LZMA generation based on restore result may miss packages

[natemcmaster]

Today, we generate the package LZMA by generating a csproj with package references, running restore, and zipping up the contents of the .nuget folder. This approach may miss packages.

Problems:

• Hard to define multiple versions of one package. dotnet-restore resolves version conflicts by picking one. This means dotnet-restore may not download multiple versions of packages, even though they are needed for the LZMA.
• Exclusions. Although we don't do this today, we may want to ensure certain packages/versions are excluded from the LZMA

Suggestion:

• Generate the LZMA from a flat list of packages/versions
• Add tests that assert the qualities of the LZMA we desire. Examples
  • The LZMA should contain the transitive closure of package X for framework Y
  • The LZMA should not contain packages named "*-servicing"
  • The LZMA should include well known package XYZ
  • The LZMA should contain only signed packages
  • etc.

cc @JunTaoLuo

[natemcmaster]

The root of the problem was addressed by this refactoring #1245.