oneget/nugetprovider

NuGet Provider for OneGet. Works on Nano Server.

NuGet provider

NuGetProvider is a OneGet (PackageManagement) provider. It primarily supports finding and installing packages from NuGet.org. It is also used by PowerShellGet for finding and installing PowerShell modules from PowerShellGallery.

It supports FullCLR and CoreCLR, meaning works for Windows, Linux, and OSX as part of PowerShellCore.

As a git submodule, it is compiled and tested with OneGet together.

For more information, see OneGet wiki.

nugetprovider's Issues

No support for Windows Authentication on Nuget feeds?

When do we get support for installing powershell modules from private nuget feeds configured with Windows Authentication (or any other authentication)?

Currently all PowershellGet *-Module functions (Get-Module,Find-Module, Install-Module, Publish-Module,etc) only connect to public nuget feeds. The same applies to Microsoft.PackageManagement.NuGetProvider.dll

Thanks

Find-Package returns incorrect packagefilename

Find-Package returns the value of PackageFilename set equal to the ID concatenated with the Version of the nuget as specified in the nuspec. If the actual filename of the nupkg is different than the ID concatenated with Version, the returned PackageFilename is incorrect and cannot be used for operations such as Remove-Item.

unable to install package Microsoft.Data.SqlClient

Hello, I am unable to install nuget package with

 Install-Package  Microsoft.Data.SqlClient -Provider nuget -Force

It will result in error below:

PS C:\WINDOWS\system32> Install-Package Microsoft.Data.SqlClient -Provider nuget -Force
Install-Package : Dependency loop detected for package 'Microsoft.Data.SqlClient'.
At line:1 char:1
+ Install-Package Microsoft.Data.SqlClient -Provider nuget -Force
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : Deadlock detected: (Microsoft.Data.SqlClient:String) [Install-Package], Exception
    + FullyQualifiedErrorId : DependencyLoopDetected,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallPackage

only way to install this package is with skipdependencies parameter:

Install-Package Microsoft.Data.SqlClient -Provider nuget -skipdependencies

I am pretty sure there is no loop in dependency, Package Manager in visual studio C# project is able to load this nuget package without any issue

40 NuGet bug

When 40 versions of a NuGet have been published to a NuGet v2 feed, Find-Package, Install-Package, and Save-Package fail because they return duplicate copies of each version.

Credential Provider Not Found at Default Path on Linux

TLDR:

This line in NugetLightRequest.GetCredsFromCredProvider incorrectly uses $HOME instead of %HOME% as required by Environment.ExpandEnvironmentVariable(). This causes the credential provider to not be found

// If running Unix
path = "$HOME/.nuget/plugins/netcore/CredentialProvider.Microsoft/CredentialProvider.Microsoft.dll";

Longer Version

Running Red Hat Enterprise Linux release 8.7, PowerShell 7.3.1, PackageManagement 1.4.8.1, PowerShellGet 2.2.5.

Trying to use an Azure Artifacts feed with PowerShell. Installed the credential provider, setup my PS-Repository, etc. (Got all this working on Windows no problem).

When I run Install-Module ModuleFromMyFeed -Debug I get output that includes this:

DEBUG: 00:00:01.3022327 Calling 'GetCredsFromCredProvider' on https://pkgs.dev.azure.com:443/myorg/_packaging/myfeed/nuget/v2/FindPackagesById()?id='ModuleFromMyFeed'&$skip=%7B0%7D&$top=%7B1%7D
DEBUG: 00:00:01.3028816 Calling credential provider installed at
Could not execute because the specified command or file was not found.
Possible reasons for this include:
  * You misspelled a built-in dotnet command.
  * You intended to execute a .NET program, but dotnet--V does not exist.
  * You intended to run a global tool, but a dotnet-prefixed executable with this name could not be found on the PATH.

Note the line for Calling credential provider installed at. There is nothing listed after the at. And note how dotnet thinks I'm trying to run dotnet --V.

If you read through the code in NugetLightRequest.GetCredsFromCredProvider you'll see it first looks for NUGET_PLUGIN_PATHS, which I do not have defined. That fails so it tries to look for the provider at "$HOME/.nuget/plugins/netcore/CredentialProvider.Microsoft/CredentialProvider.Microsoft.dll". It passes that string to Environment.ExpandEnvironmentVariables(). But does not work. Because Environment.ExpandEnvironmentVariables expects variables to be in the format %VAR%, not $VAR. See this github issue. So the variable is not expanded, so the File.Exists() check fails. That leaves credProviderPath blank, so the code then tries to run dotnet -V verbose -U <url>. Which gives the error we see in the output.

The Fix

In the source code switch $HOME to %HOME%.

The workaround.

Set the environment variable NUGET_PLUGIN_PATHS to the full path of CredentialProvider.Microsoft.dll. For example, $env:NUGET_PLUGIN_PATHS = "/home/username/.nuget/plugins/netcore/CredentialProvider.Microsoft/CredentialProvider.Microsoft.dll"

This does work for me.

inconsistent behavior of -AllowPrereleaseVersions

tested on both mac and win machines.

module versions:

Script     1.4.5      PackageManagement                   Desk      {Find-Package, Get-Package, Get-PackageProvider, Get-PackageSource…}
Script     2.2.1      PowerShellGet                       Desk      {Find-Command, Find-DSCResource, Find-Module, Find-RoleCapability…}

providers:

NuGet                    3.0.0.1          Destination, ExcludeVersion, Scope, SkipDependencies, Headers, FilterOnTag, Contains, AllowPrereleaseVersions, ConfigFile, SkipValidate
PowerShellGet            2.2.1.0          PackageManagementProvider, Type, Scope, AllowClobber, SkipPublisherCheck, InstallUpdate, NoPathUpdate, AllowPrereleaseVersions, Filter, Tag, Includes, DscResource, RoleCa…

Current behaviour:

• When running from a local folder:

PS /Users/joo> Find-Package datadiff -source .
Name                           Version          Source           Summary
----                           -------          ------           -------
Datadiff             3.3.0-pre.623    /Users/joo       Base datadiff project

PS /Users/joo> Find-Package stylelabs.datadiff -source . -AllowPrereleaseVersions
Name                           Version          Source           Summary
----                           -------          ------           -------
Stylelabs.Datadiff             3.3.0-pre.623    /Users/joo       Base datadiff project

PS /Users/joo> Find-Package datadiff -source . -AllVersions
Name                           Version          Source           Summary
----                           -------          ------           -------
Datadiff             3.3.0-pre.623    /Users/joo       Base datadiff project
Datadiff             3.2.200          /Users/joo       Base datadiff project
Datadiff             3.2.0-rc.3       /Users/joo       Base datadiff project

• when working with a remote v3 feed

PS /Users/joo> Find-Package datadiff -source https://blah.blob.core.windows.net/packages/index.json -AllowPrereleaseVersions
Name                           Version          Source           Summary
----                           -------          ------           -------
Datadiff             3.2.200          sleet            Base datadiff project

PS /Users/joo> Find-Package datadiff -source https://blah.blob.core.windows.net/packages/index.json
Name                           Version          Source           Summary
----                           -------          ------           -------
Datadiff             3.2.200          sleet            Base datadiff project

PS /Users/joo> Find-Package datadiff -source https://blah.blob.core.windows.net/packages/index.json -AllVersions -AllowPrereleaseVersions
Name                           Version          Source           Summary
----                           -------          ------           -------
Datadiff             3.3.0-pre.623    sleet            Base datadiff project
Datadiff             3.2.200          sleet            Base datadiff project
Datadiff             3.2.0-rc.3       sleet            Base datadiff project

Expected:

aligned behaviour for both local folders and remote v3 feeds

on local folders the Find-Package without "-AllowPrereleaseVersions" flag should return the latest release, not latest pre-release
on remote v3 feeds Find-Package with "-AllowPrereleaseVersions" flag should return the latest pre-release, not latest release

Note:
Also the Find-Package with "-AllVersion" flag and without "-AllowPrereleaseVersions" flag for local feeds is showing the pre-releases.

HttpClient.GetAsync fails with 302 with https if URI redirects on CoreCLR

When the HTTP URI has a redirect, we get a status code 302. This is a security feature and the code needs to work around it.

More context here: https://github.com/dotnet/corefx/issues/12171#issuecomment-250359676

Support Nuget API v3

Microsoft prefer V3 over V2, and V3 seems to be registered in OneGet in fresh Windows 10.

DefaultConfig for nuget config file produces invalid config

NuGetProvider/NugetLightRequest.cs

Lines 85 to 89 in 16519ed

	internal const string DefaultConfig = @"<?xml version=""1.0""?>
	<configuration>
	<packageSources>
	</packageSources>
	</configuration>";

Is the default config for a nuget.config if not found in this provider code. It produces an invalid nuget.config (no sources) and can result in a machine not being able to do any restores for apps or other things relying on nuget going forward.

Trouble with Install-PackageProvider Nuget

First let me start saying I'm not 100% certian this is the correct place but I'm starting somewhere.
I ran across an issue in an environment that requires us to disable SSL 3.0, TLS 1.0, TLS 1.1 along with other weaker chipers and hashes. Through painful trial and error I found 'Install-PackageProvider NuGet' would only work with TLS 1.0 enabled. Are there any plans to remedy this?

If this should be posted elsewhere please let me know.

Unable to Download list of available providers.

On fresh installs of Windows 11 we're attempting to install NuGet in PowerShell v5 using the following command line:
Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Scope AllUsers -Force -ForceBootstrap -Confirm:$false -Verbose:$true -ErrorAction Stop

The process fails with errors including "Inable to download from URI 'https://go.microsoft.com/fwlink/?LinkID=627338&clcid=0x409'" and "Unable to download the list of available providers. Check your internet connection."

If I then try to run Find-PackageProvider i also fails with the same error and terminates with "The specified PackageManagement provider 'NuGet' is not available."

The error text says it’s unable to download from URI https://go.microsoft.com/fwlink/?LinkID=627338&clcid=0x409 and when we go there in Edge, we’re redirected to https://onegetcdn.azureedge.net/providers/providers.masterList.feed.swidtag but the page doesn’t load, displaying a 'took too long to response' error.

Packet captures confirm we’re seeing a SYN but there’s no ACK resulting in an “incomplete conversation”. We’ve ruled out as much as we can on the endpoint itself and our networking teams confirmed they’ve verified there isn’t anything on our corporate network (corporate Ethernet, corporate Wi-Fi, corporate guest, corporate firewall etc.) that’s getting in the way of these requests.

Is it possible that our block of IP's has been blacklisted somehow?
Is OneGet still functional, supported?
Since AnyPackage is the recommended replacement, what's the upgrade path? (read: What is the appropriate process for removing PackageManagement/OneGet and replacing it with AnyPackage?)

Register-PackageSource: Doesn't save credentials to `nuget.config` file

Current Behavior

When I enter …

Register-PackageSource -Name 'Test' -Location 'https://test.contoso.com/' -ProviderName 'NuGet' -Credential (Get-Credential) -ForceBootstrap -Trusted

… no credentials are getting saved to the nuget.config file.

Expected Behavior

If the Credential argument is provided with ProviderName being "NuGet", Register-PackageSource should save provided credentials to nuget.config file.