ASP.NET security update broke build

Oct 17, 2014 at 10:34 AM
Edited Oct 17, 2014 at 11:39 AM
Hello all. First of all - love this project. It's made our builds 75% faster!

A few days ago, this security update was pushed to our machines. This update removes System.Web.Mvc.dll version 3.0.0.0 from the GAC and replaces it with version 3.0.0.1.

Since we use RazorGenerator, which has a reference to Mvc 3.0.0.0, our build is currently broken due to not being able to run FxCop anymore. The application itself works fine, but FxCop seems to validate indirect references.

Is there anything we can do about this, or will there be a new release of RazorGenerator to accomodate the critical security update?

Thanks in advance!

edit: just to add, we managed to fix our build using the solution described in this blogpost. Would prefer not to have to do that though :-)
Coordinator
Oct 17, 2014 at 5:09 PM
Is it the file version or the assembly version that changed? Also, can you give the precise error message that you're getting?

Generally, there are lots of components that reference MVC3, and this security update should not force all of them to be rebuilt against the new one. If it does, then they have a deeper problem.
Coordinator
Oct 17, 2014 at 8:15 PM
Do the steps listed at - http://blogs.msdn.com/b/webdev/archive/2014/10/16/microsoft-asp-net-mvc-security-update-broke-my-build.aspx - resolve the issue without having to modify FxCop settings?
Oct 20, 2014 at 10:00 AM
Edited Oct 20, 2014 at 10:01 AM
Thanks for your replies.

@davidebbo:
This is the error we were getting:
8>MSBUILD : error : CA0001 : The following error was encountered while reading module 'FrontEnds.MyFE.Implementation': Assembly reference cannot be resolved: System.Web.Mvc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35. [C:\TFS\Product\03 - FrontEnds\FrontEnds.MyFE\02-Implementation\02-Implementation.csproj]
8>MSBUILD : error : CA0058 : The referenced assembly 'System.Web.Mvc, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' could not be found. This assembly is required for analysis and was referenced by: C:\Deliverables\FrontEnds.MyFE\bin\FrontEnds.MyFE.Implementation.dll. [C:\TFS\Product\03 - FrontEnds\FrontEnds.MyFE\02-Implementation\02-Implementation.csproj]
Also, I think this means the assembly version changed.

@pranavkm:
These steps do not fix our issues. This is because the reference to System.Web.Mvc version 3.0.0.0 are indirect; they are not direct references from our project.
Coordinator
Oct 20, 2014 at 3:47 PM
As I see it, this seems like a general problem that would happen if any component uses MVC 3.0.0.0, and then you use that component. So whatever is the right answer to the problem should be orthogonal to RazorGenerator, which is just one arbitrary instance of the problem.

You should comment on that post if their suggest approach doesn't work.
Oct 20, 2014 at 7:05 PM
@davidebbo: I agree, and I have. Was just letting you guys know. For now our problem is "solved", but we would prefer not to have to resort to such FxCop flags. Mostly because it's non-standard though, since I do not really see a big downside to disabling indirect reference checking.