NuGet repositories

NuGet repositories are NuGet v3 package sources for dotnet restore, dotnet add package, dotnet nuget push, nuget.exe, Visual Studio and Rider. Hosted repositories take the packages you push; proxy repositories cache nuget.org or another v3 feed. The source address is the repository's service index, https://<depotex>/repository/<space>/<repository>/index.json.

1. Add the source

dotnet nuget add source https://depotex.example.com/repository/my-space/nuget/index.json --name depotex \
  --username me --password "$DEPOTEX_TOKEN" --store-password-in-clear-text
dotnet add package Acme.Tools --version 1.0.0

Or in nuget.config, with the token from the environment:

<configuration>
  <packageSources>
    <add key="depotex" value="https://depotex.example.com/repository/my-space/nuget/index.json" />
  </packageSources>
  <packageSourceCredentials>
    <depotex>
      <add key="Username" value="me" />
      <add key="ClearTextPassword" value="%DEPOTEX_TOKEN%" />
    </depotex>
  </packageSourceCredentials>
</configuration>

With a NuGet group as the space's default, https://depotex.example.com/repository/my-space/nuget/index.json is one source for your packages and nuget.org's (through a proxy member), and takes pushes.

2. Publish a package

Push with an API token as the API key (Publish permission):

dotnet pack -c Release
dotnet nuget push bin/Release/Acme.Tools.1.0.0.nupkg \
  --source https://depotex.example.com/repository/my-space/nuget/index.json --api-key "$DEPOTEX_TOKEN"

• The package must hold one .nuspec at its root with a valid ID and version; Depotex reads it to answer version lists, package details and search.
• IDs and versions are case-insensitive, and versions are normalized as nuget.org does: 1.0 is 1.0.0, 1.0.0.0 is 1.0.0, and build metadata after + is dropped.
• A version can't be replaced once published, as on nuget.org: new NuGet repositories publish once. Pushing a version that's already there answers 409 (conflict), so dotnet nuget push --skip-duplicate skips it.
• The API key is an API token from Profile → API tokens; it's sent in the X-NuGet-ApiKey header, which Depotex accepts for API tokens only.

3. Unlist or delete a version

dotnet nuget delete Acme.Tools 1.0.0 --source … --api-key … unlists the version by default, as nuget.org does: it leaves search and the version lists in Visual Studio, but projects that reference it exactly still restore it. Unlist and relist from the version's page in the browser too (Unlist, Relist), with Overwrite permission.

To have dotnet nuget delete remove the package instead, a repository admin sets When a package is deleted with dotnet nuget delete to Delete it in the repository's Settings (hosted repositories). Unlisting and relisting raise nuget.package.list, and changing the setting raises nuget.settings.update; organization policies can refuse either.

4. Versions and policies

• Each package version is a version in Depotex: it shows in the Versions tab, and cleanup policies, quotas, quarantine and the block list apply to it. Cleanup moves versions to the trash; it doesn't unlist them.
• Block-list rules name the package ID in any case, and ranges compare versions as NuGet does ([1.0,2.0) covers 1.5.0.1; pre-releases come before their release).
• Blocked versions are left out of version lists, package details and search, and their packages are refused; quarantined versions too when the repository hides them.

5. Proxy repositories

Add an upstream with the nuget.org preset (https://api.nuget.org/v3/index.json) or another v3 feed's service index, allow it for the space, then create a proxy repository with it. Depotex reads the upstream's service index to find its packages, details and search, caches version lists and details (re-checked after the metadata age) and packages (kept), and forwards search to the upstream. Feeds that serve details or packages from other hosts work; like Helm, other hosts are only reached by host name over HTTPS, and the upstream's credentials only go to its own server. A proxy can also reach a NuGet repository of another Depotex (Depotex link).

6. In the artifact browser

Packages show by ID, then their versions. The Install bar shows dotnet add package for the version, and Registry setup shows the PackageReference line. Unlisted versions are marked Unlisted.

7. Older clients and SemVer 2.0.0

Versions such as 1.0.0-beta.1 (a dotted pre-release label) or 1.0.0+build.5 (build metadata), and packages that depend on such versions, are SemVer 2.0.0 packages. NuGet clients before 4.3 (nuget.exe 4.1 and older, Visual Studio 2015) can't read them, so, as on nuget.org, Depotex leaves them out of what those clients see: their package details and search results show only the other versions. NuGet 4.3 and later, dotnet and current Visual Studio see every version.

8. Limits

• Symbol packages (.snupkg) aren't served.
• The old NuGet v2 (OData) feed isn't served: use a v3 client (dotnet, nuget.exe 3 or later, Visual Studio 2015 or later, PSResourceGet). nuget.exe 2, and PowerShellGet 2's Install-Module and Find-Module, need a v2 feed and can't install from Depotex; pushing with them works.
• Package signatures aren't checked or shown.
• Search through a group asks every member, so very deep result pages are slower, and the total count can be approximate.
• The browser doesn't show the .nuspec details or dependencies yet.