this post was submitted on 03 Aug 2023
2 points (100.0% liked)

.NET

1465 readers
5 users here now

Getting started

Useful resources

IDEs and code editors

Tools

Rules

Related communities

Wikipedia pages

founded 1 year ago
MODERATORS
[email protected]
[email protected]
[email protected]
2
Private Nuget feed hosting (programming.dev)
submitted 1 year ago by [email protected] to c/[email protected]
12 comments fedilink hide all child comments
 

I wanted to exchange some experience regarding private NuGet feed hosting solutions.

We have used MyGet for years both for our private and public packages. But recently it became so unstable that it would not be responsible to not investigate the alternatives. I looked into Azure Artifacts first because, we already have Azure Devops and it comes free. The transition was mostly painless (I plan to write about it in more detail soon). But hosting public feeds doesn't seem as easy. One needs to create a public project just for that. So, we still use MyGet for public feeds for now. But will move them also elsewhere.

What are your experiences with private feed hosting? Do you host them yourselves or use a paid service?

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 1 points 1 year ago* (last edited 1 year ago)

Wish I could upvote more than once. Azure artifacts has some fucky authentication requirements (cleartextpassword is the dumbest field I’ve ever heard of - especially since it’s not clear text or a password, it’s a base64ed PAT) but there’s plenty of first party support to make it less painful, and it’s a problem you only have to ‘fix’ once.

Our prior solution was verdaccio for NPM and a shared drive location for Nuget, and….well, it beats the tar out of either of those. Being able to see exactly what’s in the feed, when it got there, who put it there….all grade a stuff. Handling SSO and such seamlessly is nice too, and being able to scope access with tons of granularity….well it seems like a rake waiting to be stepped on, honestly, but if you need to manage access it seems like a big win.

Public feeds - yes. Why reinvent the wheel? Will be easier to find and use if it’s on nuget.org.

If OP’s goal is to be able to source control all the public packages that their projects use, for security or peace of mind purposes (or to make it the sole source of packages to avoid dependency injection/confusion attacks)…there’s actually a feature of Azure Artifacts where you can pull packages from an ‘upstream’ like nuget.org and host public packages in a private feed. It’s got a gui, and it’s pretty convenient as far as such things go.