Uploaded image for project: 'Dev - Nexus Repo'
  1. Dev - Nexus Repo
  2. NEXUS-34774

Some dependency packages are not downloaded via Nexus Nuget V3 repository

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 3.37.0, 3.41.0
    • Fix Version/s: 3.43.0
    • Component/s: nuget-v3
    • Labels:
    • Story Points:
      3
    • Sprint:
      NXRM MadMax Sprint 43, NXRM MadMax Sprint 44
    • Notability:
      3

      Description

      SYMPTOM:

      Not all but some of Nuget dependencies are not downloaded with nuget command.
      For example, autofixture.autonsubstitute.3.51.0.nupkg https://www.nuget.org/api/v2/package/AutoFixture.AutoNSubstitute/3.51.0
      After extracting:

      $ grep depen autofixture.autonsubstitute/AutoFixture.AutoNSubstitute.nuspec
          <dependencies>
            <dependency id="AutoFixture" version="3.51.0" />
            <dependency id="NSubstitute" version="1.5.0" />
          </dependencies>
      

      Without Nexus, above dependencies are downloaded, but not via Nexus V3 repositories

      REPRODUCE STEPS:

      1. Create nuget-V3-hosted, nuget-V3-proxy, nuget-V3-group repositories
      2. Upload some nuget package which has dependencies (eg: autofixture.autonsubstitute.3.51.0.nupkg from above URL)
      3. Use nuget command to download via group repository
        $ nuget install AutoFixture.AutoNSubstitute -Version '3.51.0' -Source http://localhost:8081/repository/nuget-v3-group/index.json -OutputDirectory ./packages_nexus -NoCache -Verbosity Detailed
        NuGet Version: 5.11.0.10
        Feeds used:
          http://localhost:8081/repository/nuget-v3-group/index.json
        
        Attempting to gather dependency information for package 'AutoFixture.AutoNSubstitute.3.51.0' with respect to project '/Users/hosako/Desktop/test/nuget/packages_nexus', targeting 'Any,Version=v0.0'
          GET http://localhost:8081/repository/nuget-v3-group/v3/registration/5/autofixture.autonsubstitute/index.json
          OK http://localhost:8081/repository/nuget-v3-group/v3/registration/5/autofixture.autonsubstitute/index.json 3195ms
        ... (snip) ...
        
        Successfully installed 'AutoFixture.AutoNSubstitute 3.51.0' to /Users/hosako/Desktop/test/nuget/packages_nexus
        Executing nuget actions took 178 ms
        

      Above says "Attempting gather dependency information for package", but only one nupkg:

      $ ls -l packages_nexus/
      total 0
      drwxr-xr-x  6 hosako  staff  192 19 Aug 18:18 AutoFixture.AutoNSubstitute.3.51.0
      

      Also, http://localhost:8081/repository/nuget-v3-group/v3/registration/5/autofixture.autonsubstitute/index.json shows

      "@id":"http://localhost:8081/repository/nuget-v3-proxy/v3/registration/4/autofixture.autonsubstitute/3.50.7.json"},{"catalogEntry":{"authors":"Daniel Hilgarth","dependencyGroups":[]
      

      If I use "-Source https://api.nuget.org/v3/index.json" in the nuget command:

      $ ls -l ./packages_nugetorg/
      total 0
      drwxr-xr-x   6 hosako  staff  192 19 Aug 17:28 AutoFixture.3.51.0
      drwxr-xr-x   6 hosako  staff  192 19 Aug 17:28 AutoFixture.AutoNSubstitute.3.51.0
      drwxr-xr-x  10 hosako  staff  320 19 Aug 17:28 NSubstitute.1.5.0.0
      

      POTENTIAL CAUSE:

      As per https://docs.microsoft.com/en-us/nuget/reference/nuspec#dependencies-element, only "id" and "version" are Required, however, it seems Nexus (parseDependencyGroups) is expecting at least three, so that packages which have the following line would not be parsed correctly:

            <dependency id="NSubstitute" version="1.5.0" />
      

      Just for the record, the nuspec of same component but 4.17.0 has below line:

              <dependency id="NSubstitute" version="[2.0.3, 5.0.0)" exclude="Build,Analyzers" />
      

        Attachments

          Activity

            People

            Assignee:
            vgrab Vladimir Grab
            Reporter:
            hosako Hajime Osako
            Last Updated By:
            Vladimir Grab Vladimir Grab
            Team:
            NXRM - Mad Max
            Owner:
            Vladimir Grab Vladimir Grab
            Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved:
              Date of First Response:

                tigCommentSecurity.panel-title