Dependency conflicts

Description

I'm not quite sure if this is a paket issue, or an FsCheck issue, but I chose to report it here because I can't repro the issue with Visual Studio's NuGet package manager console.

When adding FsCheck.Xunit, Visual Studio gives a compiler warning about conflicts in dependencies I don't even understand why they're there.

I'm not sure if the issue is related to FsCheck.Xunit at all, or if it's wider, but so far, I've only seen it in connection to FsCheck.Xunit.

Repro steps

1. Create a new F# library project using Visual Studio 2015.
2. Create a .paket directory: $ mkdir .paket
3. Copy paket.bootstrapper.exe into .paket.
4. Run the bootstrapper: $ .paket/paket.bootstrapper.exe
5. Initialise paket: $ .paket/paket init
6. Add FsCheck.Xunit to the project: $ .paket/paket add nuget FsCheck.Xunit project ConflictRepro
7. From within Visual Studio, rebuild all.

Expected behavior

The project should compile without errors or warnings. This is also the case if, instead of using paket, you use the Package Manager Console built into Visual Studio. Adding FsCheck.Xunit via the Package Manager Console does not cause the issue.

Actual behavior

The project compiles, but with a warning:

Severity	Code	Description	Project	File	Line	Suppression State
Warning		Found conflicts between different versions of the same dependent assembly that could not be resolved.  These reference conflicts are listed in the build log when log verbosity is set to detailed.	ConflictRepro	C:\Program Files (x86)\MSBuild\14.0\bin\Microsoft.Common.CurrentVersion.targets	1820	

Turning on diagnostics logging, the relevant information seems to be this:

There was a conflict between "System.Security.Cryptography.Algorithms, Version=4.1.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" and "System.Security.Cryptography.Algorithms, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a".
    "System.Security.Cryptography.Algorithms, Version=4.1.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" was chosen because it was primary and "System.Security.Cryptography.Algorithms, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" was not.
    References which depend on "System.Security.Cryptography.Algorithms, Version=4.1.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" [C:\Users\mark\Desktop\ConflictRepro\packages\System.Security.Cryptography.Algorithms\lib\net461\System.Security.Cryptography.Algorithms.dll].
        C:\Users\mark\Desktop\ConflictRepro\packages\System.Security.Cryptography.Algorithms\lib\net461\System.Security.Cryptography.Algorithms.dll
          Project file item includes which caused reference "C:\Users\mark\Desktop\ConflictRepro\packages\System.Security.Cryptography.Algorithms\lib\net461\System.Security.Cryptography.Algorithms.dll".
            System.Security.Cryptography.Algorithms
    References which depend on "System.Security.Cryptography.Algorithms, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" [].
        C:\Users\mark\Desktop\ConflictRepro\packages\System.Security.Cryptography.OpenSsl\lib\netstandard1.6\System.Security.Cryptography.OpenSsl.dll
          Project file item includes which caused reference "C:\Users\mark\Desktop\ConflictRepro\packages\System.Security.Cryptography.OpenSsl\lib\netstandard1.6\System.Security.Cryptography.OpenSsl.dll".
            System.Security.Cryptography.OpenSsl

It seems that paket adds all those System.Security.Cryptography.* assemblies as references to the project, even though they don't seem to be required. The Package Manager Console doesn't add those references.

Known workarounds

Remove the System.Security.Cryptography.* references.

This isn't the best workaround, however, because every time I ask paket to update packages, or do other work, it re-adds those references.

Reproduce the Visual Studio 2015 F# library scenario from the listed Paket commands, then inspect the detailed MSBuild build log and the project references for the System.Security.Cryptography.* assemblies. Compare Paket's generated references with those from the Package Manager Console; done means adding FsCheck.Xunit compiles without the dependency-conflict warning and updates do not re-add unnecessary references.