Project references with private set to false can cause missing dependencies

I was seeing some strange behavior where a bunch of dependencies went missing from the bin of my project when I set one of its project references to private=false.

I was able to track it down to here: https://github.com/Microsoft/msbuild/blame/a9f64ebd108702c3fc65339c66cb124217854524/src/Tasks/AssemblyDependency/Reference.cs#L1212

It appears when msbuild is trying to decide whether or not to copy an indirect dependency it first checks if the primary references referencing those dependencies are private or not by checking the metadata on the item. The problem is that project references are assumed private and they do not have a Private element in their metadata by default.

This means that without manually editing the project file if I have project reference A and project reference B that both have a dependency on C, when I set project reference A to private=false C won't get copied even though B is expecting the dependency to be there in my bin along with it.

I believe if we just check in the SetFinalCopyLocalState function that I linked above whether or not the primary reference is a project reference rather than solely basing the decision on whether the Private element is present in the metadata then it would behave as expected.

Currently my workaround is to add the Private element to each project reference and set it to true when it needs to be.