Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[master] NuGet Feed Update #725

Merged
merged 1 commit into from
Feb 9, 2021
Merged

[master] NuGet Feed Update #725

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion NuGet.config
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
<configuration>
<packageSources>
<clear />
<add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
<add key="dotnet-public" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json" />
<add key="dotnet-tools" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json" />
<add key="dotnet-eng" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" />
<add key="dotnet5" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet5/nuget/v3/index.json" />
Expand Down
2 changes: 1 addition & 1 deletion src/VisualStudio.Roslyn.SDK/Roslyn.SDK.Template.Wizard/RoslynSDKRootTemplateWizard.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ public partial class RoslynSDKRootTemplateWizard
<configuration>
<packageSources>
<clear />
<add key=""nuget.org"" value=""https://api.nuget.org/v3/index.json"" />
<add key=""dotnet-public"" value=""https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json"" />
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mmitche This one is a public template for third-party extenders, and should not be updated. How do I fix it such that it doesn't trigger automation?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If it's a third party template, does it need our pre-shipping tools feed? Could it just be nuget.org?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mmitche The Microsoft.CodeAnalysis.Testing package aren't on nuget.org yet. I personally feel it should be in nuget.org and eliminate nuget.org from the template (or only use nuget.org from it)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ideally we'd only use nuget.org for this. When will these packages go to nuget.org?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When will these packages go to nuget.org?

@sharwell @jmarolf Any plans?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This also does seem to block dotnet/docs 😕

dotnet/docs#23231 (comment)

cc: @gewarren

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are these packages likely to move to nuget? If not, we'll probably have to remove Youssef's sample from dotnet/docs and dotnet/samples repos. The vulnerability in the nuget.config file blocks our publishing pipelines in those two repos.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@gewarren Note that in its current form, the nuget.config is not vulnerable. Would you be able to contact the team who owns the tooling that do this check to recognize azure feeds as private, and not flagging a nuget.config if all feeds are azure feeds?

The discussion above is more about, "I'm a consumer that wants to extend the sample and use a package from nuget.org - in this case it could be vulnerable"

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It turns out there's a variable you can add to the pipeline so it doesn't fail the build. So we're all set now.

<add key=""dotnet-tools"" value=""https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json"" />
</packageSources>
<disabledPackageSources>
Expand Down