Can't download package with '+' in version string from TeamCity

[bigbearzhu]

Description

We used SemVer 2.0 versioning for some of our package. e.g. the package name could be: MyPackage.1.2.0-master+aaabbb.nupkg.

The metadata section was recently added to the package. When it was not there, paket worked fine. However, when we tried to add the metadata section with '+', paket update failed with 404 return from TeamCity. See the stacktrace below.

What I found is that the url does return 404 when manually accessed, however, it was just because the '+' was not escaped to %2B. If I change the url to http://TeamCity/guestAuth/app/nuget/v1/FeedService.svc/download/WebServices_NuGetPackage/36664:id/MyPackage.1.2.0-master%2Baaabbb.nupkg TeamCity returns the package fine. Sounds like we should escape the url?

Paket failed with:
        Could not download MyPackage.1.2.0-master+aaabbb from http://TeamCity/guestAuth/app/nuget/v1/FeedService.svc/download/WebServices_NuGetPackage/36664:id/MyPackage.1.2.0-master+aaabbb.nupkg.
    The remote server returned an error: (404) Not Found.
StackTrace:
     at [email protected](String message)
   at [email protected](Exception _arg10)
   at [email protected](AsyncParams`1 args)
--- End of stack trace from previous location where exception was thrown ---
   at Microsoft.FSharp.Control.AsyncBuilderImpl.commit[a](AsyncImplResult`1 res)
   at Microsoft.FSharp.Control.CancellationTokenOps.RunSynchronouslyInAnotherThread[a](CancellationToken token, FSharpAsync`1 computation, FSharpOption`1 timeout)
   at Microsoft.FSharp.Control.CancellationTokenOps.RunSynchronously[a](CancellationToken token, FSharpAsync`1 computation, FSharpOption`1 timeout)
   at Microsoft.FSharp.Control.FSharpAsync.RunSynchronously[T](FSharpAsync`1 computation, FSharpOption`1 timeout, FSharpOption`1 cancellationToken)
   at [email protected](b& )
   at Microsoft.FSharp.Collections.IEnumerator.MapEnumerator`1.System-Collections-IEnumerator-MoveNext()
   at Microsoft.FSharp.Core.CompilerServices.RuntimeHelpers.takeOuter@683[T,TResult](ConcatEnumerator`2 x, Unit unitVar0)
   at System.Collections.Generic.List`1..ctor(IEnumerable`1 collection)
   at Microsoft.FSharp.Collections.SeqModule.ToArray[T](IEnumerable`1 source)
   at Paket.InstallProcess.InstallIntoProjects[a](InstallerOptions options, Boolean forceTouch, DependenciesFile dependenciesFile, LockFile lockFile, FSharpList`1 projectsAndReferences, FSharpMap`2 updatedGroups)
   at Paket.UpdateProcess.SmartInstall(DependenciesFile dependenciesFile, UpdateMode updateMode, UpdaterOptions options)
   at <StartupCode$Paket-Core>[email protected](Unit unitVar0)

   at Paket.Utils.RunInLockedAccessMode[a](String rootFolder, FSharpFunc`2 action)
   at [email protected](ParseResults`1 results)
   at Paket.Program.processWithValidation[T](Boolean silent, FSharpFunc`2 validateF, FSharpFunc`2 commandF, ParseResults`1 result)
   at Paket.Program.main$cont@420(ParseResults`1 results, Boolean silent, Boolean fromBootstrapper, Unit unitVar)
   at Paket.Program.main()

Repro steps

Please provide the steps required to reproduce the problem

1. Create a package with name MyPackage.1.2.0-master+aaabbb.nupkg on TeamCity.

2. Install the package using paket.

Expected behavior

Should install the package correctly.

Actual behavior

404 error and fail to install.

Known workarounds

No.

[bigbearzhu]

Sorry with latest release 4.5.1, the issue seems still exists.

From the stack trace, the error was thrown in NuGetV2.download method, not the places where you have changed in commit a46c0fd. And also I would think it maybe better to be escaped when the url is just fetched, instead of when it is used.

Paket/src/Paket.Core/NuGetV2.fs

Line 929 in da5ff5a

let rec download authenticated attempt =

[forki]

I reverted it and tried 94560b5. can you please retry with 4.5.2 or send another potential fix?

[bigbearzhu]

4.5.2 didn't fix the issue as Uri.IsWellFormedUriString at

Paket/src/Paket.Core/NuGetV2.fs

Line 945 in e43745a

if Uri.IsWellFormedUriString(nugetPackage.DownloadLink, UriKind.Absolute) then

returns true for the url with only + not encoded. I have created a pull request for the proper fix.