Legalize .NET - Which NuGet Packages belongs to .NET 5/6 and which licenses are relevant?

[Stefan75]

Hello,

I have some questions to legalize .NET 5/6/.x

Today:

• Our product is currently based on .NET Framework 4.8
  (WPF, WinForms, ...)
• We have legalized .NET Framework 4.8 so that it can be used (checking license, ...).
• For all other dependencies we are doing the same:
  1. Selecting a package (e.g. binary drop, NuGet Package, ...)
  2. Checking License
  3. Document that we are using this package.
  4. Ensure that we comply with licensing obligations.
  5. Make it accessible for development
     (e.g. publish the packages to a private NuGet feed)

Now we want to migrate to .NET5/6/x:

• My impression is that .NET is now distributed over a larger number of small NuGet packages
  (System.Collections.Immutable, System.IO.Packaging)
• In my humble opinion it does not make sense to legalize each package for its own.
  I think it make sense to legalize the .NET "core" packages as a bundle together.
  (they share the same license, they belong together)
• I think for more optional packages or third party packages the current process makes still sense.
  (legalize each NuGet package individually)

I hope that explains the context of my questions:

1. Are my observations and conclusions correct?
2. . What is the connection between the following "conceptualizations":
   a. Framework References (e.g. Microsoft.WindowsDesktop.App)
   b. Package References
   c. Runtimes (e.g. .NET Runtime 5.0.11, ASP.NET Core Runtime 5.0.11, .NET Desktop Runtime 5.0.11)
   Is one of them already such a bundle?
   3.It is possible to define a .NET 5 / 6 (and for future versions as well) bundle of all "core" NuGet packages?
   Does such a bundle already exist (e.g. via meta-pckage)?
3. If yes, how? :)
4. Is it possible to version such a bundle?
   e.g. 5.0.1, 5.0.10 and find all correct versions of the sub NuGet packges?
5. Which bundles do make sense?
   e.g. Desktop with WPF, ASP.NET, EF, ...

With best regards,
stefan

---

Addional observation:

• If I create a new .NET 6 desktop application without extra dependency there is a dependency to
  System.ComponentModel.Annotations (via Microsoft.NETCore.App)
  It seems that in this dependency no NuGet was involved
• If I add dependency to the NuGet package ReactiveProperty it seems that there is an additional transitive dependency to System.ComponentModel.Annotations added.
  It seems that in this case NuGet was involved which is confirmed by the Package Manager Console output

=> It seems for me that there are two ways for dependencies:
One is without NuGet via Microsoft.NETCore.App and one is with NuGet via transitive NuGet dependencies
In the second case I have to ensure that our private NuGet feed contains System.ComponentModel.Annotations

[danmoseley]

@richlander do you want to take a shot at this question?

[huoyaoyuan]

My impression is that .NET is now distributed over a larger number of small NuGet packages

This was the distribution of .NET Core 1.x. Nowadays major libraries are shipped with a pack included in installer.

In my humble opinion it does not make sense to legalize each package for its own.
I think it make sense to legalize the .NET "core" packages as a bundle together.

Everything installable from the official installer should share the same license I think.

I think for more optional packages or third party packages the current process makes still sense.

Yes. Every NuGet package can contain their license information in nupkg metadata, and you can check them.

Are my observations and conclusions correct?
Basically, no.

What is the connection between the following "conceptualizations":
Is one of them already such a bundle?

As my understand, they are representation of the same things at different stages.
Some bundle may ship separately, the BCL, ASP.NET, WindowsDesktop runtimes are included in official installer.

Is it possible to version such a bundle?
e.g. 5.0.1, 5.0.10 and find all correct versions of the sub NuGet packges?

The main bundles don't ship separately. The version like 5.0.9 references them all.

Addional observation:

The NuGet version is mainly for compatibility with older frameworks. It redirects to the bundled version on higher frameworks.

[Stefan75]

Thanks for the reply and some insights.

If .NET Runtime, ASP.NET Core Runtime, .NET Desktop Runtime are bundles which are distributed via .NET runtime and sdk downloads, then I can legalize each of them as such a bundle. Maybe even together.

If the same content is also distributed via several NuGet packages for compatibility reasons, I have to ensure that they are all imported in our private NuGet stream. If those NuGet packages have really the same content. then I would need a mapping between the existing runtime/sdk bundles and the matching NuGet packages.

Something like:
.NET Runtime is distributed via:

• Runtime abc
• SDK abc
• Following x NuGet packages:
  System.ComponentModel.Annotations, ...

Is such a mapping available?

With best regards,
stefan

[Stefan75]

@danmoseley @richlander
Can someone from .NET / Microsoft help?