Manage NuGet Packages dialog shows 'Authors' of package but not 'Owners'

[stgates]

I have a question about why the package ‘Authors’ is listed in the data shown when looking at a package in Visual Studio through the “Manage NuGet Packages” dialog. The “Authors” is just an arbitrary string that could be filled in with anything. From trust perspective as a package consumer what I really want to know is who the ‘Owners’ or publishers of the package are.

For example if you look up the Xerces package in Visual Studio you see it says ‘The Apache Software Foundation’. I might think oh great it looks like it is published by the owner of the library. However if you actually go to the NuGet.org site and look at the package the owner is someone completely different, Kikuchi. From a package trusting perspective this is bad. I need to see front and center who the owner of the package is, since the author is just a meaningless string that could contain any value.

[yishaigalatzer]

That's a good point (and I believe we want to show both) because although Authors is an open field many times it shows the right information, for example when someone repackages a product. A good example is jQuery.

Suggestion (needs followup design)

We show keep showing authors on the list (because owners are not always available, and for internal servers the owners are always irrelevant). But we add the owners field to the description on the right, very high on the list

[jainaashish]

@karann-msft can you also please take care of this as part of Package Applicability flow #5725 ?

[forderud]

Have this problem really been resolved?

I'm still unable to display package "owners" from withing Visual Studio 2017 (nuget package manager 4.6.0). Only the "authors" field show up for me, and not the "owners". Example:

[karann-msft]

@forderud we introduced "verified packages". If the package ID prefix has been reserved by an owner, for example, Microsoft.* has been reserved to Microsoft, a package published and owned by Microsoft gets a checkmark. If a package ID starts with Microsoft.* and does not have the checkmark, then it implies it is NOT owned by Microsoft.
Let us know if that solved this problem for you.

[forderud]

Sorry, but I unfortunately don't think this fixes our problem. We're using company-internal NuGet packages together with a company internal artifact server (Artifactory), and not nuget.org. There, we want to differentiate between the owner of a package and the go-to contact person for reporting problems etc. To enable that, we need the values from both the "authors" and "owners" tags to show up in Visual Studio.

[karann-msft]

and every person that installs the package needs to be able to see both? how often does the owner or the go-to contact person change? How have you worked around this today?

[forderud]

Yes, it would be preferable if every person installing a nuget package could see both the "authors" and "owners" fields.
We lack a good work-around for this today. That's the reason for my request here.

[forderud]

@karann-msft Would it be possible to reopen this issue, since it has clearly not been resolved?

[forderud]

Gentle reminder.

[karann-msft]

cc: @rrelyea, @anangaur

[forderud]

Gentle reminder.

[karann-msft]

@forderud - I believe it is artifactory that needs to expose the owner information in the API. If you notice, when browsing a folder feed, the VS package manager UI will show the owner information from the nuspec.

[forderud]

Thanks a lot for the explanation @karann-msft . I now understand that this is not a Microsoft-issue, and will instead contact JFrog regarding this issue.

[LokiMidgard]

I also wished I could see the Owner of the package. I'm working with nuget.org.

I posted this on VisualStudios report tool and was directed here

In Visual Studio Owners of nuget packages are not displayed.

This is confusing if author and owner is different.

The package Microsoft.Office.Interop.Excel e.g. has the Author Microsoft. But the only clue that it
is not an offical package, is the missing of the check mark.

The check mark is nice, but generally it is not alarming that a package does not have one. So if the UI shows Microsoft. ... by Microsoft without a check mark I generally don't think about this (up till now)

[anangaur]

We are tracking the missing elements for VS PM UI on #7957. Closing this as duplicate.