NETSDK1152 Microsoft.NET.Sdk.Web Library with package.lock.json during publishing

[philipborg]

Describe the bug

Projects with Sdk="Microsoft.NET.Sdk.Web and <OutputType>Library</OutputType> causes NETSDK1152 when publishing with package lock. In contrast to Microsoft.NET.Sdk a library with Microsoft.NET.Sdk.Web tries to copy the package.lock.json file to all dependent projects. This causes issues if the dependent project also has a package lock file.

This issue doesn't appear when just using dotnet build.

Temporary workaround in dependency project:

  <ItemGroup>
    <Content Remove="packages.lock.json" />
    <None Include="packages.lock.json" />
  </ItemGroup>

To Reproduce

https://github.com/philipborg/Sdk.Web-PackageLock
Run dotnet publish on the example solution.
Changing Dependency.csproj to <Project Sdk="Microsoft.NET.Sdk"> makes the project able to publish.

Exception

C:\Program Files\dotnet\sdk\6.0.202\Sdks\Microsoft.NET.Sdk\targets\Microsoft.NET.ConflictResolution.targets(112,5): error NETSDK1152: Found multiple publish output files with the same relative path:

Further technical details

• Issue appears on SDK 6.0.102 and 6.0.202 (latest).
  My local installation below.

.NET SDK (reflecting any global.json):
 Version:   6.0.202
 Commit:    f8a55617d2

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.19044
 OS Platform: Windows
 RID:         win10-x64
 Base Path:   C:\Program Files\dotnet\sdk\6.0.202\

Host (useful for support):
  Version: 6.0.4
  Commit:  be98e88c76

.NET SDKs installed:
  3.1.418 [C:\Program Files\dotnet\sdk]
  5.0.402 [C:\Program Files\dotnet\sdk]
  5.0.405 [C:\Program Files\dotnet\sdk]
  5.0.407 [C:\Program Files\dotnet\sdk]
  6.0.100 [C:\Program Files\dotnet\sdk]
  6.0.200 [C:\Program Files\dotnet\sdk]
  6.0.202 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
  Microsoft.AspNetCore.App 3.1.22 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.23 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 3.1.24 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.11 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.14 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 5.0.16 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.0 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.2 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.AspNetCore.App 6.0.4 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
  Microsoft.NETCore.App 3.1.22 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.23 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 3.1.24 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.11 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.14 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 5.0.16 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.0 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.2 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.NETCore.App 6.0.4 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
  Microsoft.WindowsDesktop.App 3.1.22 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 3.1.23 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 3.1.24 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 5.0.11 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 5.0.14 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 5.0.16 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 6.0.0 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 6.0.2 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
  Microsoft.WindowsDesktop.App 6.0.4 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

[ghost]

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[philipborg]

It seems like Sdk.Web always exports package.lock.json to its build output directory unless explicitly excluded in each project.

[KalleOlaviNiemitalo]

Does packages.lock.json come from one of the **\*.json patterns in these:

sdk/src/RazorSdk/Sdk/Sdk.Razor.StaticAssets.ProjectSystem.props

Lines 29 to 37 in 48cdb7a

	<!-- Publish everything under wwwroot, all JSON files, all config files and all Razor files -->
	<Content Include="wwwroot\**" ExcludeFromSingleFile="true" CopyToPublishDirectory="PreserveNewest" Exclude="$(DefaultItemExcludes);$(DefaultExcludesInProjectFolder)" />
	<Content Include="**\*.config" ExcludeFromSingleFile="true" CopyToOutputDirectory="PreserveNewest" CopyToPublishDirectory="PreserveNewest" Exclude="$(DefaultItemExcludes);$(DefaultExcludesInProjectFolder);$(DefaultWebContentItemExcludes)" Condition="'$(ExcludeConfigFilesFromBuildOutput)'!='true'" />
	<Content Include="**\*.json" ExcludeFromSingleFile="true" CopyToOutputDirectory="PreserveNewest" CopyToPublishDirectory="PreserveNewest" Exclude="$(DefaultItemExcludes);$(DefaultExcludesInProjectFolder);$(DefaultWebContentItemExcludes)" Condition="'$(ExcludeConfigFilesFromBuildOutput)'!='true'" />
	<!-- When ExcludeConfigFilesFromBuildOutput is set, do not copy .,config, .json files to the build output directory. -->
	<Content Include="**\*.config" ExcludeFromSingleFile="true" CopyToPublishDirectory="PreserveNewest" Exclude="$(DefaultItemExcludes);$(DefaultExcludesInProjectFolder);$(DefaultWebContentItemExcludes)" Condition="'$(ExcludeConfigFilesFromBuildOutput)'=='true'" />
	<Content Include="**\*.json" ExcludeFromSingleFile="true" CopyToPublishDirectory="PreserveNewest" Exclude="$(DefaultItemExcludes);$(DefaultExcludesInProjectFolder);$(DefaultWebContentItemExcludes)" Condition="'$(ExcludeConfigFilesFromBuildOutput)'=='true'" />

sdk/src/WebSdk/Worker/Targets/Microsoft.NET.Sdk.Worker.props

Lines 23 to 29 in 48cdb7a

	<!-- Publish all JSON and config files -->
	<Content Include="**\*.config" ExcludeFromSingleFile="true" CopyToOutputDirectory="PreserveNewest" CopyToPublishDirectory="PreserveNewest" Exclude="$(DefaultItemExcludes);$(DefaultExcludesInProjectFolder)" Condition="'$(ExcludeConfigFilesFromBuildOutput)'!='true'" />
	<Content Include="**\*.json" ExcludeFromSingleFile="true" CopyToOutputDirectory="PreserveNewest" CopyToPublishDirectory="PreserveNewest" Exclude="$(DefaultItemExcludes);$(DefaultExcludesInProjectFolder)" Condition="'$(ExcludeConfigFilesFromBuildOutput)'!='true'" />
	<!-- When ExcludeConfigFilesFromBuildOutput is set, do not copy .,config, .json files to the build output directory. -->
	<Content Include="**\*.config" ExcludeFromSingleFile="true" CopyToPublishDirectory="PreserveNewest" Exclude="$(DefaultItemExcludes);$(DefaultExcludesInProjectFolder)" Condition="'$(ExcludeConfigFilesFromBuildOutput)'=='true'" />
	<Content Include="**\*.json" ExcludeFromSingleFile="true" CopyToPublishDirectory="PreserveNewest" Exclude="$(DefaultItemExcludes);$(DefaultExcludesInProjectFolder)" Condition="'$(ExcludeConfigFilesFromBuildOutput)'=='true'" />

If so, you could perhaps work around it by adding packages.lock.json to the DefaultExcludesInProjectFolder item type property in Directory.Build.props.

[philipborg]

@KalleOlaviNiemitalo

If so, you could perhaps work around it by adding packages.lock.json to the DefaultExcludesInProjectFolder item type in Directory.Build.props.

I tried adding the following Directory.Build.props and it didn't work. Still get an issue when running dotnet publish in my example project.

<Project>
    <PropertyGroup>
        <DefaultExcludesInProjectFolder>$(DefaultExcludesInProjectFolder);packages.lock.json</DefaultExcludesInProjectFolder>
    </PropertyGroup>
</Project>

[KalleOlaviNiemitalo]

#24063 might be related. On .NET SDK 6, does it work if you set the DefaultItemExcludesInProjectFolder property instead?

[philipborg]

#24063 might be related. On .NET SDK 6, does it work if you set the DefaultItemExcludesInProjectFolder property instead?

Yes! Using SDK 6.0.300 and the following Directory.Build.props I can now run dotnet publish.

<Project>
    <PropertyGroup>
        <DefaultItemExcludesInProjectFolder>$(DefaultItemExcludesInProjectFolder);packages.lock.json</DefaultItemExcludesInProjectFolder>
    </PropertyGroup>
</Project>

So is the answer here then that DefaultItemExcludesInProjectFolder should include packages.lock.json by default in the SDK project file? It also made both Rider and Visual Studio 2022 Enterprise 17.2.2 stop displaying the packages.lock.json in the solution explorer. I don't know whether that's desirable outside of my personal preferences.
I could still run dotnet restore --locked-mode which suggests that it still works.

[KalleOlaviNiemitalo]

I think DefaultItemExcludesInProjectFolder is okay as a workaround that developers can use, but the fix in .NET SDK should be different. Perhaps packages.lock.json could be included in _WebToolingArtifacts, causing it to be removed from the Content item type and added to None. Or change the **\*.json things to exclude packages.lock.json both when adding to the Content item type and when removing from None. I wonder if the same problem also affects some other *.json or *.config files that are not needed at run time; perhaps there should be a new property.

[nkolev92]

NuGet Team Triage: We're getting questions about this issue on the NuGet side as well:
NuGet/Home#13653

@marcpopMSFT
Is the assignment still accurate and can this bug be prioritized for .NET 9?

[marcpopMSFT]

@vijayrkn looks like this is being caused by the web sdk bringing in *.json which includes the package lock. Should the web sdk exclude or should we have a global exclude in the sdk to cover all cases? @dsplaisted

[baronfel]

We should have the path of the project-specific lockfile in the property NuGetLockFilePath, so we should be able to block just this one file via the Excludes safely and correctly if we decide to make this change.

[nkolev92]

I think the NuGetLockFilePath default is applied in the task, so it might need to be either NuGetLockFilePath if set, or packages.lock.json if it isn't.

[baronfel]

Excellent point - would it be possible to lift that defaulting up into the property logic in the future @nkolev92?

[nkolev92]

Yeah, I think so. I can't imagine it'd break anything.

[marcpopMSFT]

Triage: Sounds like from baronfel that we're ok putting this in our SDK potentially as it's a general rule not to include that lock file. We can use the NuGetLockFilePath value if set and use packages.lock.json if not to be a specific as possible.

[nkolev92]

Created a tracking issue for using setting the msbuild property default in the targets file: NuGet/Home#13724.