System.Security.Cryptography.Xml.dll file version downgrade between 8.0.7 and 8.0.8

[mecsco]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

Following an upgrade from 8.0.7 to 8.0.8 of a Microsoft.NET.Sdk.Web project that uses the runtime target win-x86 (self-contained), it was observed that System.Security.Cryptography.Xml.dll was being removed when running an MSI upgrade.

The reason is essentially the same as dotnet/runtime#82518 due to the file version decreasing

Comparing the various file / product versions, I observe:

• C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.8 has 8.0.524.21615
• C:\Program Files (x86)\dotnet\shared\Microsoft.AspNetCore.App\8.0.7 has 8.0.724.31311

Expected Behavior

No response

Steps To Reproduce

No response

Exceptions (if any)

No response

.NET Version

8.0.8

Anything else?

No response

[wtgodbe]

@ericstj this looks like we shipped an 8.0.5 version of System.Security.Cryptography.Xml w/ the 8.0.8 release, do you know if that's the case?

[ericstj]

We shipped System.Security.Cryptography in May - version 8.0.1.

I wonder if we built it with 8.0.1 versioning for multiple months. That could explain this. If the package was being rebuilt with the same version and that version was pulled from the servicing feeds when constructing ASP.NET it would have a higher file version than the publicly shipped one. I see from https://github.com/dotnet/runtime/commits/release/8.0/src/libraries/System.Security.Cryptography.Xml/src
That the package remained at 8.0.1 and was only disabled in July cc @carlossanlop. After it was disabled it would no longer be on the servicing feeds and ASP.NET would go back to picking up the public one.

I think this will coincidentally be fixed with https://github.com/dotnet/runtime/pull/107161/files#diff-96cf205e7d17fc3e8555ab5b26de3d26ae7039db478c09a610202cf1aebe9ca7R8 since that will ship the package again.

[carlossanlop]

I wonder if we built it with 8.0.1 versioning for multiple months

Yes, unfortunately we did, it remained turned on for at least one extra month after it was released. The complexities we had during the release process for 8.0.1 made it difficult to track which packages to keep turned on and which turned off. Apologies for the problems caused.

[wtgodbe]

Closing as the recent 8.0 builds will have resolved the issue