P2P libraries in project.assets.json file have incorrect Version

[eerhardt]

Details about Problem

NuGet product used (NuGet.exe | VS UI | Package Manager Console | dotnet.exe): dotnet restore3

NuGet version (x.x.x.xxx):

>dotnet nuget --version
NuGet Command Line
3.6.0.0

dotnet.exe --version (if appropirate):
1.0.0-preview3-003855

VS version (if appropriate):

OS version (i.e. win10 v1607 (14393.321)):

Worked before? If so, with which NuGet version: dotnet restore with a project.json

Detailed repro steps so we can see the same problem

1. Have 2 projects: App and Library. App has a ProjectReference to Library.
2. Set Library's $(Version) to 2.3.4.
3. Restore App.csproj
4. Inspect App's project.assets.json file:

    "Library/1.0.0": {
      "type": "project",
      "path": "../Library/Library.csproj",
      "msbuildProject": "../Library/Library.csproj"
    }

P2PTest.zip

Expected Result

I expect Library should have a version of 2.3.4.

[eerhardt]

/cc @emgarten @rrelyea

[rrelyea]

How is this version used?
Is this blocking RC?
RC2 ok?

[eerhardt]

We use the project assets file information to generate the .deps.json file - specifically we use:

1. The TargetLibrary Name
2. The TargetLibrary Version
3. The TargetLibrary's Dependencies
4. The LockFileLibrary's MSBuildProject to match it with other MSBuild info about the P2P reference.

So if this Version is wrong, then the library's version in the .deps.json is going to be wrong.

Looking through https://github.com/dotnet/core-setup/tree/master/src/corehost code, I don't think the host needs the version number to be correct for "project" libraries, since these aren't resolved from the NuGet cache. @schellap @gkhanna79 - can you confirm?

The other place that reads the .deps.json file is ASPNET code. @pranavkm @pranavkm @anurse - Do you see the "project" library's version number being incorrect in the .deps.json file as a blocker for RC?

[pranavkm]

cc @pakrym in case he knows more. We don't use the Version component of DependencyContext in Mvc (just the name). So this shouldn't affect AspNetCore.

[pakrym]

I don't think type:project dependency version is used anywhere right now.

[schellap]

The host is agnostic to the type of the asset (package, project etc.) It uses a probing order given package name and version which forms the identity (meaning what) -- this can be found in the NuGet cache (meaning where) if it appears there first.

[rrelyea]

Moving to RC2, yell if that is too late.