Sdl tasks failing with .NET 5

[Anipik]

I am trying to enable the policheck for runtime repo. In the runtime repo, we use global.json file to download the latest sdk and use this.

But it seems like policheck is not compatible with the lastest sdk and require 2.2 sdk.

Build ID: https://dev.azure.com/dnceng/internal/_build/results?buildId=579800

The specified framework can be found at:
  - https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=2.2.0&arch=x64&rid=win10-x64
D:\a\1\s\.packages\Microsoft.Guardian.Cli.0.7.2\tools\guardian.cmd baseline --working-directory D:\a\1 --name mainbaseline
D:\a\1\s\.dotnet
It was not possible to find any compatible framework version
The framework 'Microsoft.NETCore.App', version '2.2.0' was not found.
  - The following frameworks were found:
      5.0.0-preview.3.20167.12 at [D:\a\1\s\.dotnet\shared\Microsoft.NETCore.App]

You can resolve the problem by installing the specified framework and/or SDK.

• This issue is blocking
• This issue is causing unreasonable pain

This issue is blocking effort for enabling policheck for the runtime repo

cc @sunandabalu @ericstj

[ViktorHofer]

@markwilkie it seems Policheck needs a 2.x SDK installed. I would suggest that we lift this requirement and do either one of these:

• Consume a self-contained version of Policheck
• Bootstrap the required SDK to run automatically, similar to the auto injected "Run Codesign Validation" step or
• Allow the tool to rollforward on Major versions IF we are sure that a dotnet SDK is installed in all the pipelines that invoke Policheck.

[markwilkie]

Any insight @sunandabalu ?

[ericstj]

cc @davidknise

[davidknise]

Hey guys, I don't believe PoliCheck has the requirement, but Guardian.

The "Run Codesign Validation" step is running the "Use .NET Core" code to resolve to version 2.2.402. You could add that build step before running Guardian to resolve this.

We also offer a standalone windows package, so you could update the install step instead:
Microsoft.Guardian.Cli.win10-x64

We are working on updating Guardian and the additional toolset to 3.1.201 and will be installing both 2.2.402 and 3.1.201 on our Guardian build tasks for a period of time.

[ericstj]

@davidknise what are your thoughts on updating Gaurdian's runtimeconfig.json to permit roll-forward in case the target runtime is not present? .NETCore 2.2 isn't an LTS release and is currently out of support: https://dotnet.microsoft.com/platform/support/policy/dotnet-core

[davidknise]

@ericstj "We are working on updating Guardian and the additional toolset to 3.1.201 and will be installing both 2.2.402 and 3.1.201 on our Guardian build tasks for a period of time."

Permit roll-foward would be great, and I didn't know that was an option. Guardian doesn't have or emit that file. Since we're in the dotnet org here on GitHub, do you happen to know what the associated MSBuild property is for this?

[ericstj]

Using the 3.0 SDK you can use <RollForward>Major</RollForward> Double check that you get the expected change to your .runtimeconfig.json to be sure you have the SDK that supports this.

@vitek-karas also shared lots of good pointers here: dotnet/docs#12237 (comment)