Update Roslyn's transitive dependency on System.Formats.Asn1

[marcpopMSFT]

This impacts 17.8, 17.10, and 17.11. The binary does not ship in the SDK but is pulled into the deps.json from Microsoft.Build->System.Security.Crytpography.Pkcs->System.Formats.Asn1.

There is no newer version of 7.0.0 so you'll have to pin to 8.0.1 I think though you should investigate what impact that'll have. Alternatively, you can get MSBuild to fix this and just update their version. Note that you appear to reference three different versions of MSBuild in 17.10/11 depending on whether you're building for netfx or source build.

17.8
Roslyn\Microsoft.Build.Tasks.CodeAnalysis.deps.json: "System.Formats.Asn1/6.0.0": {c

17.10
17.11
Roslyn\Microsoft.Build.Tasks.CodeAnalysis.deps.json: "System.Formats.Asn1/7.0.0": {

[marcpopMSFT]

CC @rainersigwald @JanKrivanek in case MSBuild has plans to fix the 17.3, 17.7, and 17.10 versions.

[ericstj]

We should try to get dependencies that tasks don't ship out of their deps files. They don't need to be there.

[jaredpar]

Is there anything we can do to get them out or is this tooling at a layer above us?

[rainersigwald]

The MSBuild packages are already referenced with ExcludeAssets="runtime" which I was hoping would also drop 'em from the .deps.json. I think that's an SDK feature request.

We could certainly hack around the deps.json generation to drop them.

Although: do the Roslyn tasks do anything funny with the .deps.json? Should we just not ship it in the SDK?

[jaredpar]

Although: do the Roslyn tasks do anything funny with the .deps.json? Should we just not ship it in the SDK?

Not to my knowledge.

Does your ALC management code consider .deps.json?

[rainersigwald]

Yes; if it's present we feed it to AssemblyDependencyResolver. But that should mostly only be relevant if you have RID-specific assets you want to use, like native dependencies, which I don't think Roslyn has.

[jaredpar]

Can we document when it is isn't needed? If we fit in the docs of "don't need" is there a way we can suppress it being generated?I'm a bit loath about deleting it from the build dir. Maybe we could delete it when we deploy in the SDK.

[marcpopMSFT]

CC @dsplaisted So do we think the solution here is to just not ship the deps.json? What scenarios is that task used in and can we test out deleting the deps.json in a local install and running through some of those scenarios to make sure that works?
<GenerateDependencyFile>false</GenerateDependencyFile> should suppress the file from being generated.

[rainersigwald]

It's used when any of the tasks defined in that .dll are <UsingTasked, so just "building a couple of projects with and without the compiler server" should be a pretty good test.

[rainersigwald]

Can we document when it is isn't needed?

Yeah we should dotnet/msbuild#10531. In short it's only required if you have RID-specific dependencies.

[jaredpar]

Moved the conversation over to msbuild. This issue will track the audit suppression I add in the short term

dotnet/msbuild#10656