Skip to content

Draft: Add support for NuGet request forwarding

Moaz Khalifa requested to merge 233414-add-support-for-nuget-request-forwarding into master

What does this MR do and why?

C#/.NET developers often use a combination of private, in-house built packages and packages that are publically available in the public NuGet registry.

However, we do not currently help users pull packages from this popular, remote repository.

In this MR, when a user tries to download a NuGet package using their Project/Group endpoint and the package is NOT found, we forward the request to nuget.org and download the package if found there.

How to set up and validate locally

Note: There are two endpoints the NuGet client can hit in order to download a package: 1. The metadata service endpoint which provides the download URL, 2. The download endpoint directly.

Testing request forward through the metadata service:

  1. Make sure that the Forward NuGet package requests option is enabled on your admin application settings page: http://gdk.test:3000/admin/application_settings/ci_cd#js-package-settings
  2. Add your local group or project as a source with the NuGet CLI.
  3. Try to install a NuGet package that doesn't exist in your source. We can test with any published NuGet package. Try this one for example:
nuget install NodaMoney -Source localhost -Version 1.0.4
  1. The package should be successfully installed from nuget.org because the request has been forwarded.
  2. Remove the installed package files from the directory it was downloaded in.
  3. Clear local NuGet cache:
 nuget locals all -clear
  1. Toggle the Forward NuGet package requests option then try to install the same package again. You should receive the following error:
Package 'NodaMoney 1.0.4' is not found in the following primary source(s): 'http://gdk.test:3000/api/v4/projects/<your_project_id>/packages/nuget/index.json'. Please verify all your online package sources are available (OR) package id, version are specified correctly.
  1. In order to test cascading group's settings to its subgroups, follow these steps:
    1. Create a subgroup inside your parent group.
    2. Make sure the subgroup's nuget_package_requests_forwarding setting is disabled:
    Namespace::PackageSetting.find_by_namespace_id(<subgroup_id>).update(nuget_package_requests_forwarding: false)
    1. Make sure the parent group's nuget_package_requests_forwarding & lock_nuget_package_requests_forwarding settings are enabled:
    Namespace::PackageSetting.find_by_namespace_id(<parent-group_id>).update(nuget_package_requests_forwarding: true, lock_nuget_package_requests_forwarding: true)
    1. Add the subgroup or a project in this subgroup as a source with the NuGet CLI and name it localhost2 for example. Note that any name would work.
    2. Clear local NuGet cache:
     nuget locals all -clear
    1. Try to install the NodaMoney package:
     nuget install NodaMoney -Source localhost2 -Version 1.0.4
    1. The package should be installed successfully since we are enforcing NuGet setting for all subgroups settings in the parent group.

Testing request forward through the download endpoint:

  1. Clear local NuGet cache: 
     nuget locals all -clear
  2. Create a packages.config file in a local directory on your machine.
 <?xml version="1.0" encoding="utf-8"?>
 <packages>
   <package id="NodaMoney" version="1.0.4" />
 </packages>
  1. Execute the command:
  nuget restore -PackagesDirectory . -Source localhost
  1. nuget restore command would hit the download endpoint directly and the request should be forwarded to nuget.org and the package is downloaded successfully.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #233414

Edited by Moaz Khalifa

Merge request reports