[master] NuGet Feed Update #725
Conversation
| @@ -13,7 +13,7 @@ public partial class RoslynSDKRootTemplateWizard | |||
| <configuration> | |||
| <packageSources> | |||
| <clear /> | |||
| <add key=""nuget.org"" value=""https://api.nuget.org/v3/index.json"" /> | |||
| <add key=""dotnet-public"" value=""https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json"" /> | |||
There was a problem hiding this comment.
@mmitche This one is a public template for third-party extenders, and should not be updated. How do I fix it such that it doesn't trigger automation?
There was a problem hiding this comment.
If it's a third party template, does it need our pre-shipping tools feed? Could it just be nuget.org?
There was a problem hiding this comment.
@mmitche The Microsoft.CodeAnalysis.Testing package aren't on nuget.org yet. I personally feel it should be in nuget.org and eliminate nuget.org from the template (or only use nuget.org from it)
There was a problem hiding this comment.
Ideally we'd only use nuget.org for this. When will these packages go to nuget.org?
There was a problem hiding this comment.
There was a problem hiding this comment.
Are these packages likely to move to nuget? If not, we'll probably have to remove Youssef's sample from dotnet/docs and dotnet/samples repos. The vulnerability in the nuget.config file blocks our publishing pipelines in those two repos.
There was a problem hiding this comment.
@gewarren Note that in its current form, the nuget.config is not vulnerable. Would you be able to contact the team who owns the tooling that do this check to recognize azure feeds as private, and not flagging a nuget.config if all feeds are azure feeds?
The discussion above is more about, "I'm a consumer that wants to extend the sample and use a package from nuget.org - in this case it could be vulnerable"
There was a problem hiding this comment.
It turns out there's a variable you can add to the pipeline so it doesn't fail the build. So we're all set now.
NuGet Feed Update
This pull request updates the usage of NuGet.org in cases where it is used in conjunction with other feeds.
Is this PR required?
Generally yes. If the target branch is no longer in use and will not need to be built in the future, please close this PR.
This PR is broken build, what do I do?
If packages are missing, please tag 'dotnet/dnceng' or 'mmitche' on this PR and note the missing packages.
If there are other unexpected failures, please contact 'dotnet/dnceng'.