No dependency from System.Security.Cryptography.Pkcs to Microsoft.Bcl.Cryptography causes X509CertificateLoader issues in .Net 10

[johnthcall]

Description

System.Security.Cryptography.Pkcs 10.0.2 (and other 10.x.x versions) has a dependency on Microsoft.Bcl.Cryptography in versions before net10.0 but has no dependencies in net10.0 as a result any code written in a library using Microsoft.Bcl.Cryptography via a transitive dependency and compiled as pre-net10 and then used via projectreference in a net10 project fails due to System.IO.FileNotFoundException: 'Could not load file or assembly 'Microsoft.Bcl.Cryptography'

Reproduction Steps

1. Make ClassLibrary1 project targeting net8 and <PackageReference Include="System.Security.Cryptography.Pkcs" Version="10.0.2" />
2. Add the Utilities.cs below to ClassLibrary1

namespace ClassLibrary1
{
    using System;
    using System.Security.Cryptography.X509Certificates;

    public static class Utilities
    {
        public static X509Certificate2 Parse(string clientSecret)
        {
            return X509CertificateLoader.LoadCertificate(Convert.FromBase64String(clientSecret));
        }
    }
}

3. Make ConsoleApp1 project targeting net10 and ProjectReference to ClassLibrary1
4. Update program.cs in ConsoleApp1 below

namespace ConsoleApp1
{
    using ClassLibrary1;

    class Program
    {
        static void Main(string[] args)
        {
            // Self-Signed cert, not a secret
            var cert = Utilities.Parse("MIICtTCCAZ2gAwIBAgIJAIBtw/Sm5KB2MA0GCSqGSIb3DQEBCwUAMBoxGDAWBgNVBAMTD1Rlc3RDZXJ0aWZpY2F0ZTAeFw0yNjAzMjUwMzI0MjlaFw0yNzAzMjUwMzI0MjlaMBoxGDAWBgNVBAMTD1Rlc3RDZXJ0aWZpY2F0ZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKoHhZk4TDwumRR3zJmL398aCwwgKC2PJOxhR9WKf0DxAwnFLKMtAnX3SOBh5evzH98J7Bpd3yPmwxCafjM3tp6N3V7CBK0mWkIRSUIXLi0+K+DyH2cXnPqSt71TVik9xGIIyjrKMDUrD70BvHwqR0IRTvLHfUSSjbosbprRYLjj+1eFRRapMWSi1HRZqvIvp1qtqKdMawp01qUIuARYCbHsCKmrlMCSd+CrvaiioZJcpBJqkNtqwaOgmzyE3iG6fpR04g+m+xE/ZATHaTyqc25HDu0bes/NrU62s0oFbPreWv4nKBOHVUGlhBnHTrKPLbB3AAZvtFgSGVt4LOKI7xkCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAfjmzmwf+nXaUjk9YLuxnDKOu5C9N/sQr/F5F1a11D1Ml9K/0q2gv0U4whbT+OB3oTj7RP8ONXTghd9OHiygxYWXe+rEF7xayoAlsC9BAEvl4ZjWxBnUKi8sEnMKhugmptc5ltXk4t1H8Kp+I6gwT85Y1yH99zJbrDvd5BEQRvsNabvnBvjYeIX+tAHiKLJ0fxzf8gM/vhEf1dn+RrXoVL6O2KxJho9S/avnN+lRGyOdWG9ZhVbjZGTTllQwJzycanb+VRFTh0ugidYcFj/MdW9hlOtnyHTFoGStvhfS8FK9x2ZwjBNQd1unRvdh0VHXD2KM5IWuPgyMH2bTuG04dOA==");
        }
    }
}

5. Run app and see 'Microsoft.Bcl.Cryptography' FileNotFound

Expected behavior

Microsoft.Bcl.Cryptography.dll used in ClassLibrary1 exists in ConsoleApp1's output folder.

Actual behavior

Microsoft.Bcl.Cryptography.dll is not copied to ConsoleApp1's output folder as the transitive dependency from System.Security.Cryptography.Pkcs does not apply in net10.0

Regression?

If ConsoleApp1 is net8 or net9 there are no issues.

Known Workarounds

Add an explicit dependency in either ConsoleApp1 or ClassLibrary1 to Microsoft.Bcl.Cryptography 10.0.2

Configuration

Net SDK 10.0.105
Windows 11
x64

Other information

No response

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

[vcsjones]

So, here is "why" this happens.

X509CertificateLoader exposed in Microsoft.Bcl.Cryptography for downlevel platforms (.NET 8, .NET Framework). Starting in .NET 9, this class is inbox - it's built in to the runtime in the System.Security.Cryptography assembly.

For M.B.C, when targeting .NET 9+, it does not include this type in the assembly, it has a type forward saying "I am not in M.B.C anymore, I am in S.S.C, go look there".

For S.S.C.Pkcs, it also targets "downlevel", .NET 8 and .NET Framework. Since it wants to use X509CertificateLoader in .NET 8, it includes a package reference to M.B.C.

---

Okay, so in ClassLibrary1 which targets .NET 8, you are loading S.S.C.Pkcs, and using X509CertificateLoader from M.B.C. Since it comes in as a transitive dependency, it's available from the NuGet package.

In ConsoleApp1, which targets .NET 10, you have a ProjectReference to ClassLibrary1 (.NET 8). Since your console application is targeting .NET 10, the System.Security.Cryptography.Pkcs project resolves to the .NET 10 reference. S.S.C.Pkcs for .NET 10 does not add a reference to M.B.C because it doesn't need it - but you transitively need it.

The type forward doesn't work because it needs M.B.C to even find the TypeForwardedTo.

---

It's not clear to me if this is expected behavior or not. Adding an explicit dependency to M.B.C in S.S.C.Pkcs even in .NET 10 would work so that the type forward attribute is always found. On the other hand, that increases the output size for really no great reason other than "Go look somewhere else for this type".

@ericstj I would be curious for your take here.