 in GitHub Actions. Can confirm that 5.9.0-preview.2 fixes it 👍

[fabio-muramatsu]

@nkolev92 Sorry for the delay. I can confirm it's generating the right lock file using 5.9.0-preview.2. Thank you!