Update NuGet.config in HttpStress #55519
Conversation
We can't use nuget.org in this manner to comply with security guidance
|
Tagging subscribers to this area: @dotnet/ncl Issue DetailsWe can't use nuget.org in this manner to comply with security guidance.
|
|
Once the HttpStress tests build I'll merge this to unblock the JIT rolling builds. |
| @@ -1,7 +1,7 @@ | |||
| <?xml version="1.0" encoding="utf-8"?> | |||
| <configuration> | |||
| <packageSources> | |||
| <!-- Add public nuget feed. --> | |||
| <add key="nuget.org" value="https://api.nuget.org/v3/index.json" /> | |||
| <clear /> | |||
There was a problem hiding this comment.
Why do you clear this? We need what's in repository wide nuget.config
There was a problem hiding this comment.
If this is true, then you should not have this file at all. We don't allow nuget.org. Let me delete this and we'll see the fallout. FYI, this already broke other partners within the runtime repo.
There was a problem hiding this comment.
Let's try. BTW, /azp run runtime-libraries stress-http is the magic to run the pipeline.
There was a problem hiding this comment.
One more thing, can we import packages from nuget.org to dotnet-public if they are missing? What's the process for that?
| <!-- Add public nuget feed. --> | ||
| <add key="nuget.org" value="https://api.nuget.org/v3/index.json" /> | ||
| <clear /> | ||
| <add key="dotnet-public" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json" /> |
There was a problem hiding this comment.
Will all the packages we use be there? Could you run the stress pipeline on this PR? It's not part of inner loop.
|
/azp run runtime-libraries stress-http |
|
Azure Pipelines successfully started running 1 pipeline(s). |
|
/azp run runtime-libraries stress-http |
|
Azure Pipelines successfully started running 1 pipeline(s). |
There was a problem hiding this comment.
The http stress pipeline run for the last change.
I don't want to wait for it, so approving, thanks.
|
The pipeline looks good |
ghost
locked as resolved and limited conversation to collaborators
We can't use nuget.org in this manner to comply with security guidance.