.NET 8: Establish downstream / upstream guidance

[richlander]

Upstream is an established concept within open source. To a large degree, the .NET project has been operating in alignment with the upstream model. However, very little has ever been written down or communicated about that. We should fix that. The introduction of the Virtual Mono Repo (VMR; #2924) is the perfect opportunity for that.

There are a few obvious aspects of that:

• Better clarity on the changes that we'll accept, particularly that won't be included in Microsoft-provided builds.
• Better separation between Microsoft and community builds (example).
• Make it much easier for any party to build .NET SDK w/o a significant upfront investment. This includes making it easier to create a short- or long-term fork.
• Removing unnecessary product friction like RIDs.
• Support model/group for distro-maintainers.
• Publicly documented model for CVE handling and pre-disclosure.

[dotnet-issue-labeler]

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[MichaelSimons]

[Triage] @richlander, @mmitche - Aside from creating the VMR has any traction been made on this? Is the remaining work in scope for .NET 8.0 or .NET 9.0?

[mmitche]

I am re-scoping this issue into a few issues:

• Infrastructure changes that are moving to .NET 9
• Infrastructural and documentation changes around CVE disclosure that should be completed in the .NET 8 timeframe + "soft" changes that should be completed .NET 8 around documentation

The RID graph removal has been completed.