System.Security.Cryptography.Cng netstandard 2.0 version is incorrect

[weshaggard]

see https://github.com/dotnet/corefx/issues/25766

The netstandard 2.0 version is currently 4.3.1.0 but the netcorepp 2.0 version is 4.3.0.0. Given the netstandard2.0 is supported on netcoreapp2.0 the versions need to match. One of two things needs to happen:

1. The NS2.0 ref needs to be frozen to 4.3.0.0 to match what is inbox on netcoreapp2.0
2. We need to ship a newer version of the library that works on netcoreapp2.0 in the nuget package OOB, that has version 4.3.1.0

Given there isn't any new API surface I suggest we go with option (1) in the future if we need to add new API then we can decide to unfreeze it and also update our netcoreapp2.0 implementation to match.

cc @bartonjs @ericstj

[weshaggard]

The issue was caused by PR dotnet/corefx#23168. It looks like we have the same issue for OpenSsl.

[chaami]

Hi,
I have hit a wall around this issue with a net4.6.2 test project in targeting a netstandard2.0 library.
I get the following error when trying to execute the tests:

Message: System.IO.FileLoadException : Could not load file or assembly 
'System.Security.Cryptography.Cng, Version=4.3.0.0, Culture=neutral, 
PublicKeyToken=b03f5f7f11d50a3a' or one of its dependencies.
The located assembly's manifest definition does not match the assembly reference. (Exception from HRESULT: 0x80131040)

I believe this comes because the NuGet installed bundles different versions of the Dll:
In the current non preview version (4.5.0.0) of System.Security.Cryptography.Cng, we get
the 4.3.2.1 version for netcoreapp2.1, net4.6.1, net4.6.2 net4.7.2 targets whereas the netstandard 2.0 version is served with 4.3.0.0 (I believe you the goal of this issue was to freeze it to that right ?)
Incidently the version is 4.0.0.0 for net46 (but I am selfishly discard this as I am not concerned...).

I tried to solve this with an binding redirect in the testing library like this one:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="System.Security.Cryptography.Cng" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />
        <bindingRedirect oldVersion="0.0.0.0-4.3.1.0" newVersion="4.3.0.0" />
      </dependentAssembly>
    </assemblyBinding>
  </runtime>
</configuration>

But this wouldn't work as the _CopyFilesMarkedCopyLocal target would always overwrite the dll in the bin directory with the 4.3.1.0 version.
The only way to workaround this was to build the library in double targets net4.6.2 and netstandard2.0.

Has the winter been too cold and the freezing remained when it should have been removed ?
Could you please push a version of the the NuGet with the versions correctly aligned or explain to me what I am missing ?

Thanks in advance and kind regards.