nuget.exe ignores inheritance for packageSourceCredentials - nuget

Is it possible to configure Nuget so the package sources are configured in the nuget.config file in the solution dir, while the credentials for those sources are configured in the nuget.config file located at the user level (%appdata%\NuGet\NuGet.Config)?
Reading how settings are applied for nuget operations, seems like nuget.config has some sort of inheritance. I was trying to use this inheritance to configure nuget for my team in the following way.
Each developer will have a personal set of credentials to the Nuget repository.
Each visual studio solution will contain a Nuget.config file in the solution directory.
2.1. The Nuget.config file will contain two package sources: nuget.org, and a private credential required source.
Each developer will configure the credentials to the private Nuget source within the file located in the user profile (%appdata%\NuGet\NuGet.Config). In this way, those credentials are not committed to source control.
here are some examples of the nuget.config files I am trying to use:
Solution level file
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<packageSources>
<add key="nuget.org" value="https://api.nuget.org/api/v3/index.json" />
<add key="Private" value="url_for_the_private_feed" />
</packageSources>
<activePackageSource>
<add key="All" value="(Aggregate source)" />
</activePackageSource>
</configuration>
User level file
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<packageSources>
<add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
</packageSources>
<packageSourceCredentials>
<Private>
<add key="Username" value="user_name_here" />
<add key="Password" value="encrypted_password_here" />
</Private>
</packageSourceCredentials>
</configuration>
For some reason, I am not able to get this to work.

I finally figured out that if the NuGet command includes the argument -configFile <path to nuget.config> then the behavior described in how settings are applied does not apply, and instead, the NuGet CLI will only consider the configuration file passed as a parameter.
This is not clear in the documentation. For some reason, I thought that I could pass a nuget.config file to the NuGet CLI, and it would use that file in conjunction with the user-level configuration and the computer-level configuration.

Related

nuget local feed stops working when package with two different versions is present

I am trying to use nuget local feed for publishing my packages. So, I tried to push my first component / package. I have the following nuget.config in my sdk project:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<packageSources>
<add key="nuget" value="https://api.nuget.org/v3/index.json" />
<add key="Microsoft Visual Studio Offline Packages" value="C:\Program Files (x86)\Microsoft SDKs\NuGetPackages\" />
<add key="local feed" value="x:\nuget\packages\" />
</packageSources>
<packageRestore>
<add key="enabled" value="True" />
<add key="automatic" value="True" />
</packageRestore>
<bindingRedirects>
<add key="skip" value="False" />
</bindingRedirects>
<packageManagement>
<add key="format" value="0" />
<add key="disabled" value="False" />
</packageManagement>
</configuration>
SDK Project's configuration is as follows:
<PropertyGroup>
<TargetFramework>net6.0</TargetFramework>
<Nullable>enable</Nullable>
<ImplicitUsings>enable</ImplicitUsings>
<Title>My custom component</Title>
<Version>0.0.1-alpha</Version>
<PackageId>$(RootNamespace)</PackageId>
</PropertyGroup>
I set the project to Release configuration, and execute Pack command. As a result, .nupkg file is created in bin/Release folder.
Inside the package manager console window, I execute the following command:
nuget add pathToNupkgFile -Source x:\nuget\packages
So far so good, package is located in folder x:\nuget\packages\companyname.components.blazor.mycomponent\0.0.1-alpha.
Now I created new solution where I want to consume package from local feed. I copied the same nuget.config file to folder where new solution was created. I open Manage Nuget Packages for Solution (short MNPfS), search for new package, and install it. All fine until this point.
Now, if I do the same procedure and create 0.0.2-alpha nupkg, after nuget add command, new version is present in x:\nuget...., but I am unable to browse local feed any more in MNPfS screen. As soon as I open MNPfS, I get following message in window where packages should be listed:
Error occured
And error list window displays following message:
Error [local feed] '.', hexadecimal value 0x00, is an invalid character. Line 1, position 1.
Now, if I delete version 0.0.1-alpha from local feed repository, then I can browse again in MNPfS and new package is displayed, and can be installed. So, the problem occurs only when two versions of same package are present.
Anyone knows why is this happening, and how can I have multiple versions of same package in local feed?
Looks like the problem was related to nuget add command -Source parameter. When source points to partition with FUSE file system, then it does not create proper nuspec file, although no error is provided in Package Manager console.
nuspec file results in content with multiple NULL values. If I specify -Source to current partition where project is, then nuspec file is properly created, and then I can just copy the content to FUSE file system, and all works OK.

How to Install Azure Artifacts Packages dependencies in Vs Code?

How to Install the Azure Artifacts Packages in VS Code, I tried to check the Connect to feed option and found there are multiple Nuget options like Dotnet, Nuget.exe, and Visual Studio, etc.
But when I am trying for VS Code then it's not working.
What I did so far in the VS Code?
1 Approach) I install the NuGet package manager and when I am trying to do search my package then it's not showing in the list. but using this command "Get-PackageSource" I am able to see the package in the console.
2 Approach) I created one nuget.config file and mentioned below the package details
'<?xml version="1.0" encoding="utf-8"?>
<configuration>
<packageSources>
<clear />
<add key="test#Release" value="https://xxxxxxx.pkgs.visualstudio.com/_packaging/test/nuget/v3/index.json" />
</packageSources>
</configuration>'
after that running NuGet restore command and below giving the output but I didn't see any dependencies in the project and the same thing working fine using Visual Studio 2017
NuGet Config files used:
C:\Users\sudhir\source\repos\testPrivateNugetFeed\NuGet.Config
C:\Users\sudhir\AppData\Roaming\NuGet\NuGet.Config
C:\Program Files (x86)\NuGet\Config\Microsoft.VisualStudio.Offline.config
C:\Program Files (x86)\NuGet\Config\Xamarin.Offline.config
Feeds used:
`https://XXXXX.pkgs.visualstudio.com/_packaging/test/nuget/v3/index.json'
All projects are up-to-date for restore.
I have also followed this thread
Add custom package source to Visual Studio Code
Please give me some solution.
How to Install Azure Artifacts Packages dependencies in Vs Code?
I could reproduce this issue on my side, it seems to be a limitation of the NuGet package manager extension or Visual Studio Code.
No matter how I set up my Nuget.config file, I could not see the custom nuget package from the Azure devops feed in the NuGet package manager extension. I also test any other extension like NuGet Gallery, but not success.
To resolve this issue, I add following nuget.config file in my project, which next to my .sln fileļ¼š
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<packageSources>
<add key="AzureDevOpsFeed" value="https://pkgs.dev.azure.com/<MyORGName>/_packaging/<MyFeedName>/nuget/v3/index.json" />
<add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
</packageSources>
<config>
</config>
<packageSourceCredentials>
<AzureDevOpsFeed>
<add key="Username" value="LeoTest" />
<add key="ClearTextPassword" value="My PAT Here" />
</AzureDevOpsFeed>
</packageSourceCredentials>
</configuration>
And add following in my packages.config:
<?xml version="1.0" encoding="utf-8"?>
<packages>
<package id="LibA" version="1.0.0" targetFramework="net461" />
</packages>
The LibA is a custom package in my Azure decops feed:
Then I use nuget.exe to restore the package for my project:
If nuget restore not work for you, please share the log for that command.

TFS build .net Core with nuget restore end in error

While trying to build on tfs a .net Code 2.2 solution have a nuget restore task. it's trying to connect to our internal feeds. Then it fail. In the build logs we have :
error : Unable to load the service index for source http://internalSource/index.json. [D:\dummy.csproj]
error : No credentials are available in the security package [D:\dummy.csproj]
Looking at TFS generated files, it's not using the credential we declare in our solution.
Our nuget.config:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<packageRestore>
<!-- Allow NuGet to download missing packages -->
<add key="enabled" value="True" />
<add key="automatic" value="True" />
</packageRestore>
<packageSources>
<clear />
<add key="PackageSTN" value="http://internal/index.json" />
</packageSources>
<activePackageSource>
<add key="All" value="(Aggregate source)" />
</activePackageSource>
<packageSourceCredentials>
<PackageSTN>
<add key="Username" value="user" />
<add key="Password" value="pwd" />
</PackageSTN>
</packageSourceCredentials>
</configuration>
The one on TFS the build give us:
<configuration>
<packageRestore>
<add key="enabled" value="True"/>
<add key="automatic" value="True"/>
</packageRestore>
<packageSources>
<clear/>
<add key="PackageSTN" value="http://internal/index.json"/></packageSources>
<activePackageSource>
<add key="All" value="(Aggregate source)"/>
</activePackageSource>
<packageSourceCredentials>
<PackageSTN>
<add key="Username" value="VssSessionToken"/>
<add key="ClearTextPassword" value="Too Big to be display"/>
</PackageSTN>
</packageSourceCredentials>
</configuration>
Seem like it's trying to use some VssSessionToken TFS account to log on.
In addition we replace the %APPDATA% nuget.config on the server with the one with our credential, in case it will have a look inside, no luck as well.
TFS build .net Core with nuget restore end in error
As we know, when we select the option Feeds in my NuGet.config, we also need provide the Credentials for feeds outside this account/collection:
If we use the token we got from CredentialProvider.VSS.exe in the field "Personal Access Token" in the NuGet connection window, we may got the issue like you. The token we got from CredentialProvider.VSS.exe is a short-lived token, you could replace it with PAT (Personal Access Token) to check if it work for you.
Check this thread for some more details.
Besides, if you are using the old nuget.exe, you can use the task NuGet Tool Installer to update it.
If above not help you, please share your build definition about nuget restore task and the steps how to add the Credentials for feeds outside this account/collection.
Hope this helps.
Finally we did a powershell script, to by-pass this :/
try
{
$solutionSln = $env:BUILD_SOURCESDIRECTORY + $env:solutionSln
$nugetConfig = $env:BUILD_SOURCESDIRECTORY + $env:nugetConfig
Write-Host "dotnet restore $solutionSln --configfile $nugetConfig --verbosity Detailed --no-cache"
dotnet restore $solutionSln --configfile $nugetConfig --verbosity Detailed --no-cache
}
catch {
Write-Host $_
exit 1
}

Mixing packages from nuget.org and repository folder in VSTS

My solution grabs some nuget packages from Nuget.org and some of them are in my repository under the "lib" folder. I am aware that having packages in my repository is not the best option, but for now, i am stuck with it.
In my solution nuget.config looks like this :
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<packageSources>
<add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
<add key="CustomSource" value="../lib" />
</packageSources>
<activePackageSource>
<add key="All" value="(Aggregate source)" />
</activePackageSource>
<solution>
<add key="disableSourceControlIntegration" value="true" />
</solution>
</configuration>
It works fine in Visual Studio.
In VSTS I changed the nuget restore task option :
My build fails like this:
The nuget command failed with exit code(1) and error(Failed to
retrieve information about
'Microsoft.Extensions.Configuration.Abstractions' from remote source
'D:\a\1\lib'.)
Packages failed to restore
Obviously, Microsoft.Extensions.Configuration.Abstractions, is supposed to download from nuget.org. What should I change so it tries to use the 2 nuget sources?
Thanks!
If you specify your own NuGet.config file in NuGet restore task, it will save the content of the specify NuGet.config file to a temporary config file like: D:\a\1\Nuget\tempNuGet_3274.config.
So If you are using Hosted agent, you should specify the local feed path as:
<add key="CustomSource" value="../s/Projectname/lib" />
Besides, you can also use private agent which locate in your local machine, so that the packages can be found from other directory.

How to get the myget package source?

I am using myget for my Nuget packages. Because i am using a private feed with credentials, i followed this blog: http://www.xavierdecoster.com/deploying-to-azure-web-sites-using-nuget-package-restore-from-a-secured-feed
My local (project) nuget.config (located in the .nuget folder in the solution) looks like this:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<solution>
<add key="disableSourceControlIntegration" value="true" />
</solution>
<packageSource>
<clear />
<add key="EcareMyGet" value="https://www.myget.org/F/rai69/"></add>
</packageSource>
<activePackageSource>
<add key="EcareMyGet" value="https://www.myget.org/F/rai69/"></add>
</activePackageSource>
<packageSourceCredentials>
<EcareMyGet>
<add key="Username" value="www.myget.org/raimond" />
<add key="ClearTextPassword" value="wachtwoord" />
</EcareMyGet>
</packageSourceCredentials>
</configuration>
In my nuget.targets i've changed the restore command according to the blog:
<RestoreCommand>$(NuGetCommand) install "$(PackagesConfig)" -NonInteractive $(RequireConsentSwitch) -solutionDir "$(SolutionDir)\" -Verbosity detailed </RestoreCommand>
Despite this, the buildserver is still using nuget.org as source:
NuGet.exe sources
Registered Sources:
1. https://nuget.org/api/v2/ [Enabled]
https://nuget.org/api/v2/
Who knows a solution?
Answer: replace <packageSource> by <packageSources> in the nuget.config file
Below is the conversation that lead to the answer...
Just to be sure, did you also read the part where you disable the -RequireConsent switch?
<RequireRestoreConsent Condition=" '$(RequireRestoreConsent)' != 'false' ">
false
</RequireRestoreConsent>
Also, make sure you didn't configure it in the MSBuild PackageSources element, which by default looks as shown below (no package source configured):
<ItemGroup Condition=" '$(PackageSources)' == '' ">
<!-- Package sources used to restore packages.
By default, registered sources under %APPDATA%\NuGet\NuGet.Config
will be used -->
<!-- The official NuGet package source (https://nuget.org/api/v2/) will be
excluded if package sources are specified and it does not appear
in the list -->
<!--
<PackageSource Include="https://nuget.org/api/v2/" />
<PackageSource Include="https://my-nuget-source/nuget/" />
-->
</ItemGroup>
If you did and that's not the issue, can you please share a little more detail about the output logs so I can determine when the issue is caused and by what command?
You write that you use "My local (project) nuget.config", which makes me believe that you have the nuget.config file located in your project folder.
You can read about the NuGet Config File here. There you'll see that "NuGet first loads NuGet.config from the default location, then loads any file named NuGet.config starting from the root of the current drive and ending in the current directory.".
What this means, it that NuGet will look for the configuration in the folder hierarchy all the way from the root and to the location of nuget.exe, which usually is under the .nuget folder in the solution root. This means that it will never look inside the project folders in your solution. So you can try to move your nuget.config to the solution folder, and see it it gets read properly then.