{"action":"created","issue":{"url":"https://api.github.com/repos/dotnet/cli/issues/1544","repository_url":"https://api.github.com/repos/dotnet/cli","labels_url":"https://api.github.com/repos/dotnet/cli/issues/1544/labels{/name}","comments_url":"https://api.github.com/repos/dotnet/cli/issues/1544/comments","events_url":"https://api.github.com/repos/dotnet/cli/issues/1544/events","html_url":"https://github.com/dotnet/cli/issues/1544","id":135879836,"number":1544,"title":"Stabilize CLI Dependency Package Flow","user":{"login":"piotrpMSFT","id":2379589,"avatar_url":"https://avatars.githubusercontent.com/u/2379589?v=3","gravatar_id":"","url":"https://api.github.com/users/piotrpMSFT","html_url":"https://github.com/piotrpMSFT","followers_url":"https://api.github.com/users/piotrpMSFT/followers","following_url":"https://api.github.com/users/piotrpMSFT/following{/other_user}","gists_url":"https://api.github.com/users/piotrpMSFT/gists{/gist_id}","starred_url":"https://api.github.com/users/piotrpMSFT/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/piotrpMSFT/subscriptions","organizations_url":"https://api.github.com/users/piotrpMSFT/orgs","repos_url":"https://api.github.com/users/piotrpMSFT/repos","events_url":"https://api.github.com/users/piotrpMSFT/events{/privacy}","received_events_url":"https://api.github.com/users/piotrpMSFT/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/dotnet/cli/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":{"login":"eerhardt","id":8291187,"avatar_url":"https://avatars.githubusercontent.com/u/8291187?v=3","gravatar_id":"","url":"https://api.github.com/users/eerhardt","html_url":"https://github.com/eerhardt","followers_url":"https://api.github.com/users/eerhardt/followers","following_url":"https://api.github.com/users/eerhardt/following{/other_user}","gists_url":"https://api.github.com/users/eerhardt/gists{/gist_id}","starred_url":"https://api.github.com/users/eerhardt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eerhardt/subscriptions","organizations_url":"https://api.github.com/users/eerhardt/orgs","repos_url":"https://api.github.com/users/eerhardt/repos","events_url":"https://api.github.com/users/eerhardt/events{/privacy}","received_events_url":"https://api.github.com/users/eerhardt/received_events","type":"User","site_admin":false},"milestone":null,"comments":12,"created_at":"2016-02-23T22:00:28Z","updated_at":"2016-02-23T23:21:52Z","closed_at":null,"body":"## Objective\r\ndotnet/cli needs to achieve and maintain a stable dependency surface area while keeping up with improvements in dependency components. Moving to a private dependency myget feed was a big step in the right direction, ensuring consistent retention policy and fast build times, but is insufficient for CLI to reach production.\r\n\r\n## Requirements\r\n- [ ] CLI build times cannot regress\r\n- [ ] CLI must have control over its build time dependencies so builds are stable.\r\nChanging dependency versions must require going through CI, and existing dependencies cannot disappear from feeds.\r\n\r\n## Enhancements\r\n- [ ] CLI must have immediate access to new builds of external dependencies.\r\nOnce a CoreFx build with an important fix comes out then it can immediately be used in CLI.\r\n- [ ] CLI must have a cohesive closure of dependencies.\r\nAny project in the CLI repo referencing System.Foo must be referencing the same version of System.Foo\r\n- [ ] CLIs closure of dependencies must be intentional.\r\nCLI repo should be able to specify that it depends on NETStandard.Library version X, and the build should ensure that only that version is used.\r\n[e.g. NuGet currently downgrading many of our libraries]"},"comment":{"url":"https://api.github.com/repos/dotnet/cli/issues/comments/187961869","html_url":"https://github.com/dotnet/cli/issues/1544#issuecomment-187961869","issue_url":"https://api.github.com/repos/dotnet/cli/issues/1544","id":187961869,"user":{"login":"piotrpMSFT","id":2379589,"avatar_url":"https://avatars.githubusercontent.com/u/2379589?v=3","gravatar_id":"","url":"https://api.github.com/users/piotrpMSFT","html_url":"https://github.com/piotrpMSFT","followers_url":"https://api.github.com/users/piotrpMSFT/followers","following_url":"https://api.github.com/users/piotrpMSFT/following{/other_user}","gists_url":"https://api.github.com/users/piotrpMSFT/gists{/gist_id}","starred_url":"https://api.github.com/users/piotrpMSFT/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/piotrpMSFT/subscriptions","organizations_url":"https://api.github.com/users/piotrpMSFT/orgs","repos_url":"https://api.github.com/users/piotrpMSFT/repos","events_url":"https://api.github.com/users/piotrpMSFT/events{/privacy}","received_events_url":"https://api.github.com/users/piotrpMSFT/received_events","type":"User","site_admin":false},"created_at":"2016-02-23T23:21:52Z","updated_at":"2016-02-23T23:21:52Z","body":"CLI installers should ship only one version of each library per target. Today we have 15 System.Runtimes that run just atop corefx/coreclr. That needs to be fixed.\r\n\r\nSo long as folks are referencing common libraries correctly [e.g. use the Metapackage where available] CLI can override their dependencies to unify. This will mean, though, that we will need to add false dependencies next to `roslyn` and `nuget` to hoist their dependencies, but that may be the lowest-cost thing to do at the moment."}}