<vulnerabilityDataSource> in Nuget.config not working if Nuget.org is added as a disabled package source

[gautam-singh2]

in Nuget.config not working if Nuget.org is added as a disabled package source

from home.

[zivkan]

@gautam-singh2 the feature was not implemented early enough to make it into the .NET 8 SDK (not even 8.0.400). But you can use the .NET 9 SDK to build projects targeting .NET 8, and therefore benefit from the stability of .NET 8's LTS status for your apps, while still using the latest build tools

I always recommend looking at our official docs before looking at github issues, or design specs that are written before the feature is implemented. I can't control where search engines will point you to, but hopefully over time the official docs will get better search rankings than github issues.

• audit sources docs
• nuget.config reference
  • Looks like I forgot to mention which version of NuGet auditSources are available in, so I created a pull request: NuGet/docs.microsoft.com-nuget#3334

[gautam-singh2]

On further digging, I realized that the comment I was referring to was #12698 (comment), was more than an year old and later a new spec was created https://github.com/NuGet/Home/blob/dev/accepted/2023/NuGetAudit-without-nuget.org-as-packageSource.md where <auditSources> was chosen over vulnerabilityDataSource. The spec has already been implemented NuGet/NuGet.Client#5708 and should be available in .NET SDK 8.0.400? Can someone please confirm?

[gautam-singh2]

I modified C:\MyTest\NuGet.config used in Step 5) to have these contents (used auditSources instead of vulnerabilityDataSource):

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageRestore>
    <add key="enabled" value="True" />
    <add key="automatic" value="True" />
  </packageRestore>
  <packageSources>
	  <add key="RETRACTED 1" value="A VALID V2 URL" />
	  <add key="RETRACTED 2" value="ANOTHER V2 URL" />
  </packageSources>
  <auditSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
  </auditSources>
  <disabledPackageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="Microsoft Azure Service Fabric" value="true" />
    <add key="Microsoft and .NET" value="true" />
</disabledPackageSources>
  <activePackageSource>
	  <add key="RETRACTED 1" value="A VALID V2 URL" />
	  <add key="RETRACTED 2" value="ANOTHER V2 URL" />
  </activePackageSource>
</configuration>

Tried with .NET SDK 8.0.400 and .NET SDK 9.0.100-preview.7.24407.12, it still didnt show the warning about security flaw unless I removed nuget.org from the disabled package sources list.

from home.

[gautam-singh2]

I finally got it to work when I changed the key name in auditSources to be different from the key name in disabledPackageSources. It didnt work with .NET SDK 8.0.400 though, only with .NET SDK 9.0.100-preview.7.24407.12. This might be expected though since the change NuGet/NuGet.Client#5708 might not be released as part of .NET SDK 8.0.400?