are dependencies promoted in .net assembly manifests?

Question

I build an assembly with VS2010, and it has a plain vanilla reference to .NET 4.0.

It also has a reference to Ionic.Zip, which has a reference to .NET 2.0.

When I look at the manifest with ildasm, I see both versions of .NET as direct dependencies of my assembly, plus 2.0 listed again under the Ionic assembly.

Is this normal, or is there some 2.0 dependency that I'm just failing to see?

Answer 1

This is normal, you'll see .NET 2.0 assembly references for any framework classes that are exposed by the public types in the legacy assembly. For example, a class library project compiled in VS2008 with this code:

using System;
using System.Text;

public class Class1 {
    public static void Run(out StringBuilder sb) {
        sb = new StringBuilder();
    }
}

And used in a VS2010 console mode app that targets 4.0:

using System;
using System.Text;

class Program {
    static void Main(string[] args) {
        StringBuilder sb;
        Class1.Run(out sb);
    }
}

Produces assembly references in its manifest like this:

// Metadata version: v4.0.30319
.assembly extern mscorlib
{
  .publickeytoken = (B7 7A 5C 56 19 34 E0 89 )                         // .z\V.4..
  .ver 4:0:0:0
}
.assembly extern ClassLibrary3
{
  .ver 1:0:0:0
}
.assembly extern mscorlib as mscorlib_2
{
  .publickeytoken = (B7 7A 5C 56 19 34 E0 89 )                         // .z\V.4..
  .ver 2:0:0:0
}

Note the reference to the 2.0 version of mscorlib, named "mscorlib_2". This is resolved at runtime. There is no sign from the fusion log that it was ever asked to resolve the mscorlib_2 assembly reference. The StringBuilder class object that get created is the 4.0 version. Which probably means that the CLR assembly loader is redirecting the version. I'm not aware of any config that does the mapping, guessing at this being hard-coded.

This is of course potentially breaking behavior for the code that was only ever tested with v2.0-v3.5sp1 versions of the .NET assemblies. I haven't heard of a single case yet.