Move Sdk from the dotnet-8 to a new dotnet-8-sdk package

[debasishbsws]

Fixes: #17580

For new package PRs only

• the PR is marked as related to a pre-existing package request bug, such as a dependency

[debasishbsws]

Can not able to resolve CVE

[debasishbsws]

Found it all the CVE are showing up because of one package of NuGet that was in older version link

🔎 Scanning "/tmp/artifacts-1/packages/x86_64/dotnet-8-sdk-8.0.204-r0.apk"
├── 📄 /usr/share/dotnet/sdk/8.0.204/cs/NuGet.CommandLine.XPlat.resources.dll
│       📦 NuGet.CommandLine.XPlat 6.0.0.278 (dotnet)
│           Medium CVE-2022-30184 GHSA-3885-8gqc-3wpf fixed in 6.0.2
│
├── 📄 /usr/share/dotnet/sdk/8.0.204/cs/NuGet.Commands.resources.dll
│       📦 NuGet.Commands 6.0.0.278 (dotnet)
│           Medium CVE-2022-30184 GHSA-3885-8gqc-3wpf fixed in 6.0.2
│           High CVE-2023-29337 GHSA-6qmf-mmc7-6c2p fixed in 6.0.5
│           High CVE-2022-41032 GHSA-g3q9-xf95-8hp5 fixed in 6.0.3
│
├── 📄 /usr/share/dotnet/sdk/8.0.204/cs/NuGet.Common.resources.dll
│       📦 NuGet.Common 6.0.0.278 (dotnet)
│           High CVE-2023-29337 GHSA-6qmf-mmc7-6c2p fixed in 6.0.5
│
├── 📄 /usr/share/dotnet/sdk/8.0.204/cs/NuGet.PackageManagement.resources.dll
│       📦 NuGet.PackageManagement 6.0.0.278 (dotnet)
│           High CVE-2023-29337 GHSA-6qmf-mmc7-6c2p fixed in 6.0.5
│
├── 📄 /usr/share/dotnet/sdk/8.0.204/cs/NuGet.Packaging.resources.dll
│       📦 NuGet.Packaging 6.0.0.278 (dotnet)
│           Critical CVE-2024-0057 GHSA-68w7-72jg-6qpp fixed in 6.0.6
│
├── 📄 /usr/share/dotnet/sdk/8.0.204/cs/NuGet.Protocol.resources.dll
│       📦 NuGet.Protocol 6.0.0.278 (dotnet)
│           High CVE-2023-29337 GHSA-6qmf-mmc7-6c2p fixed in 6.0.5
│           High CVE-2022-41032 GHSA-g3q9-xf95-8hp5 fixed in 6.0.3
│
├── 📄 /usr/share/dotnet/sdk/8.0.204/de/NuGet.CommandLine.XPlat.resources.dll
│       📦 NuGet.CommandLine.XPlat 6.0.0.278 (dotnet)
│           Medium CVE-2022-30184 GHSA-3885-8gqc-3wpf fixed in 6.0.2
│
├── 📄 /usr/share/dotnet/sdk/8.0.204/de/NuGet.Commands.resources.dll
│       📦 NuGet.Commands 6.0.0.278 (dotnet)
│           Medium CVE-2022-30184 GHSA-3885-8gqc-3wpf fixed in 6.0.2
│           High CVE-2023-29337 GHSA-6qmf-mmc7-6c2p fixed in 6.0.5
│           High CVE-2022-41032 GHSA-g3q9-xf95-8hp5 fixed in 6.0.3
│
├── 📄 /usr/share/dotnet/sdk/8.0.204/de/NuGet.Common.resources.dll
│       📦 NuGet.Common 6.0.0.278 (dotnet)
│           High CVE-2023-29337 GHSA-6qmf-mmc7-6c2p fixed in 6.0.5
│
├── 📄 /usr/share/dotnet/sdk/8.0.204/de/NuGet.PackageManagement.resources.dll
│       📦 NuGet.PackageManagement 6.0.0.278 (dotnet)
│           High CVE-2023-29337 GHSA-6qmf-mmc7-6c2p fixed in 6.0.5
│
├── 📄 /usr/share/dotnet/sdk/8.0.204/de/NuGet.Packaging.resources.dll
│       📦 NuGet.Packaging 6.0.0.278 (dotnet)
│           Critical CVE-2024-0057 GHSA-68w7-72jg-6qpp fixed in 6.0.6
│
├── 📄 /usr/share/dotnet/sdk/8.0.204/de/NuGet.Protocol.resources.dll
│       📦 NuGet.Protocol 6.0.0.278 (dotnet)
│           High CVE-2023-29337 GHSA-6qmf-mmc7-6c2p fixed in 6.0.5
│           High CVE-2022-41032 GHSA-g3q9-xf95-8hp5 fixed in 6.0.3
│
├── 📄 /usr/share/dotnet/sdk/8.0.204/es/NuGet.CommandLine.XPlat.resources.dll
│       📦 NuGet.CommandLine.XPlat 6.0.0.278 (dotnet)
│           Medium CVE-2022-30184 GHSA-3885-8gqc-3wpf fixed in 6.0.2
│
├── 📄 /usr/share/dotnet/sdk/8.0.204/es/NuGet.Commands.resources.dll
│       📦 NuGet.Commands 6.0.0.278 (dotnet)
│           Medium CVE-2022-30184 GHSA-3885-8gqc-3wpf fixed in 6.0.2
│           High CVE-2023-29337 GHSA-6qmf-mmc7-6c2p fixed in 6.0.5
│           High CVE-2022-41032 GHSA-g3q9-xf95-8hp5 fixed in 6.0.3
│...
...
...

[kaniini]

The SDK should be built from the same sources as the runtime, as one of the build artifacts. Splitting it out would be inconsistent with every other distribution of .NET.

[debasishbsws]

@kaniini Okay, I understand.

The issue occurred with the PowerShell package update PR it required the sdk version 8.0.204 where in the dotnet/dotnetv8.0.4 release we have the version 8.0.104 of the SDK

Can you suggest what should I do here?
I know there is another repo dotnet/installer which include the new SDK v8.0.104 but the docs suggest to build dotnet-8 from dotnet/dotnet package