Ability to restrict nuget package to specific feed

[augustoproiete]

(or one possible way NuGet could improve the dotnet restore story around failed sources)

I understand that the current behavior is by design (#7035, #7015, #6373) and I'm proposing improvements to it.

---

Today all of our builds were broken because of

1.) dotnet restore requires that every single package source to be accessible

and

2.) MyGet had an outage that lasted several hours (still out as of this writing)

---

In my scenario, all nuget packages come from nuget.org except for 1 (one) single package that comes from a vendor - that happens to be hosted in a MyGet private feed. I tried to add one more dependency (from nuget.org) but because MyGet was down, I got an error:

NuGet.targets(128,5): error : Unable to load the service index for source https://www.myget.org/F/vendor/api/v3/index.json

My .csproj was changed from something like this:

<ItemGroup>
  <PackageReference Include="Serilog" Version="2.10.0" />
  <PackageReference Include="VendorPackage" Version="1.2.3" />
</ItemGroup>

To something like this:

<ItemGroup>
  <PackageReference Include="AutoMapper" Version="10.1.1" />
  <PackageReference Include="Serilog" Version="2.10.0" />
  <PackageReference Include="VendorPackage" Version="1.2.3" />
</ItemGroup>

As you can see, all I've done was to add a new dependency (that would be found only in nuget.org).

I had done a dotnet restore previously so both Serilog and VendorPackage were already in the local nuget cache (along with their own dependencies), and the newly added package AutoMapper in this example needed to be restored from nuget.org.

Now, there seems to be a couple of issues here that I don't fully understand:

1.) Why does nuget need to try to access any on-line package sources, if I'm asking for VendorPackage v1.2.3 and it's already in the local cache along with all of its dependencies?

I would understand the need to check for new versions if I used a wildcard in the version number e.g. <PackageReference Include="VendorPackage" Version="1.2.*" /> but I didn't... I have a very specific and hard-coded version there... That should be enough.

2.) Why does nuget need to search for the package in every single source? Again, I declared AutoMapper v10.1.1 that exists in the local nuget cache, and was found in nuget.org. Why doesn't it stop with the first feed that satisfy the hard-coded version requirement?

---

Proposal

Regardless of the answers to the questions above, I believe the dotnet restore experience would improve a lot of we could define which feed(s) should be searched for each package.

A new attribute on PackageReference e.g. Feed could allow one or more names (CSV) of package sources that are defined in the nuget configuration (machine/local).

e.g.

.csproj

<ItemGroup>
  <PackageReference Include="AutoMapper" Version="10.1.1" Feed="nuget.org" />
  <PackageReference Include="VendorPackage" Version="1.2.3" Feed="vendor" />
</ItemGroup>

nuget.config

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="vendor" value="https://www.myget.org/F/vendor/api/v3/index.json" />
  </packageSources>
  <disabledPackageSources>
    <clear />
  </disabledPackageSources>
  <fallbackPackageFolders>
    <clear />
  </fallbackPackageFolders>
</configuration>

---

Verbose Logs

C:\project>dotnet restore
  Determining projects to restore...
  Restored C:\project\src\Project.Utils\Project.Utils.csproj (in 386 ms).
  Restored C:\project\src\Project.ApiModels\Project.ApiModels.csproj (in 386 ms).
  Restored C:\project\test\Project.Api.IntegrationTests\Project.Api.IntegrationTests.csproj (in 632 ms).
  Restored C:\project\test\Project.Utils.UnitTests\Project.Utils.UnitTests.csproj (in 639 ms).
  Restored C:\project\src\Project.Utils.Excel\Project.Utils.Excel.csproj (in 727 ms).
  Restored C:\project\src\Project.DataModels.Migrations\Project.DataModels.Migrations.csproj (in 780 ms).
  Restored C:\project\src\Project.DataModels\Project.DataModels.csproj (in 786 ms).
C:\Program Files\dotnet\sdk\3.1.403\NuGet.targets(128,5): error : Unable to load the service index for source https://www.myget.org/F/vendor/api/v3/index.json. [C:\project\project.sln]
C:\Program Files\dotnet\sdk\3.1.403\NuGet.targets(128,5): error :   Response status code does not indicate success: 503 (Service Unavailable). [C:\project\project.sln]

---

.NET Core SDK (reflecting any global.json):
 Version:   3.1.403
 Commit:    9e895200cd

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.18363
 OS Platform: Windows
 RID:         win10-x64
 Base Path:   C:\Program Files\dotnet\sdk\3.1.403\

Host (useful for support):
  Version: 3.1.9
  Commit:  774fc3d6a9

[nkolev92]

Hey @augustoproiete,

Thanks for filling this issue. Dup of #6867.