Why is >= necessary when building .NET Core for distribution to allow upgrades?

[dagood]

Dependencies between packages should use an equal or greater than version requirement. For example, dotnet-sdk-2.2:2.2.401 requires aspnetcore-runtime-2.2 >= 2.2.6. This makes it possible for the user to upgrade their installation via a root package (for example, dnf update dotnet-sdk-2.2).

Why does a >= dependency "make it possible" for a user to upgrade? What is it contrasting against that doesn't allow the user to upgrade their installation via dnf update etc.?

For example, does the following block upgrade from 3.0.0 to 3.0.1 somehow?

• dotnet-sdk-3.0 3.0.0 requires dotnet-targeting-pack-3.0 = 3.0.0
• dotnet-sdk-3.0 3.0.1 requires dotnet-targeting-pack-3.0 = 3.0.1

This more accurately represents the actual dependency (more info at dotnet/installer#5738).

/cc @leecow @tmds @omajid @nguerrera @dleeapho

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 1ce2ad2f-c2fb-b15a-fb97-75417a1b51e8
• Version Independent ID: 40eec307-4ff8-e68f-c8a7-ead32cccf776
• Content: .NET Core distribution packaging - .NET Core
• Content Source: docs/core/build/distribution-packaging.md
• Product: dotnet-core
• GitHub Login: @tmds
• Microsoft Alias: mairaw

[tmds]

This makes it possible for the user to upgrade their installation via a root package

This is about expressing a dependency on a version vs not specify a version.
When not specifying a version, updating dotnet-sdk package won't update dotnet-runtime for example.

On the difference between >= and =, this is about whether dependencies are backwards compatible, and if they may be updated to a later version without updating the dependent.
If there is no backwards compatibility, = should be used.

[dotnet-bot]

This issue has been closed as part of the issue backlog grooming process outlined in #22351.

That automated process may have closed some issues that should be addressed. If you think this is one of them, reopen it with a comment explaining why. Tag the @dotnet/docs team for visibility.