"The use of .nupkg or .nuspec in for package name or source is known to cause issues." reports empty nuspec <id /> when a .nupkg file was specified

[jpluimers]

What You Are Seeing?

Being a novice chocolatey contributor, I follow documentation as I wanted to create a pull request for Any plans to upgrade SetACL to the new version? · Issue #309 · bcurran3/ChocolateyPackages.

So I expanded the cryptic -dv -s . switches from Chocolatey Software | Building, Testing, and Pushing Your Package into an understandable form in order to build and test before submitting any pull request for the above issue.

The first line after running choco install setacl.3.1.2.0.nupkg --debug --verbose --source=. surprised me as it did not help me into formulating the correct command (though I was happy the install did succeed).

Extract from the full log gist:

C:\Users\jeroenp\Documents\Versioned\github.com\jpluimers\bcurran3.ChocolateyPackages\setacl>choco install setacl.3.1.2.0.nupkg --debug --verbose --source=.
The use of .nupkg or .nuspec in for package name or source is known to cause issues. Please use the package id from the nuspec `<id />` with `-s .` (for local folder where nupkg is found).
Chocolatey v1.1.0
Chocolatey is running on Windows v 10.0.19044.0
...

What is Expected?

Instead of <id /> I expected a .nuspec name, .nuspec filename or package name (as all three are in the setacl.3.1.2.0.nupkg which appears to be a ZIP compressed Office Open XML file formats having both the source content and some extra meta-data).

How Did You Get This To Happen? (Steps to Reproduce)

1. I forked https://github.com/bcurran3/ChocolateyPackages into https://github.com/jpluimers/bcurran3.ChocolateyPackages

2. From C:\Users\jeroenp\Documents\Versioned\github.com\jpluimers I did a git clone https://github.com/jpluimers/bcurran3.ChocolateyPackages

3. In the directory tree C:\Users\jeroenp\Documents\Versioned\github.com\jpluimers\bcurran3.ChocolateyPackages\setacl I changed the files according to the changes I documented in Any plans to upgrade SetACL to the new version? · Issue #309 · bcurran3/ChocolateyPackages

4. Following the steps from the above documentation link, I started with [choco pack](https://docs.chocolatey.org/en-us/create/commands/pack). in that directory with the below output indicating that setacl.3.1.2.0.nupkg is the package name:

   C:\Users\jeroenp\Documents\Versioned\github.com\jpluimers\bcurran3.ChocolateyPackages\setacl>choco pack
   Chocolatey v1.1.0
   Attempting to build package from 'setacl.nuspec'.
   Successfully created package 'C:\Users\jeroenp\Documents\Versioned\github.com\jpluimers\bcurran3.ChocolateyPackages\setacl\setacl.3.1.2.0.nupkg'
   

   If the last line had been as below, then it would have been clear to me that the package name is setacl and the package filename is C:\Users\jeroenp\Documents\Versioned\github.com\jpluimers\bcurran3.ChocolateyPackages\setacl\setacl.3.1.2.0.nupkg

   Successfully created package file 'C:\Users\jeroenp\Documents\Versioned\github.com\jpluimers\bcurran3.ChocolateyPackages\setacl\setacl.3.1.2.0.nupkg' from package `setacl` version `3.1.2.0`.
   

5. Now from a UAC elevated command prompt I ran choco install setacl.3.1.2.0.nupkg --debug --verbose --source=. with this output start:

   C:\Users\jeroenp\Documents\Versioned\github.com\jpluimers\bcurran3.ChocolateyPackages\setacl>choco install setacl.3.1.2.0.nupkg --debug --verbose --source=.
   The use of .nupkg or .nuspec in for package name or source is known to cause issues. Please use the package id from the nuspec `<id />` with `-s .` (for local folder where 
   nupkg is found).
   Chocolatey v1.1.0
   Chocolatey is running on Windows v 10.0.19044.0
   ...
   

System Details

• OS Build (In PowerShell run [System.Environment]::OSVersion.version.tostring()): 10.0.19044.0
• Windows PowerShell version (Run: $PSVersionTable):

  Name                           Value
  ----                           -----
  PSVersion                      5.1.19041.1682
  PSEdition                      Desktop
  PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
  BuildVersion                   10.0.19041.1682
  CLRVersion                     4.0.30319.42000
  WSManStackVersion              3.0
  PSRemotingProtocolVersion      2.3
  SerializationVersion           1.1.0.1
  

• Chocolatey version (Run choco --version): 1.1.0

Output Log

Full Log Output

IF YOUR LOG CONTENT IS SHORT, PLACE IT HERE - WE NEED _ALL_ DETAILED OUTPUT BASED ON THE ABOVE TO BE ABLE TO PROVIDE SUPPORT (YOU WILL FIND THAT IN THE $env:ChocolateyInstall\logs\chocolatey.log between the `=====`)
IF YOUR LOG CONTENT IS LONG, PLEASE LINK TO A GIST (see https://docs.github.com/en/github/writing-on-github/editing-and-sharing-content-with-gists/creating-gists)

Full log in: https://gist.github.com/jpluimers/12154f5ce5500e1a7f3cb6a3596f0523

[TheCakeIsNaOH]

You need to run choco install setacl --debug --verbose --source=. and then the warning should not be shown.

setacl is the ID of the package, and what is in the <id> element of the .nuspec file.
setacl.3.1.2.0.nupkg is the filename of the package, not the id/name of the package.

[gep13]

@jpluimers I just wanted to add from additional information here, on top of what @TheCakeIsNaOH has already stated...

• You are correct, an instance of Chocolatey package (i.e. a nupkg), is just a zip file under the hood, and it contains some additional files used for understanding the NuGet packaging specification.
• In the example that you pointed to, it has the following choco install packageName -dv -s . where it is saying, provide the packageName, or more specifically, the id, not the packageFileName. In your case, the packageName is setacl and the package file name is setacl.3.1.2.0.nupkg. This is the case throughout Chocolatey, for example, each of the installation commands that you can see here: https://community.chocolatey.org/packages Each one of those commands uses the package name, which is just adobereader, or chocolatey or flashplayerplugin. None of those commands specify the package file name, so when testing locally, there is no difference, other than specifying either an alternative or additional source ,i.e. .
• While going through the process of creating the package, I am curious if you found this page: https://docs.chocolatey.org/en-us/create/create-packages#testing-your-package If not, we need to do a better job at surfacing it. I am specifically referring to the final note in that section.

[jpluimers]

Thanks for this @TheCakeIsNaOH:

You need to run choco install setacl --debug --verbose --source=. and then the warning should not be shown.

setacl is the ID of the package, and what is in the <id> element of the .nuspec file.
setacl.3.1.2.0.nupkg is the filename of the package, not the id/name of the package.

When researching the confusing message, I got these differences.

Seeing that message in the first place gives me the feeling Chocolatey is trying to help relatively novice users.

But for them, it is confusing: apparently at that moment they are already supposed to know what an empty <id /> means (despite it being not empty in the .nupkg nor the .nuspec files).

I think Chocolatey can do better here given that it knows how a .nupkg file is structured and that it can distill out the correct information from it.

Hence my issue in the first place and my suggestion above to enrich the choco pack output like this:

`Successfully created package file 'C:\Users\jeroenp\Documents\Versioned\github.com\jpluimers\bcurran3.ChocolateyPackages\setacl\setacl.3.1.2.0.nupkg' from package `setacl` version `3.1.2.0`.

Thinking about it, it would be a great help for all (not just novice) users to rephrasing the choco install output

The use of .nupkg or .nuspec in for package name or source is known to cause issues. Please use the package id from the nuspec `<id />` with `-s .` (for local folder where nupkg is found).

into something like

The use of .nupkg or .nuspec in for package name or source is known to cause issues. Please use the package id from the nuspec `<id />` with `-s .` (for local folder where nupkg is found). In your case the package id from the nuspec file inside the nupkg is `setacl`.

Thanks for the commits and comments @gep13: much appreciated.

While going through the process of creating the package, I am curious if you found this page: https://docs.chocolatey.org/en-us/create/create-packages#testing-your-package If not, we need to do a better job at surfacing it. I am specifically referring to the final note in that section.

No, but I did find https://docs.chocolatey.org/en-us/create/create-packages in the Google Search results (archived here) right above https://community.chocolatey.org/courses/creating-chocolatey-packages/building-testing-and-pushing

I think with "note" you mean this one:

NOTE: Do not call install with .nupkg - pointing to a file explicitly overrides source. You must call your install with the package name, not the nupkg file and location. You've already specified for choco to look in a local source with --source "'.;https://community.chocolatey.org/api/v2/'". Call choco install dude --source "'.;https://community.chocolatey.org/api/v2/'", not choco install .\dude.nupkg --source "'.;https://community.chocolatey.org/api/v2/'".

I didn't notice it as it was too low on the page after irrelevant contexts (like package dependencies). In addition it was too large to understand in one go. I need to think about how that can be done better.

Back the the search results:

Basically https://community.chocolatey.org/courses/creating-chocolatey-packages/building-testing-and-pushing is the https://docs.chocolatey.org/en-us/create/create-packages#testing-your-package subset of the huge https://docs.chocolatey.org/en-us/create/create-packages page so I agree with Google that https://community.chocolatey.org/courses/creating-chocolatey-packages/building-testing-and-pushing is a better fit for my purpose than https://docs.chocolatey.org/en-us/create/create-packages#testing-your-package

Note I was not creating a fresh package, but preparing a pull request for an existing published package.

Since modifications are way more frequent than creations and require a smaller skill-set, it is important for bout output and documentation to take that into account: that was the basic reason for submitting this issue.

I am drafting a blog post that has one more point and will file a separate issue for that.

[koitsu]

I came across this ordeal today and wanted to ask something:

The warning message, which dates back to commit ff0340c, is grammatically incorrect. Exactly what does (emphasis mine) "The use of .nupkg or .nuspec in for package name or source ..." mean? Is it trying to say something like the below? (Sorry, GitHub seems to be eating my backticks, and escaping them does not seem to work)

The use of .nupkg or .nuspec as a package name or source is known to cause issues. When using -s . please use the package name from the nuspec <id> field instead of the explicit .nupkg or .nuspec file.

Also FWIW, I'm struggling with what this ticket is about, but on only 1 of my 3 Chocolatey packages, which is quite strange.

[koitsu]

Also FWIW, I'm struggling with what this ticket is about, but on only 1 of my 3 Chocolatey packages, which is quite strange.

I figured out the problem: it has to do with the <version> string. It seems choco pack will let you get away with certain version syntaxes that choco install will not, resulting in package installation failures that would otherwise work. I can make a separate ticket about this, but in short:

    <id>asm6f</id>
    <version>1.6-freem-v02</version>

...will work with choco pack but fail with choco install asm6f -s .. Meanwhile, using a version of 1.6.20181019 results in a happy choco pack and choco install asm6 -s . I suspect this relates, somehow, to https://docs.chocolatey.org/en-us/create/create-packages#package-fix-version-notation but I haven't quite worked out why.

[corbob]

@koitsu that's likely because the first version is a prerelease, so you need to either specify the version, or include --pre. If that still doesn't allow you to install the package, I'd suggest opening a new issue because that version looks to me like it should work.

[koitsu]

@corbob Thanks a lot! The message has since scrolled off my terminal, but I do remember it saying something about --pre which I did not understand. Might be good to have the documentation updated to reflect this too (not volunteering you, myself, or the OP here). Anyway I at least worked around it.