[main] Source code updates from dotnet/dotnet

NuGet.config

@@ -21,4 +21,8 @@
   <disabledPackageSources>
     <clear />
   </disabledPackageSources>
+  <auditSources>
+    <clear />
+    <add key="nuget.org" value="https://data.nuget.org/v3/index.json" />
+  </auditSources>
 </configuration>

eng/Build.props

@@ -186,7 +186,7 @@
                         Condition=" '$(BuildMainlyReferenceProviders)' != 'true' " />
         <DotNetProjects Include="$(RepoRoot)src\Tools\NativeAot\aspnetcoretools\aspnetcoretools.csproj"
                         Exclude="@(ProjectToBuild);@(ProjectToExclude);$(RepoRoot)**\bin\**\*;$(RepoRoot)**\obj\**\*"
-                        Condition=" '$(BuildMainlyReferenceProviders)' != 'true' and '$(DotNetBuildSourceOnly)' != 'true' " />
+                        Condition=" '$(BuildMainlyReferenceProviders)' != 'true' and '$(DotNetBuildUseMonoRuntime)' != 'true' " />
         <!-- Only build the composite R2R runtime pack when we will actually ship it -->
         <DotNetProjects Include="$(RepoRoot)src\Framework\App.Runtime\src\aspnetcore-runtime-composite.proj"
                         Condition=" '$(BuildMainlyReferenceProviders)' != 'true' and '$(TargetOsName)' != 'win' " />

eng/Npm.Workspace.nodeproj

@@ -138,8 +138,11 @@
   <Target Name="Restore" Inputs="@(NpmInputFiles)" Outputs="@(NpmOutputFiles)">
     <Message Text="Restoring NPM packages..." Importance="high" />
 
+    <!-- Run 'npm ci' through a retry wrapper to tolerate transient network
+         failures (e.g. ECONNRESET) that npm's built-in fetch-retries does not
+         reliably recover from. -->
     <Exec
-      Command="npm ci"
+      Command="node $(MSBuildThisFileDirectory)scripts/npm/npm-ci-retry.mjs"
       WorkingDirectory="$(NpmWorkspaceRoot)"
       EnvironmentVariables="$(_NpmAdditionalEnvironmentVariables)"
       />

eng/Signing.props

@@ -15,6 +15,14 @@
     <FileSignInfo Include="Mono.Cecil.Mdb.dll" CertificateName="3PartySHA2" />
     <FileSignInfo Include="Mono.Cecil.Pdb.dll" CertificateName="3PartySHA2" />
     <FileSignInfo Include="Mono.Cecil.Rocks.dll" CertificateName="3PartySHA2" />
+    <FileSignInfo Include="OpenTelemetry.Api.ProviderBuilderExtensions.dll" CertificateName="3PartySHA2" />
+    <FileSignInfo Include="OpenTelemetry.Api.dll" CertificateName="3PartySHA2" />
+    <FileSignInfo Include="OpenTelemetry.Exporter.OpenTelemetryProtocol.dll" CertificateName="3PartySHA2" />
+    <FileSignInfo Include="OpenTelemetry.Extensions.Hosting.dll" CertificateName="3PartySHA2" />
+    <FileSignInfo Include="OpenTelemetry.Instrumentation.AspNetCore.dll" CertificateName="3PartySHA2" />
+    <FileSignInfo Include="OpenTelemetry.Instrumentation.Http.dll" CertificateName="3PartySHA2" />
+    <FileSignInfo Include="OpenTelemetry.Instrumentation.Runtime.dll" CertificateName="3PartySHA2" />
+    <FileSignInfo Include="OpenTelemetry.dll" CertificateName="3PartySHA2" />
   </ItemGroup>
 
   <ItemGroup>

eng/Versions.props

@@ -11,7 +11,7 @@
     <AspNetCoreMajorVersion>11</AspNetCoreMajorVersion>
     <AspNetCoreMinorVersion>0</AspNetCoreMinorVersion>
     <AspNetCorePatchVersion>0</AspNetCorePatchVersion>
-    <PreReleaseVersionIteration>6</PreReleaseVersionIteration>
+    <PreReleaseVersionIteration>7</PreReleaseVersionIteration>
     <IdentityModelVersion Condition="'$(IsIdentityModelTestJob)' != 'true'">8.0.1</IdentityModelVersion>
     <IdentityModelVersion Condition="'$(IsIdentityModelTestJob)' == 'true'">*-*</IdentityModelVersion>
     <PreReleaseVersionLabel>preview</PreReleaseVersionLabel>

eng/common/core-templates/job/helix-job-monitor.yml

@@ -57,6 +57,14 @@ parameters:
   type: number
   default: 30
 
+# When 'true' (the default), Helix work items that exit 0 but have failed AzDO test results
+# are treated as failed: they count toward the monitor's exit code and are resubmitted by a
+# later invocation's retry pass. Set to 'false' to fall back to exit-code-only outcomes.
+# Forwarded as --fail-on-failed-tests.
+- name: failWorkItemsWithFailedTests
+  type: boolean
+  default: true
+
 # Advanced: optional pipeline artifact (produced earlier in this run) that contains the tool
 # nupkg. When set, the artifact is downloaded and the tool is installed from the nupkg into
 # a local tool-path; this bypasses the repo's .config/dotnet-tools.json manifest and is
@@ -170,6 +178,7 @@ jobs:
       toolArgs=(
         --helix-base-uri           '${{ parameters.helixBaseUri }}'
         --polling-interval-seconds '${{ parameters.pollingIntervalSeconds }}'
+        --fail-on-failed-tests     '${{ parameters.failWorkItemsWithFailedTests }}'
         --max-wait-minutes         "$((${{ parameters.timeoutInMinutes }} - 5))" # Set the tool's timeout slightly lower than the Azure DevOps job timeout to allow it to exit gracefully.
         --stage-name               '$(System.StageName)'
       )

eng/common/core-templates/steps/send-to-helix.yml

@@ -10,6 +10,7 @@ parameters:
   HelixConfiguration: ''                 # optional -- additional property attached to a job
   HelixPreCommands: ''                   # optional -- commands to run before Helix work item execution
   HelixPostCommands: ''                  # optional -- commands to run after Helix work item execution
+  UseHelixMonitor: false                 # optional -- true will submit Helix jobs configured for the standalone Helix Job Monitor (results are reported/waited on out-of-band; this step will not wait, and WaitForWorkItemCompletion will be overridden)
   WorkItemDirectory: ''                  # optional -- a payload directory to zip up and send to Helix; requires WorkItemCommand; incompatible with XUnitProjects
   WorkItemCommand: ''                    # optional -- a command to execute on the payload; requires WorkItemDirectory; incompatible with XUnitProjects
   WorkItemTimeout: ''                    # optional -- a timeout in TimeSpan.Parse-ready value (e.g. 00:02:00) for the work item command; requires WorkItemDirectory; incompatible with XUnitProjects
@@ -31,7 +32,15 @@ parameters:
   continueOnError: false                 # optional -- determines whether to continue the build if the step errors; defaults to false
 
 steps:
-  - powershell: 'powershell "$env:BUILD_SOURCESDIRECTORY\eng\common\msbuild.ps1 $env:BUILD_SOURCESDIRECTORY/${{ parameters.HelixProjectPath }} /restore /p:TreatWarningsAsErrors=false ${{ parameters.HelixProjectArguments }} /t:Test /bl:$env:BUILD_SOURCESDIRECTORY\artifacts\log\$env:BuildConfig\SendToHelix.binlog"'
+  - powershell: >
+      $(Build.SourcesDirectory)\eng\common\msbuild.ps1
+      $(Build.SourcesDirectory)/${{ parameters.HelixProjectPath }}
+      /restore
+      /p:TreatWarningsAsErrors=false
+      /p:EnableHelixJobMonitor=${{ parameters.UseHelixMonitor }}
+      ${{ parameters.HelixProjectArguments }}
+      /t:Test
+      /bl:$(Build.SourcesDirectory)/artifacts/log/$(_BuildConfig)/SendToHelix.binlog
     displayName: ${{ parameters.DisplayNamePrefix }} (Windows)
     env:
       BuildConfig: $(_BuildConfig)
@@ -61,7 +70,15 @@ steps:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)
     condition: and(${{ parameters.condition }}, eq(variables['Agent.Os'], 'Windows_NT'))
     continueOnError: ${{ parameters.continueOnError }}
-  - script: $BUILD_SOURCESDIRECTORY/eng/common/msbuild.sh $BUILD_SOURCESDIRECTORY/${{ parameters.HelixProjectPath }} /restore /p:TreatWarningsAsErrors=false ${{ parameters.HelixProjectArguments }} /t:Test /bl:$BUILD_SOURCESDIRECTORY/artifacts/log/$BuildConfig/SendToHelix.binlog
+  - script: >
+      $(Build.SourcesDirectory)/eng/common/msbuild.sh
+      $(Build.SourcesDirectory)/${{ parameters.HelixProjectPath }}
+      /restore
+      /p:TreatWarningsAsErrors=false
+      /p:EnableHelixJobMonitor=${{ parameters.UseHelixMonitor }}
+      ${{ parameters.HelixProjectArguments }}
+      /t:Test
+      /bl:$(Build.SourcesDirectory)/artifacts/log/$(_BuildConfig)/SendToHelix.binlog
     displayName: ${{ parameters.DisplayNamePrefix }} (Unix)
     env:
       BuildConfig: $(_BuildConfig)
@@ -91,3 +108,4 @@ steps:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)
     condition: and(${{ parameters.condition }}, ne(variables['Agent.Os'], 'Windows_NT'))
     continueOnError: ${{ parameters.continueOnError }}
+

eng/common/cross/build-rootfs.sh

@@ -88,8 +88,9 @@ __FreeBSDPackages+=" terminfo-db"
 __OpenBSDVersion="7.8"
 __OpenBSDPackages="heimdal-libs"
 __OpenBSDPackages+=" icu4c"
-__OpenBSDPackages+=" inotify-tools"
+__OpenBSDPackages+=" libinotify"
 __OpenBSDPackages+=" openssl"
+__OpenBSDPackages+=" e2fsprogs"
 
 __IllumosPackages="icu"
 __IllumosPackages+=" mit-krb5"

eng/common/cross/install-debs.py

@@ -121,10 +121,14 @@ async def fetch_release_file(session, mirror, suite, keyring):
         await download_file(session, release_gpg_url, release_gpg_file.name)
 
         print("Verifying signature of Release with Release.gpg.")
-        verify_command = ["gpg"]
+        # Use gpgv rather than gpg for verification. gpgv verifies a detached
+        # signature against a fixed keyring without involving gpg-agent or
+        # keyboxd, which makes it robust on hosts running GnuPG 2.4+ (e.g. Azure
+        # Linux) where "gpg --keyring" routes through keyboxd and can fail.
+        verify_command = ["gpgv"]
         if keyring:
             verify_command += ["--keyring", keyring]
-        verify_command += ["--verify", release_gpg_file.name, release_file.name]
+        verify_command += [release_gpg_file.name, release_file.name]
         result = subprocess.run(verify_command, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
 
         if result.returncode != 0:

eng/common/cross/toolchain.cmake

@@ -59,9 +59,9 @@ elseif(TARGET_ARCH_NAME STREQUAL "arm64")
       set(TIZEN_TOOLCHAIN "aarch64-tizen-linux-gnu")
     endif()
   elseif(FREEBSD)
-    set(triple "aarch64-unknown-freebsd12")
+    set(TOOLCHAIN "aarch64-unknown-freebsd14")
   elseif(OPENBSD)
-    set(triple "aarch64-unknown-openbsd")
+    set(TOOLCHAIN "aarch64-unknown-openbsd")
   endif()
 elseif(TARGET_ARCH_NAME STREQUAL "armel")
   set(CMAKE_SYSTEM_PROCESSOR armv7l)
@@ -117,9 +117,9 @@ elseif(TARGET_ARCH_NAME STREQUAL "x64")
       set(TIZEN_TOOLCHAIN "x86_64-tizen-linux-gnu")
     endif()
   elseif(FREEBSD)
-    set(triple "x86_64-unknown-freebsd12")
+    set(TOOLCHAIN "x86_64-unknown-freebsd14")
   elseif(OPENBSD)
-    set(triple "x86_64-unknown-openbsd")
+    set(TOOLCHAIN "x86_64-unknown-openbsd")
   elseif(ILLUMOS)
     set(TOOLCHAIN "x86_64-illumos")
   elseif(HAIKU)
@@ -160,8 +160,6 @@ if(TIZEN)
     find_toolchain_dir("${CROSS_ROOTFS}/usr/lib64/gcc/${TIZEN_TOOLCHAIN}")
   endif()
 
-  message(STATUS "TIZEN_TOOLCHAIN_PATH set to: ${TIZEN_TOOLCHAIN_PATH}")
-
   include_directories(SYSTEM ${TIZEN_TOOLCHAIN_PATH}/include/c++)
   include_directories(SYSTEM ${TIZEN_TOOLCHAIN_PATH}/include/c++/${TIZEN_TOOLCHAIN})
 endif()
@@ -206,9 +204,9 @@ if(ANDROID)
     include(${CROSS_ROOTFS}/../build/cmake/android.toolchain.cmake)
 elseif(FREEBSD OR OPENBSD)
     # we cross-compile by instructing clang
-    set(CMAKE_C_COMPILER_TARGET ${triple})
-    set(CMAKE_CXX_COMPILER_TARGET ${triple})
-    set(CMAKE_ASM_COMPILER_TARGET ${triple})
+    set(CMAKE_C_COMPILER_TARGET ${TOOLCHAIN})
+    set(CMAKE_CXX_COMPILER_TARGET ${TOOLCHAIN})
+    set(CMAKE_ASM_COMPILER_TARGET ${TOOLCHAIN})
     set(CMAKE_SYSROOT "${CROSS_ROOTFS}")
     set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -fuse-ld=lld")
     set(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} -fuse-ld=lld")

eng/common/native/NativeAotSupported.props

@@ -13,6 +13,8 @@
     <!-- Reject unsupported architectures via RID suffix match -->
     <_NativeAotSupportedArch Condition="
       '$(TargetArchitecture)' != 'wasm' and
+      '$(TargetArchitecture)' != 's390x' and
+      '$(TargetArchitecture)' != 'ppc64le' and
       ('$(TargetArchitecture)' != 'x86' or '$(TargetOS)' == 'windows')
     ">true</_NativeAotSupportedArch>
 

eng/common/tools.ps1

@@ -741,13 +741,6 @@ function MSBuild() {
       Write-PipelineTelemetryError -Category 'Build' -Message 'Binary log must be enabled in CI build, or explicitly opted-out from with the -excludeCIBinarylog switch.'
       ExitWithExitCode 1
     }
-
-    # Node reuse must be disabled in CI builds unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED.
-    # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on.
-    if ($nodeReuse -and $env:MSBUILD_NODEREUSE_ENABLED -ne "1") {
-      Write-PipelineTelemetryError -Category 'Build' -Message 'Node reuse must be disabled in CI build.'
-      ExitWithExitCode 1
-    }
   }
 
   $buildTool = InitializeBuildTool

eng/common/tools.sh

@@ -423,7 +423,7 @@ function InitializeToolset {
   if [[ -z "$nuget_config" ]]; then
     # Search for any variation of nuget.config in the RepoRoot
     local found_config
-    found_config=$(find "$repo_root" -maxdepth 1 -type f -iname "nuget.config" -print -quit)
+    found_config=$(find "$repo_root" -maxdepth 1 -type f -iname nuget.config | head -n 1)
 
     if [[ -n "$found_config" ]]; then
       nuget_config="$found_config"
@@ -466,7 +466,8 @@ function ExitWithExitCode {
 function StopProcesses {
   echo "Killing running build processes..."
   pkill -9 "dotnet" || true
-  pkill -9 "vbcscompiler" || true
+  pkill -9 -i -x VBCSCompiler || true
+  pkill -9 -i -x MSBuild || true
   return 0
 }
 
@@ -493,14 +494,7 @@ function DotNet {
 function MSBuild {
   if [[ "$ci" == true ]]; then
     if [[ "$binary_log" != true && "$exclude_ci_binary_log" != true ]]; then
-      Write-PipelineTelemetryError -category 'Build'  "Binary log must be enabled in CI build, or explicitly opted-out from with the -noBinaryLog switch."
-      ExitWithExitCode 1
-    fi
-
-    # Node reuse must be disabled in CI builds unless explicitly opted in via MSBUILD_NODEREUSE_ENABLED.
-    # Internal testing only; this env var will be replaced with a switch (https://github.com/dotnet/arcade/issues/17013) and must not be depended on.
-    if [[ "$node_reuse" == true && "${MSBUILD_NODEREUSE_ENABLED:-}" != "1" ]]; then
-      Write-PipelineTelemetryError -category 'Build'  "Node reuse must be disabled in CI build."
+      Write-PipelineTelemetryError -category 'Build'  "Binary log must be enabled in CI build, or explicitly opted-out from with the --excludeCIBinarylog switch."
       ExitWithExitCode 1
     fi
   fi

eng/scripts/npm/npm-ci-retry.mjs

@@ -0,0 +1,36 @@
+// Runs `npm ci` with retries to mitigate transient network failures.
+//
+// npm's built-in fetch retry (configured via fetch-retries in .npmrc) does not
+// reliably recover from errors that occur while reading a response body, such as
+// "Invalid response body while trying to fetch ... read ECONNRESET". Those
+// failures surface as a non-zero exit from `npm ci` and would otherwise fail the
+// build non-deterministically. Wrapping the command in a retry loop makes the
+// restore step robust against these transient registry/network hiccups.
+import { execSync } from 'child_process';
+
+const maxAttempts = 5;
+const baseDelayMs = 15000;
+
+function sleep(ms) {
+  // Synchronous sleep so we can pause between attempts without async plumbing.
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+  try {
+    console.log(`Running 'npm ci' (attempt ${attempt}/${maxAttempts})...`);
+    execSync('npm ci', { stdio: 'inherit' });
+    process.exit(0);
+  } catch (error) {
+    console.error(`'npm ci' failed on attempt ${attempt}/${maxAttempts}: ${error.message}`);
+
+    if (attempt === maxAttempts) {
+      console.error(`'npm ci' failed after ${maxAttempts} attempts.`);
+      process.exit(1);
+    }
+
+    const delayMs = baseDelayMs * attempt;
+    console.log(`Retrying 'npm ci' in ${delayMs / 1000} seconds...`);
+    sleep(delayMs);
+  }
+}

global.json

@@ -22,9 +22,9 @@
     "jdk": "latest"
   },
   "msbuild-sdks": {
-    "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26322.110",
-    "Microsoft.DotNet.Helix.Sdk": "11.0.0-beta.26322.110",
-    "Microsoft.DotNet.SharedFramework.Sdk": "11.0.0-beta.26322.110",
+    "Microsoft.DotNet.Arcade.Sdk": "11.0.0-beta.26351.108",
+    "Microsoft.DotNet.Helix.Sdk": "11.0.0-beta.26351.108",
+    "Microsoft.DotNet.SharedFramework.Sdk": "11.0.0-beta.26351.108",
     "Microsoft.Build.NoTargets": "3.7.0",
     "Microsoft.Build.Traversal": "3.4.0",
     "Microsoft.WixToolset.Sdk": "6.0.3-dotnet.4"

src/Identity/EntityFrameworkCore/src/IdentityUserContext.cs

@@ -142,7 +142,7 @@ protected IdentityUserContext() { }
 
     private sealed class PersonalDataConverter : ValueConverter<string, string>
     {
-        public PersonalDataConverter(IPersonalDataProtector protector) : base(s => protector.Protect(s), s => protector.Unprotect(s), default)
+        public PersonalDataConverter(IPersonalDataProtector protector) : base(s => protector.Protect(s), s => protector.Unprotect(s))
         { }
     }
 

src/Servers/Kestrel/Kestrel/src/Microsoft.AspNetCore.Server.Kestrel.csproj

@@ -14,6 +14,7 @@
     <Reference Include="Microsoft.AspNetCore.Hosting" />
     <Reference Include="Microsoft.AspNetCore.Hosting.Abstractions" />
     <Reference Include="Microsoft.AspNetCore.Hosting.Server.Abstractions" />
+    <Reference Include="Microsoft.AspNetCore.Http.Abstractions" />
     <Reference Include="Microsoft.AspNetCore.Server.Kestrel.Core" />
     <Reference Include="Microsoft.AspNetCore.Server.Kestrel.Transport.NamedPipes" />
     <Reference Include="Microsoft.AspNetCore.Server.Kestrel.Transport.Quic" />

src/Tools/NativeAot/aspnetcoretools/aspnetcoretools.csproj

@@ -6,13 +6,15 @@
     <PackageId>aspnetcoretools</PackageId>
     <PackAsTool>true</PackAsTool>
     <IsShippingPackage>false</IsShippingPackage>
-    <ExcludeFromSourceOnlyBuild>true</ExcludeFromSourceOnlyBuild>
-    <PublishAot Condition="'$(DotNetBuildSourceOnly)' != 'true'">true</PublishAot>
+    <ExcludeFromSourceOnlyBuild>false</ExcludeFromSourceOnlyBuild>
+    <!-- Native AOT requires the CoreCLR runtime; the aggregate executable cannot be produced when building with the Mono runtime. -->
+    <ExcludeFromSourceOnlyBuild Condition="'$(DotNetBuildUseMonoRuntime)' == 'true'">true</ExcludeFromSourceOnlyBuild>
+    <PublishAot>true</PublishAot>
     <NativeLib>Shared</NativeLib>
     <EnablePreviewFeatures>true</EnablePreviewFeatures>
     <RuntimeIdentifiers Condition="'$(DotNetBuild)' != 'true' and '$(DotNetBuildSourceOnly)' != 'true'">$(BundledToolTargetRuntimeIdentifiers)</RuntimeIdentifiers>
-    <RuntimeIdentifiers Condition="'$(DotNetBuild)' == 'true' and '$(DotNetBuildSourceOnly)' != 'true'">$(TargetRuntimeIdentifier)</RuntimeIdentifiers>
-    <RuntimeIdentifier Condition="'$(PublishAot)' == 'true' and '$(DotNetBuildSourceOnly)' != 'true' and '$(RuntimeIdentifier)' == '' and '$(TargetRuntimeIdentifier)' != ''">$(TargetRuntimeIdentifier)</RuntimeIdentifier>
+    <RuntimeIdentifiers Condition="'$(DotNetBuild)' == 'true'">$(TargetRuntimeIdentifier)</RuntimeIdentifiers>
+    <RuntimeIdentifier Condition="'$(PublishAot)' == 'true' and '$(RuntimeIdentifier)' == '' and '$(TargetRuntimeIdentifier)' != ''">$(TargetRuntimeIdentifier)</RuntimeIdentifier>
     <RuntimeIdentifier Condition="'$(PublishAot)' == 'true' and '$(DotNetBuildSourceOnly)' != 'true' and '$(RuntimeIdentifier)' == ''">$(NETCoreSdkRuntimeIdentifier)</RuntimeIdentifier>
     <NoWarn>$(NoWarn);CS2008</NoWarn>
   </PropertyGroup>

src/Tools/dotnet-dev-certs/src/dotnet-dev-certs.csproj

@@ -12,7 +12,7 @@
     <ExcludeFromSourceOnlyBuild>false</ExcludeFromSourceOnlyBuild>
   </PropertyGroup>
 
-  <PropertyGroup Condition="'$(DotNetBuildSourceOnly)' != 'true'">
+  <PropertyGroup Condition="'$(DotNetBuildUseMonoRuntime)' != 'true'">
     <PublishAot>true</PublishAot>
     <RuntimeIdentifiers Condition="'$(DotNetBuild)' != 'true'">$(BundledToolTargetRuntimeIdentifiers)</RuntimeIdentifiers>
     <RuntimeIdentifiers Condition="'$(DotNetBuild)' == 'true'">$(TargetRuntimeIdentifier)</RuntimeIdentifiers>

src/Tools/dotnet-user-jwts/src/dotnet-user-jwts.csproj

@@ -13,7 +13,7 @@
     <ExcludeFromSourceOnlyBuild>false</ExcludeFromSourceOnlyBuild>
   </PropertyGroup>
 
-  <PropertyGroup Condition="'$(DotNetBuildSourceOnly)' != 'true'">
+  <PropertyGroup Condition="'$(DotNetBuildUseMonoRuntime)' != 'true'">
     <PublishAot>true</PublishAot>
     <RuntimeIdentifiers Condition="'$(DotNetBuild)' != 'true'">$(BundledToolTargetRuntimeIdentifiers)</RuntimeIdentifiers>
     <RuntimeIdentifiers Condition="'$(DotNetBuild)' == 'true'">$(TargetRuntimeIdentifier)</RuntimeIdentifiers>

src/Tools/dotnet-user-secrets/src/dotnet-user-secrets.csproj

@@ -13,7 +13,7 @@
     <ExcludeFromSourceOnlyBuild>false</ExcludeFromSourceOnlyBuild>
   </PropertyGroup>
 
-  <PropertyGroup Condition="'$(DotNetBuildSourceOnly)' != 'true'">
+  <PropertyGroup Condition="'$(DotNetBuildUseMonoRuntime)' != 'true'">
     <PublishAot>true</PublishAot>
     <RuntimeIdentifiers Condition="'$(DotNetBuild)' != 'true'">$(BundledToolTargetRuntimeIdentifiers)</RuntimeIdentifiers>
     <RuntimeIdentifiers Condition="'$(DotNetBuild)' == 'true'">$(TargetRuntimeIdentifier)</RuntimeIdentifiers>