nuget/nugetgallery

NuGet Gallery is a package repository that powers https://www.nuget.org. Use this repo for reporting NuGet.org issues.

NuGet Gallery — Where packages are found

This project powers nuget.org, the home for .NET's open-source ecosystem. For information about NuGet, visit the Home repository.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Getting started

First install prerequisites:

1. Visual Studio 2022 - Install the following Workloads and individual components:
   • ASP.NET and web development
   • Azure development
   • Just web UI functional tests: "Web performance and load testing tools" individual component

Visual Studio 2019 may work but Visual Studio 2022 is recommended.

The "Azure development" workload installs SQL Server Express LocalDB which is the database configured for local development.

Now run the NuGet Gallery:

1. Clone the repository with git clone https://github.com/NuGet/NuGetGallery.git
2. Navigate to .\NuGetGallery
3. Build with .\build.ps1
4. Create the database and enable HTTPS with .\tools\Setup-DevEnvironment.ps1
5. Open .\NuGetGallery.sln using Visual Studio
6. Ensure the NuGetGallery project is the StartUp Project and press F5 to run the site

Refer to our documentation for information on how to develop the frontend, use AAD, and more.

Deploy

Deploy to Azure

You will find instructions on how to deploy the Gallery to Azure here.

Deploy locally

After you succeed in running the NuGet Gallery, you can create a publish profile to deploy locally (such as your local Windows computer).

The steps are:

1. Select the NuGetGallery project in Solution Explore of Visual Studio.
2. Right click the project, and then click Publish in the pop-up menu. Create a publish profile and make sure the Target is set to Folder.
3. Copy the contents of the Target Location to any folder you want. For the following example, assume the folder is C:\ContosoSoftware\NuGetGallery.
4. Execute the command below to start the web app (note that the parameter /path of iisexpress.exe only supports absolute paths on Windows).

   "C:\Program Files\IIS Express\iisexpress.exe" /path:C:\ContosoSoftware\NuGetGallery

Now you can access the local website with a web browser. The URL is https://localhost.

After you deploy it, you don't need using Visual Studio to run it anymore.

Contribute

If you find a bug with the gallery, please visit the Issue tracker and create an issue. If you're feeling generous, please search to see if the issue is already logged before creating a new one.

When creating an issue, clearly explain

• What you were trying to do.
• What you expected to happen.
• What actually happened.
• Steps to reproduce the problem.

Also include any information you think is relevant to reproducing the problem such as the browser version you used. Does it happen when you switch browsers. And so on.

Submit a patch

Before starting work on an issue, either create an issue or comment on an existing issue to ensure that we're all communicating. We have a list of items that are up for grabs and you can start working on (but always ping us beforehand).

To contribute to the gallery, make sure to create a fork first. Make your changes in the fork following the Git Workflow. When you are done with your changes, send us a pull request.

Copyright and License

Copyright .NET Foundation

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this work except in compliance with the License. You may obtain a copy of the License in the LICENSE file, or at:

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft’s Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party’s policies.

The Git Workflow

This is the Git workflow we're currently using:

Setting up

Clone and checkout the dev branch.

Visual Studio may modify the applicationhost.config file. You can force git to ignore changes to this file with:

git update-index --assume-unchanged .vs/config/applicationhost.config

You can undo this with this command:

git update-index --no-assume-unchanged .vs/config/applicationhost.config

This should help prevent unwanted file commits.

When starting a new feature/unit of work.

1. Pull the latest. Begin by pulling to make sure you are up-to-date before creating a branch to do your work This assumes you have no local commits that haven't yet been pushed (i.e., that you were previously up-to-date with origin).

   git checkout dev
   git pull dev
   

2. Create a topic branch to do your work. You must work in topic branches to help us keep our features isolated and easily moved between branches. Our policy is to start all topic branches off of the 'dev' branch. Branch names should use the following format '[user]-[bugnumber]'. If there is no bug yet, create one and assign it to yourself!

   git checkout dev
   git checkout -b anurse-123
   

3. Do your work. Now, do your work using the following highly accurate and efficient algorithm :)

   1. Make changes.

   2. Test your changes (you're practicing TDD, right?)

   3. Add your changes to git's index.

       git add -A
      

   4. Commit your changes.

       git commit -m "<description of work>"
      

   5. if (moreWorkToDo) go to #3.1 else go to #4.

4. Start a code review. Start a code review by pushing your branch up to GitHub (git push origin anurse-123) and creating a Pull Request from your branch to dev. Wait for at least someone on the team to respond with: ":shipit:" (that's called the "Ship-It Squirrel" and you can put it in your own comments by typing :shipit:).

5. Merge your changes in to dev. Click the bright green "Merge" button on your pull request! Don't forget to delete the branch afterwards to keep our repo clean.

   If there isn't a bright green button... well, you'll have to do some more complicated merging:

   git checkout dev
   git pull origin dev
   git merge anurse-123
   ... resolve conflicts ...
   git push origin dev
   

6. Be ready to guide your change through QA, Staging and Prod Your change will make its way through the QA, Staging and finally Prod branches as it's deployed to the various environments. Be prepared to fix additional bugs!

nugetgallery's Issues

Pager claims to show 10 items but shows 20

e.g. on a test instance with 500 packages, it says:

500 results for Packages
Displaying results 1 - 10

But then it displays 20 packages on each page.

Store tags in a separate table.

We should store tags in a separate table and flatten them in the feed.

For users with the IsAdmin bit, add an administrators role to the principal

CDN + Web Optimization (optimize and minimize PNGs, CSS, and JS)

I think Mads has a nice VS plugin for PNGs, but probably should add it to our build process at some point.

Automatically resize uploaded icons

If a package contains a single Icon.png, we should automatically resize and crop it to fit the conventions outlined in #14

Wire up Report Abuse and Don't Require Authentication

Today, nuget.org requires authentication to report abuse. That seems wrong to me because I shouldn't need a NuGet.org account as a user of NuGet, but I might run into a bad package.

Add layout-level flash success message and styling for general use

I need this to add a flash message after verifying a package submission, and I'm sure we'll need it elsewhere.

Make the display package view work

Phil, I'm giving this to you since you started on it.

Make MiniProfiler work for database queries

I had this working locally at one time, but now I can't get it work at all.

Add runtime migration to bootstrapper

Not sure if we want this on for development, but definitely need for deployment

Implement Report Abuse

Azure Enable this puppy

Create a partial for displaying ratings across the various views in which we show them

And, of course, update all the views to use it.

Make sure Users are associated with the package they upload

I need to be able to query the set of packages that a user owns.

Give owners the ability to delete a package

But strongly discourage it and make it annoying to do. And show all the dependencies they'll break.

Add the delete package API service

Create an API key when a new user is created.

Add runtime migration to bootstrapper

Not sure if we want this on for development, but definitely need for deployment

Add QUnit Unit Tests

We should have JavaScript unit tests. I vote for QUnit. I've never integrated them into a build, but I heard it's not too hard. :)

Add a link labelled "Where is the download?"

The link should point to a page that briefly explains what NuGet is and how it works.

Add build.bat to build everything from command line

Also run the migrations

VS blows up on feed when it contains unpublished packages

Just trying to list packages in VS fails with:

Get-Package : The null value from property 'Published' cannot be assigned to a type 'System.DateTimeOffset'.

For unpublished packages, the feed has:

<d:Published m:type="Edm.DateTime" m:null="true"></d:Published>

While I think the current feed uses that magic date.

Not sure exactly what the right fix is, but we need to make it work somehow.

The version display in the display packages page isn't sorted properly

@haacked, do you want to look at this since you're already working in that code?

Repro:

1. Upload a package with version 1.0
2. Upload a package with version 1.0.1

Expected: 1.0.1 is first, being more recent
Actual: 1.0 is more recent

Add BuildViews to BuildSolution.ps1 (and not to VS builds)

Cannot upload new version of existing package ID

Tried to upload a newer version of the same package id and it says "The package identifier 'RouteMagic' is not available".

Implement an SmtpService for sending emails

Rename VersionRange in PackageDependencies table to VersionSpec and make it nullable

I didn't realize that the version spec' could be null when I created the table.

Wire up Contact Owners Page to Email Service

Moving on to other UI wire-up, but don't want to forget this. I'll also make use of RazorGenerator for email templates. :)

Send a proper email to new users immediately after they create an account

We don't have to be consistent with the existing email that's sent (though, it's not bad). Along the way, we'll need to build up the infrastructure for queuing and processing queued email messages.

Note there's a follow-up related issue #88 we should do later.

Handle case where an authenticated user has no row in the Users table

This really shouldn't happen, but isn't hard to get into this state in development when reverting and updating and resting data.

Show title in list/details view instead of id if available.

Ensure that the site supports pre-release packages properly

There's several places we don't yet handle pre-release properly.

1. When listing package versions, we should highlight pre-release in some manner.
2. Pre-release package should never be displayed as the recommended version.
3. If we add a property to indicate the "latest" package, we need to also consider marking the "latest" pre-release package for those who specify -Prerelease

There's probably others I'm missing.

Add the push package API service

Pushing packages fails

Seems like our database field lengths are too short.

[SqlException (0x80131904): String or binary data would be truncated.
The statement has been terminated.]
    System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection) +2062078


System.Data.Entity.Internal.InternalContext.SaveChanges() +206
   System.Data.Entity.Internal.LazyInternalContext.SaveChanges() +24
   System.Data.Entity.DbContext.SaveChanges() +20
   NuGetGallery.EntityRepository`1.CommitChanges() in c:\dev\github\NuGetGallery\Website\Entities\EntityRepository.cs:13
   NuGetGallery.PackageService.CreatePackage(IPackage nugetPackage, User currentUser) in     c:\dev\github\NuGetGallery\Website\Services\PackageService.cs:34
   NuGetGallery.ApiController.CreatePackage(Guid apiKey) in      c:\dev\github\NuGetGallery\Website\Controllers\ApiController.cs:30
   lambda_method(Closure , ControllerBase , Object[] ) +126
   System.Web.Mvc.ActionMethodDispatcher.Execute(ControllerBase controller, Object[] parameters) +17

Add the publish package API service

Examine current site's log for load and make sure new site can handle that plus project increases

Include the API services, upload, list and searching

Add missing tests for controllers and services after initial spike

@Gissues:{"order":66.66666666666666,"status":"backlog"}

Add the missing parts to the package creation process

For instance, right now it's not pushing dependencies, package file size, and several other fields

Import data from the old site

Title says it all. We need a one-off way to import the old site into the new one.

Require HTTPS for API services

Since there are API keys in the URLs, we should require HTTPS for them.

Add better routing and associated URL helper

I plan to add better routing (better URL structure) and redirect the old ones to the new ones.

As part of that, I want to get rid of the RouteName class and use UrlHelper extension methods specific to our apps.

So you'd use things like:

Url.PackageUrl("Elmah")
Url.PackageUrl("Elmah", new Version(1,2))
Url.PackageUrl("Elmah", new Version(1,2), PackageAction.Edit)
OR
Url.PackageEditUrl("Elmah", new Version(1,2), PackageAction.Edit)

I'm undecided about having a package action enum or simply having different methods for each package operation.

Thoughts?

Make paging and sorting work on the list packages view

Allow package replacement via the Push API

I don't know if the current site supports this, but we should allow the push API to replace an existing package version. Are there any rules we want to enforce for update?

Need a small icon for pre-release packages

Just like we do for the "latest" version of the package (formerly recommended version), we need an icon for prerelease packages.

Match DB column sizes to the old gallery DB and update request models/validation for string lengths

Implement Contact Owners

Add a sweet error page

Bonus points if it works in Cthulhu or unicorns.

Make package download URL work

So that we can actually install packages from the new feed

Host icons in our blob storage

Rather than allowing embedded icons (which, while useful, is a much more complicated feature), let's download Icons from the IconUrl and use those in the feed and website (we will not rewrite the NuPkg), that way we can host the icons ourselves and support HTTPS.

We may still investigate embedding icons in packages, but for now the main priority is taking the bandwidth burden of hosting and SSL support off of the package author and on to us.

Previous version as filed by @haacked

Allow including icon and license within package

Original Spec

Icons:

• Icon_dialog.png (32x32)
• Icon_list.png (50x50)
• Icon_details.png (100x100)

License:
License.txt

Related Issue: Automatically resize images

Add AntiForgery Tokens to each form

I'm going to do all this in one pass. It'll be part of a general 1st pass security review.