Error in Azure because of netcore 3.1.4 security patch - azure

We build our web app with Azure DevOps pipelines and deploy into Azure with an Azure DevOps release. I think today netcore got updated to netcore 3.1.4 on our build agent. But now our Azure DevOps deployment fails, because the netcore 3.1.4 runtime is not yet installed on our app service in Azure.
The error message we are getting:
Could not find 'aspnetcorev2_inprocess.dll'. Exception message:
It was not possible to find any compatible framework version
The framework 'Microsoft.AspNetCore.App', version '3.1.4' was not found.
- The following frameworks were found:
2.2.8 at [D:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
3.0.3 at [D:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
3.1.1 at [D:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
3.1.3 at [D:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
You can resolve the problem by installing the specified framework and/or SDK.
This makes sense and can happen, but what is the best way to go about fixing this?
I could fix my build to a specific netcore version. But I don't like this, because we do want to keep updating to newer versions, but we don't want a version that is not available in Azure app service.
Am I correct in thinking that we would have to install our services self contained, because otherwise we could get into this issue more often when Azure DevOps is faster with installing patches than Azure?
Or is there a way to force update Azure app service to the new netcore 3.1.4 security patch which would be ideal I think?
I just need some guidance in what is the best approach to fix this issue?

Or is there a way to force update Azure app service to the new netcore 3.1.4 security patch which would be ideal I think?
AFAIK, there is no such a way to force update Azure app service to the new netcore 3.1.4.
We could keep track on the latest releases on the https://aspnetcoreon.azurewebsites.net/, but we could not update it at this moment.
To resolve this issue, we recommend that you publish your app as self-contained produces an application, which includes the .NET Core runtime and libraries, and your application and its dependencies. Users of the application can run it on a machine that doesn't have the .NET Core runtime installed.
Publishing your app as self-contained produces a platform-specific executable. The output publishing folder contains all components of the app, including the .NET Core libraries and target runtime. The app is isolated from other .NET Core apps and doesn't use a locally installed shared runtime. The user of your app isn't required to download and install .NET Core.
You could check this document .NET Core application publishing overview for some more details.
Hope this helps.

If you want version of netcore to be automatically updated as an updated version is available, building our service as self-container seems like a good option: no need to have anything installed on the machine running (ie the version on Azure DevOps and Azure Web App don't have to match).
The main downside of this approach is that the build is going to less deterministic: running your build twice with on the same commit might create different binaries depending on what is currently install on the build agent. if you want to know more, here is an interesting post arguing about why deterministic build is important.
To keep the build determinitic, you can use the Use .Net Core task at the beginning of the build (that will make sure that the desired version of the dotnet sdk is on the agent). You could also add a global.json in your repository to lock for both the build on your dev box and in Azure Dev Ops.

This is a common topic of discussion, and you can find a lot of blogs advocating one or another side.
There were big discussions started when Microsoft released LTS net core 3.1 and it took some time before Azure start supporting the 3.1 runtime as well.
You could find a lot of blogs strongly suggesting to deploy your web apps as self-contained (runtime is ~100MB in size) and cut loose the dependency towards Microsoft supporting the latest runtime. While others advocate that the applications should remain as light weight as possible and the runtime should be set in the pipeline. But that is still up on you. I, myself prefer to deploy self-contained apps after my bad experience with net-core 3.1.
There is no established best practice.

In the past , I've run into the same situation, you can fix this by manually setting the value from RunTime Stack drop down. If you manually update the build processes .yml file
RuntimeStack: 'DOTNETCORE|3.1'

Related

.NET Core 2.1 Azure Functions won't build in Azure Pipelines

I keep getting this error when I try to run the pipelines for my azure backend functions:
[error]C:\Users\VssAdministrator.nuget\packages\microsoft.net.sdk.functions\1.0.27\build\netstandard1.0\Microsoft.NET.Sdk.Functions.Build.targets(41,5): Error : It was not possible to find any compatible framework version
The framework 'Microsoft.NETCore.App', version '2.1.0' was not found.
It's a pretty old program, but yesterday was the first time that the build has failed and I don't know how to fix it. It happens both in the develop and main branch so I'm guessing it's a change from Azure.
As documented in this GitHub issue .NET Core 2.1 has been removed from all build agent images.
Possible impact
If your project depends on a pre-installed .Net 2.1 it can be broken.
You can try to use the setup dotnet task to explicitly install .NET Core 2.1.
- uses: actions/setup-dotnet#v1
with:
dotnet-version: '2.1.x'
Please be advised .NET Core 2.1 has been out of support since August 21, 2021 (see .NET and .NET Core Support Policy). An upgrade to a currently supported version like .NET Core 3.1 or higher should not be a lot of work and is well worth the effort.

Application Insights doesn't work if you have Microsoft.Azure.ServiceBus Nuget package installed

We have an e-commerce ASP .NET MVC application which posts a message in an Azure Service Bus Queue at some point. To interact with the Azure Service Bus we are using Microsoft.Azure.ServiceBus v5.0 package.
Application is hosted in Azure as a WebApp so we are using Application Insights to monitor it but because of the fact that Microsoft.Azure.ServiceBus starting with the version 3.0 has a dependency on System.Diagnostics.DiagnosticSource monitoring is failing (basically nothing is logged to Application Insights).
We found out that this is an known issue:
Troubleshooting Application Insights Agent (formerly named Status Monitor v2)
The question is there are other solutions than downgrade Microsoft.Azure.ServiceBus package to version 2?
Thanks.
As I understand your question correctly, it asks about how to handle this situation where the two nugets have conflicting version requirements for a common child (System.Diagnostics.DiagnosticSource) nuget.
In such cases, you should always use a version of one of the former nugets which has the version of the child nuget version lower as compared to the other. For example, in this case you should use below two compatible nuget packages:

What happens when .NET Core hosting bundle's version is behind development machine versions

Situation
Today there is a security vulnerability in .NET Core 2.1 and we have all of our developers update their .NET Core 2.1.x to .NET Core 2.1.10 but no idea when we'll get around to updating the .NET Core hosting bundles on our production web servers.
Questions
Does the fact that we updated our developer machines become nullified because we haven't updated the web servers yet?
Once our developer's code is pushed to production will those apps run against the older libraries for .NET Core that are on our web servers or will they somehow run in the newer version that our developer machines are building with?
If our projects once pushed to production run under an older version of .NET Core libraries, will we run into compatiblity issues because our developers built against an older version?
I guess my ultimate question is, should we always have a policy in our company to update the hosting bundles on our web servers before we update our development machines?
If you wanna benefit from the update done from .NET Core 2.1.x to .NET Core 2.1.10, I would say : while you don't update the servers, yes.
The apps will try to run under the installed framework on the ervers. If you are publishing using the default mode, your code will depend on the framework installed on your production machines. However, you can change to self contained deployment mode and embed the framework with your code to work on "targeted platform" (https://www.danielcrabtree.com/blog/496/net-core-self-contained-and-framework-dependent-deployments-explained).
It should remain compatible because the versions are both 2.1.x. However I would not try it in production before having tested it in a separated environment.
I believe you should not update your production servers before having tested the new version first. I would change the targeted framework on my development machine, then I would update the framework and the code in (at least) a pre-prod environment. I would test it in this environment. And only then, I would consider a change on the production servers.
Point 3. EDITED based on Daboul comment

.Net Core 2 Service fabric build warnings

I am seeing lots of build warnings essentially saying libraries are being restored from .netstandard for service fabric. I am on a Mac, running my SF cluster on Linux vm per the Microsoft docs
warning NU1701: Package 'Microsoft.ServiceFabric.Services 2.7.198' was restored using '.NETPortable,Version=v0.0,Profile=Profile259, .NETFramework,Version=v4.6.1' instead of the project target framework '.NETCoreApp,Version=v2.0'. This package may not be fully compatible with your project.
My service will deploy to the cluster, but fails to initialize with
Error event: SourceId='System.Hosting',
Property='CodePackageActivation:Code:EntryPoint'.
There was an error during CodePackage activation.The service host terminated with exit code:34304
This post seems to suggest that it is because the vm hosting my cluster is linux, which can't run .net 4.6 libraries, it is erring out.
Is it fair to assume that this is because of the .net standard libaries attempting to run on linux? A bit lost at this time. Any help would be greatly appreciated. Is it possible to run stateful .netcore services on the linux vm?
It seems to be suggested all over the docs, but I haven't seen a full guide for it on linux. All of the Microsoft docs lead to java based services being deployed. I found some yeoman templates for .net core service fabric services, but in another article so no indication these run on linux. Can anyone confirm?

Unable to deploy Orchard Azure project - YSOD fresh off sources

I am deploying Orchard to Azure cloud services (webrole) without any code changes to the official stable release. However, when I navigate to that freshly deployed Orchard cloud service (webrole), I see a YSOD with Could not load file or assembly 'Microsoft.WindowsAzure.ServiceRuntime, Version=1.7.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The system cannot find the file specified.
As a work around, if I enable Local Copy=True (i.e. modify source), then this specific YSOD goes but is replaced by another one for msshrtmi). But more importantly, I'm able to deploy the pre-built downloaded Orchard Azure (1.7, prebuilt off same GIT src tag), without issues, so I'd rather fix the root issue than go down a rabbit hole of workarounds and drift further from the official sources.
How I'm running into this issue:
Download source from GIT (http://orchard.codeplex.com/SourceControl/latest, I used commit 5e0c26f73cf5, )
Run ClickToBuildAzurePackage.cmd script
Edit buildazure\Stage\ServiceConfiguration.cscfg to put in connection string's to point to the real Azure storage account (vs Local Storage).
Deploy both the files in buildazure\Stage to Azure via the windowsazure.com portal
Navigate to site (eg: http://OrchardTest.cloudapp.net)
Enjoy the yellow-screen-of-death :(
Our local build system:
Windows 8, x64
VS2012.3
Azure SDK 1.7, 1.8, 2.0
Question:
Has anyone deployed to Azure successfully? Any ideas how to resolve this issue?
There should never be a need to CopyLocal True on the Azure Service Runtime. That is automatically included in the package, defined by your Cloud Services project (In this case, Orchard.Azure.CloudService). And actually, I could imagine that CopyLocal True might cause issues if the bin contains a different version of the Service Runtime than the Azure package was built under.
Orchard Azure uses the Azure 2.0 libraries. It shows that you have the 2.0 SDK installed because you can compile the Orchard.Azure.CloudService project to make a package. Cloud Service projects have different a project guid for each version of the Azure tools, so without the v2.0 SDK, it would be an unknown project type. However, with your Orchard website picking up ServiceRuntime v1.7, it seems that something is amiss with your local environment, as it should still identify with v2.0.
When you open Orchard.Azure.sln, check the Properties on the Microsoft.WindowsAzure.ServiceRuntime reference within the Orchard.Azure.Web project. What is the version that Visual Studio lists on that reference? It should be 2.0.0. If it does not, my best recommendation would be to reinstall the 2.0 Libraries.
The deployment steps as you have defined work just fine with no YSOD. I successfully tried it just before writing this; it did not reproduce your issue.

Resources