Multiple projects in source-build-externals building with out of date SDKs

[ericstj]

The following will resolve to out-of-support SDKs. I think we should patch them:
https://github.com/dotnet/dotnet/blob/960c0fea76ef2f4f8ca9dfac59a0fdf6faa54a5c/src/source-build-externals/src/repos/src/abstractions-xunit/global.json#L3-L4
https://github.com/dotnet/dotnet/blob/960c0fea76ef2f4f8ca9dfac59a0fdf6faa54a5c/src/source-build-externals/src/repos/src/newtonsoft-json/Src/global.json#L3-L4

How does this not cause a problem for source-build today? Is it because we force a difference CLI to be used and we invoke it outside these root folders?

[MichaelSimons]

Source-build updates the SDK version in the repo's global.json file of all repositories to the toolset SDK version used for building. This happens during the build. For source-build-externals, all of the global.json files in the submodules gets updated. The version of the SDK used to build can vary and is not known until build time. Patching the version is not scalable and would be a maintenance burden.

[ericstj]

I'm not suggesting that we patch in source control. Source-build already applies patches during the build. It could happen at that time to have the desired effect.

If you don't do this you'll be faced with false positive alerts from CG once those go live.

[ericstj]

IMO it's also a bug that the SDK doesn't even mention anything about this. I filed dotnet/sdk#49231

[ericstj]

Another option here would be to patch in a removal of the submodule's global.json if it is not used, or a removal of the SDK version section that's not sued.

[ViktorHofer]

Moving to dotnet/source-build as this is SB specific.