Product version commit hash reflects VMR instead of original repo

[mthalman]

All external packages rebuilt from source in source-build-reference-packages/src/externalPackages/ embed the VMR's commit hash in their ProductVersion string instead of the original upstream repo's commit hash. For example, Valleysoft.DockerCredsProvider has this for product version:

• MSFT: 2.2.4+6e1ecd0a80755f9f0e88dc23b98b52f51a77c65e
• SB: 2.2.4+0f576f0a937886996ec6b606fbe9a0c37b5884b3

This occurs because these packages include Microsoft.SourceLink.GitHub as a PackageReference. SourceLink resolves SourceRevisionId from the current git repository, which during source-build is the VMR (dotnet/dotnet) rather than the individual package's repo. The .NET SDK's AddSourceRevisionToInformationalVersion target then appends this hash to InformationalVersion, which becomes the ProductVersion string in the PE version resource.

Affected DLLs

• Valleysoft.DockerCredsProvider.dll
• Microsoft.IdentityModel.Abstractions.dll, Microsoft.IdentityModel.JsonWebTokens.dll, Microsoft.IdentityModel.Logging.dll, Microsoft.IdentityModel.Tokens.dll, System.IdentityModel.Tokens.Jwt.dll
• Newtonsoft.Json.dll
• Microsoft.ApplicationInsights.dll
• Microsoft.Css.Parser.dll
• Spectre.Console.dll
• Microsoft.VisualStudio.SolutionPersistence.dll

Proposed Solution

When building an external package project in SB, set SourceRevisionId to match the commit hash of the associated repo.