For 2.1-rc1, examine the set of prebuilt packages for dependencies that need to be cut

[dagood]

Here's a list of prebuilt nuget packages from my local offline build of #418: https://gist.github.com/dagood/752e2037c46d33969f1a1e9d6639322f

[dagood]

A comparison vs. a 2.0 release tarball's set of prebuilts: https://gist.github.com/dagood/384a35e0faa943566b4df78a3ea97720.

There are a ton of new prebuilt packages. A decent number look like Microsoft build dependencies that we can dummy out, like microbuild.*, xunit.*, stylecop.analyzers, vswhere, opencover, and windowsazure.storage.

Here are a few that seem a little more questionable. I looked in the per-repo package caches after building a recent HEAD with /p:ArchiveDownloadedPackages=true, and grepped project.assets.json files for some of them to see where they're used:

• fsharp.core/4.3.4 (in main packages, used in fsharp's "buildtools" folder)
• newtonsoft.json/10.0.3 (in main packages, used by dotnet/buildtools)
• newtonsoft.json/6.0.4 (in main packages, used by vstest)
• newtonsoft.json/8.0.3 (in templating packages, used (only) by templating)
• Lots of corefx and core-setup packages.
• More nuget.* packages.

I saw these empty directories in bin/obj/x64/Release/nuget-packages which suggests the package dir redirection isn't working for them: cli, clicommandlineparser, cli-migrate, common, coreclr, corefx, core-setup, fsharp, javascriptservices, known-good, msbuild, netcorecli-fsc, roslyn-tools, sdk, standard, symreader, symreader-portable, vstest, websdk.

---

@dseefeld @crummel @dleeapho, any broader context about how to evaluate these, and how much we need to trim back for preview2?

An idea I have is to put together a report of every single prebuilt with every project.assets.json that lists it. (Since project.assets.json is created by nuget as an end result of restore, it seems pretty safe to me to rely on it.) Do you think that would that be useful?

[dleeapho]

I like the idea of the report. Might be of interest to @omajid also.

[dagood]

Filed #461 for report generation. (Leaving this issue as-is, tracking either looking at the report or examining the prebuilts without one if necessary.)

[dagood]

Here are the reports from a build based on #489: cli-reports.zip.

[dagood]

We looked at the prebuilt usage report for an offline tarball build on 16a2bab (v2.1.0-rc1) and wrote up notes in UsageSummary.xml: https://gist.github.com/dagood/d8166b3af1af66795bf1cc86ba759040.

There's some extra information available in that report--the tooling to add that's in PR here: #523.

[eerhardt]

@dseefeld @dleeapho @dagood - Is there a reason this issue is closed? I would have thought we would remove some of these dependencies for source-build.

For example: opencover and coveralls.io are only used for code coverage in tests, which we obviously don't need during source-build. I think we should remove the dependencies on these packages/tools.

[dagood]

Yes, there are many packages pointed out in the report that we could remove, including those. This issue tracked examining the prebuilt package set, which we did--removing prebuilts is tracked by #307. (Decomposing the annotated report into however many issues we need would be useful, but I figure that can happen when someone's actually starting to cut out the prebuilts and they can group them into issues how it makes sense to them.)