MSBuild SDK resolver tries to validate SHA for a SDK package which fails restore when using packages.lock.json

[bergbria]

Details about Problem

dotnet.exe --version: 2.2.100

Suppose I have a project P that uses nuget sdk N and N has never been installed on the machine.

If P does not contain a packages.lock.json file, dotnet restore --use-lock-file will succeed.
If P does have a lock file, dotnet restore --use-lock-file will print errors the first time, then succeed on subsequent runs

Detailed repro steps so we can see the same problem

1. Unzip lockFile_spuriousError_repro.zip somewhere on your machine.

2. Run repro.bat

...

After debugging through the code a bit, the issue comes to a head in ValidatePackagesSha512(PackagesLockFile lockFile, LockFile assetsFile). The method effectively checks that all the hashes in the in-memory assets.json object match those in the lock file. This normally works fine since the sdk packages aren't actually written to either file. However, in the degenerate case, the SDK package appears in assetsFile for some reason (though the sdk package is never included in the generated file). In this case, the error is produced since lockFile has no corresponding hash.

[jainaashish]

the issue is it tries to validate SHA during SDK resolver because SDK resolver also internally calls restore API.