[release/8.0] Update MicrosoftBuildVersion to latest

[github-actions]

Backport of #98006 to release/8.0

/cc @ericstj @LoopedBard3

Customer Impact

• Customer reported
• Found internally

Component governance issue in runtime, due to dependencies MSBuild tasks built in repo.

Regression

• Yes
• No

Testing

Built in main.

Risk

Low - build only dependency. Package version does not appear in shipping assets, nor is binary redistributed.

[ericstj]

@ViktorHofer @MichaelSimons do we need a corresponding SBRP change in servicing to take this? I know we needed changes in main for SBRP when this was made - not sure if we branch that for servicing or not.

I think the SBRP changes were
dotnet/source-build-reference-packages#885
dotnet/source-build-reference-packages#886

[MichaelSimons]

Yes those will need to be backported. Because of all the infrastructure changes made in 9.0, a simple backport will not work without some changes to the project files.

[ericstj]

Source build leg is failing because it needs dotnet/source-build-reference-packages#932.

[MichaelSimons]

Yes those will need to be backported. Because of all the infrastructure changes made in 9.0, a simple backport will not work without some changes to the project files.

I retract this statement after seeing that 4.8.3 is targeting net8.0. Instead, I think we should build with n-1 in source-build (currently 4.8.5). To do this, we would need to add this dependency in the Version.Detail.xml in order to allow source-build to lift it. See https://github.com/dotnet/runtime/blob/release/8.0/eng/Version.Details.xml#L403.

[ericstj]

So it sounds like we need a ToolsetDependencies entry. Can you let me know which version that should be? You're saying 4.8.5 and 4.8.3 - did you mean 17.9.5 and 17.8.3? cc @rainersigwald

[MichaelSimons]

So it sounds like we need a ToolsetDependencies entry.

Yes.

Can you let me know which version that should be? You're saying 4.8.5 and 4.8.3 - did you mean 17.9.5 and 17.8.3?

Sorry I mixed up the version numbers. I meant 17.8.3 and 17.8.5.

It is fine to use 17.8.3.

To conclude, I think the following toolset dependencies should be added. The second is to prevent prebuilts from being reported in the runtime's source-build leg.

<Dependency Name="Microsoft.Build" Version="17.8.3">
  <Uri>https://github.com/dotnet/msbuild</Uri>
  <Sha>195e7f5a3a8e51c37d83cd9e54cb99dc3fc69c22</Sha>
</Dependency>
<Dependency Name="Microsoft.SourceBuild.Intermediate.msbuild" Version="17.8.3-preview-23613-06">
  <Uri>https://github.com/dotnet/msbuild</Uri>
  <Sha>195e7f5a3a8e51c37d83cd9e54cb99dc3fc69c22</Sha>
  <SourceBuild RepoName="msbuild" ManagedOnly="true" />
</Dependency>

[ericstj]

I see - so simply adding those to VersionDetails.xml is enough? Because we're already using MicrosoftBuildVersion for our property sourcebuild will know to set this with the actual version?

[MichaelSimons]

I see - so simply adding those to VersionDetails.xml is enough? Because we're already using MicrosoftBuildVersion for our property sourcebuild will know to set this with the actual version?

That's correct. The VersionDetails.xml entry signals to source-build to use the current version which it does by overriding the Version.props property.

[ericstj]

@MichaelSimons -- looks like this MSBuild version did bring some new prebuilts:

System.Configuration.ConfigurationManager.7.0.0
System.Diagnostics.EventLog.7.0.0
System.Reflection.MetadataLoadContext.7.0.0
System.Security.Cryptography.ProtectedData.7.0.0

Should we resurrect the SBRP change for just those?

[ericstj]

Looks like if we move to 17.9.5 it would have dependencies on 8.0.0 versions of these packages. I wonder if that's the better way to solve this?

[ericstj]

@steveisok -- is there any reason to fast-track this into May release, or is it ok to go in June?

[steveisok]

It resolves a cg alert so taking it now would be preferred.

[ericstj]

/backport to release/8.0

[github-actions]

Started backporting to release/8.0: https://github.com/dotnet/runtime/actions/runs/8712642220