Pin System.Formats.Asn

[JanKrivanek]

Fixes https://devdiv.visualstudio.com/DevDiv/_componentGovernance/DotNet-msbuild-Trusted/alert/9977351?typeId=6797870&pipelinesTrackingFilter=0

Context

Lets pin System.Formats.Asn, till the System.Security.Cryptography.Pkcs is available and updated

[rainersigwald]

I think you'll also need to add one of these sections

msbuild/eng/Version.Details.xml

Lines 34 to 39 in 85d1d66

	<!-- Necessary for source-build. This allows the package to be retrieved from previously-source-built artifacts
	and flow in as dependencies of the packages produced by msbuild. -->
	<Dependency Name="System.Reflection.MetadataLoadContext" Version="8.0.0">
	<Uri>https://dev.azure.com/dnceng/internal/_git/dotnet-runtime</Uri>
	<Sha>5535e31a712343a63f5d7d796cd874e563e5ac14</Sha>
	</Dependency>

so sourcebuild can flow the right versions.

[JanKrivanek]

I added the dependency via:

darc add-dependency --name "System.Formats.Asn1" --version 8.0.1 --type "product" --repo "https://dev.azure.com/dnceng/internal/_git/dotnet-runtime" --commit "bf5e279d9239bfef5bb1b8d6212f1b971c434606"

I'm bit blurry on following - and would appreciate info or documentation pointers (tagging @dotnet/source-build-internal to chime in here):

• How should the SHA be obtained? I suppose for runtime I just grab SHA for appropriate tag - e.g. https://github.com/dotnet/runtime/tree/v8.0.1, right?
• When adding new product dependency, should I allways make sure it exist in SBRP and if not (case here), add it via https://github.com/dotnet/source-build-reference-packages?tab=readme-ov-file#adding-new-packages?

[mthalman]

I added the dependency via:

darc add-dependency --name "System.Formats.Asn1" --version 8.0.1 --type "product" --repo "https://dev.azure.com/dnceng/internal/_git/dotnet-runtime" --commit "bf5e279d9239bfef5bb1b8d6212f1b971c434606"

I'm bit blurry on following - and would appreciate info or documentation pointers (tagging @dotnet/source-build-internal to chime in here):

• How should the SHA be obtained? I suppose for runtime I just grab SHA for appropriate tag - e.g. https://github.com/dotnet/runtime/tree/v8.0.1, right?
• When adding new product dependency, should I allways make sure it exist in SBRP and if not (case here), add it via https://github.com/dotnet/source-build-reference-packages?tab=readme-ov-file#adding-new-packages?

Since you've defined the dependency using darc, it's set up perfectly. And since this dependency comes from runtime, which is built before msbuild in the VMR, this prebuilt will only occur in the msbuild repo's build, not the VMR's build. For that reason, it's acceptable to simply configure this as an allowed prebuilt rather than defining this package in SBRP.