Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve experience for embedded license files in package manager #957

Open
glopesdev opened this issue Jul 2, 2022 · 1 comment · May be fixed by #1969
Open

Improve experience for embedded license files in package manager #957

glopesdev opened this issue Jul 2, 2022 · 1 comment · May be fixed by #1969
Labels
bug Something isn't working
Milestone

Comments

@glopesdev
Copy link
Member

glopesdev commented Jul 2, 2022

The new standard for NuGet is embedding license files directly in packages to ensure immutability (see wiki). Unfortunately, the package manager experience is not great for these packages in two common scenarios:

  1. Packages hosted in local folders will expose the license metadata embedded in the .nupkg but the current dialog only knows how to handle deflated packages, and will crash when trying to access the license terms. A possible workaround is to check whether the package is an instance of LocalPackageSearchMetadata and access the local package reader stream for the license file directly.
  2. The MyGet server does not correctly handle embedded license files, resulting in both no license metadata and no license URL being available when browsing packages with embedded licenses. This is unfortunate for packages requiring license acceptance as there is currently no way to make the licenses visible.

Unfortunately for 2. it seems that MyGet server version for NuGet has failed to keep up with protocol updates, and it is likely this will continue to be the case. We should probably start considering alternatives for hosting packages in the long term.

@glopesdev glopesdev added the bug Something isn't working label Jul 2, 2022
@glopesdev
Copy link
Member Author

The current outage in MyGet.org exposed the fragility of relying on it for a permanent hosting solution. Our current recommendation will be for the community to upload all packages to NuGet.org. For the next release we will consider transitioning into a separate service for experimental / curated feeds. Some alternatives below:

@glopesdev glopesdev added this to the 2.9 milestone Aug 27, 2024
@glopesdev glopesdev linked a pull request Aug 28, 2024 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant