Updated to .Net 10, and enabled native aot/single file.

[Alexandre Zollinger Chohfi (azchohfi)]

Overview

This PR upgrades the whole solution from .NET 9 to .NET 10 and, more importantly, finally turns the CLI into a Native AOT, single-file, self-contained executable.

Why

Shipping msstore as a trimmed, AOT-compiled, single-file binary has been a long-standing goal (smaller download, faster cold start, no shared runtime dependency on the target machine). It was previously blocked because some key dependencies weren't trim/AOT-safe — see the old workaround comment in Directory.Build.props:

BROKEN: IL Trimming, until Microsoft.Identity.Client supports it, just so it builds

and the commented-out PublishTrimmed / PublishAot in MSStore.CLI.csproj.

.NET 10 plus updated dependencies (notably Microsoft.Identity.Client and a new AOT/OpenTelemetry-based Microsoft.ApplicationInsights) now support trimming and AOT, so we can enable it for real and drop the workarounds.

What changed

1. Target framework: net9.0 → net10.0

All projects (MSStore.API, MSStore.CLI, MSStore.CLI.UnitTests, the MAUI test template), publish profiles, CI/pipelines (UseDotNet → 10.0.x), and binSkim globs.

2. Native AOT / single-file / self-contained publishing

• MSStore.CLI.csproj: PublishTrimmed, PublishAot, and PublishSingleFile are now enabled unconditionally (previously commented out / Release-only).
• Publish profiles (win/linux/osx × x64/arm64): switched from SelfContained=false + PublishReadyToRun=true to SelfContained=true (AOT-native), dropping ReadyToRun.

3. Telemetry re-implementation (required for AOT)

The old Microsoft.ApplicationInsights 2.x TelemetryClient.Context.* API isn't AOT-friendly, so it was reworked:

• Bumped Microsoft.ApplicationInsights 2.23.0 → 3.x (OpenTelemetry-based) and wired it up via ConfigureOpenTelemetryBuilder in Program.cs, mapping the old context fields (service name/version, instance id, runtime identifier) to OpenTelemetry resource attributes.
• Introduced a static Program.SessionId (a Guid) to replace telemetryClient.Context.Session.Id; AzureBlobManager and the PWABuilder correlation headers now use it directly and no longer depend on TelemetryClient.
• A default ConnectionString is now required by App Insights 3.x, so one is set (both in Program and in the test host).
• Suppressed IL2026;IL3050 in Directory.Build.props, pending ApplicationInsights-dotnet#3120 — these are reported by the App Insights package but not actually hit.

4. P/Invoke hardening for AOT

Services/CredentialManager/Unix/NativeMethods.cs: libsecret imports moved from CharSet.Auto to CharSet.Ansi with BestFitMapping=false, ThrowOnUnmappableChar=true, and the same mapping flags added to the macOS Security-framework imports (AOT-correct marshalling).

5. Dependency updates (all bumped to latest)

• Microsoft.Identity.Client / .Broker / .Extensions.Msal 4.77.0 → 4.86.1 (trim/AOT support — the original blocker)
• Microsoft.Extensions.* and System.CommandLine: RC → stable (10.0.10 / 2.0.10)
• Microsoft.ApplicationInsights 3.1.2, Azure.Storage.Blobs 12.25 → 12.29.1
• Spectre.Console 0.51.1 → 0.57.2, SkiaSharp (+ NativeAssets) 3.119 → 4.150.1
• Meziantou.Framework.Win32.CredentialManager 1.7.6 → 3.0.1 (no code changes needed), Nerdbank.GitVersioning 3.7.115 → 3.10.91
• Test stack: MSTest.Sdk / MSTest.* → 4.3.2, Microsoft.NET.Test.Sdk → 18.8.1, Microsoft.Testing.Extensions.CodeCoverage → 18.9.0, TrxReport → 2.3.2

6. Test assertion library: FluentAssertions → AwesomeAssertions

FluentAssertions 8+ switched to a commercial license (7.2.0 was the last Apache-2.0 release). Replaced it with AwesomeAssertions 9.5.0, the Apache-2.0 community fork. This is a one-line swap — the only touch point is the global using in Usings.cs (updated to the AwesomeAssertions namespace); all 178 .Should() assertions are unchanged.

7. Build / CI simplification

• Consolidated the pipeline templates: removed build-nuget.yaml and pack-nuget.yaml, added a single build-and-tests.yaml. GitHub build.yml job renamed to "Build and Run Tests"; release NuGet stage renamed to Build_And_Tests.
• build-cli now publishes self-contained AOT directly — no more intermediate NuGetDLLs artifact download, no --no-self-contained, no ReadyToRun. ESRP signing patterns updated for the new native outputs (libSkiaSharp.dll, msalruntime_*.dll, single-file msstore.exe).
• Added the linux-arm64 NativeAOT cross-compilation toolchain (clang/lld + aarch64 cross gcc/binutils) so arm64 AOT can cross-compile on the x64 Ubuntu agents ("Fix cross compilation for arm64").

8. Version bump

version.json: 0.3.10-alpha → 0.4.0-alpha to reflect the runtime/packaging change.

Validation

Solution builds clean (0 warnings), all unit tests pass on net10.0 and net10.0-windows, and the win-x64 Native AOT single-file publish succeeds and runs.

Open items / to confirm

• Telemetry parity: need to verify the new App Insights 3.x + OpenTelemetry implementation sends the equivalent of what we emit today.