Install-Package with Azure DevOps Artifacts feed with NuGet upstream source is failing

Question

Problem

I'm attempting to install a package from a public repository. I want to use the PackageSource External. This is a Azure DevOps Artifacts Feed that is configured with NuGet Gallery as an Upstream source. Since NuGet Gallery is an upstream source, my request for a package should pass through Artifacts and be fulfilled by the Upstream source, but instead it errors and says that there's no match.

On the other hand, if I submit the same request using a PackageSource that is pointing directly to NuGet Gallery, it works. Could the Upstream source functionality in Artifacts be broken?

---

Package sources

[D:\MySandboxes\TFS\Development\DevOps\]
>Get-PackageSource

Name                             ProviderName     IsTrusted  Location
----                             ------------     ---------  --------
Microsoft Visual Studio Offli... NuGet            False      C:\Program Files (x86)\Microsoft SDKs\NuGetPackages\
Internal                         NuGet            False      http://azuredevops/Development/_packaging/Internal/nuget/v3/index.json
External                         NuGet            False      http://azuredevops/Development/_packaging/External/nuget/v3/index.json
MyNuGet                          NuGet            False      https://www.nuget.org/api/v2
PSGallery                        PowerShellGet    False      https://www.powershellgallery.com/api/v2

Installing package with Azure DevOps Artifacts package source (fails)

[D:\MySandboxes\TFS\Development\DevOps\]
>Install-Package Resta.UriTemplates -Source External -Destination "."
Install-Package : No match was found for the specified search criteria and package name 'Resta.UriTemplates'. Try Get-PackageSource to see all available registered package sources.
At line:1 char:1
+ Install-Package Resta.UriTemplates -Source External -Destination "."
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Microsoft.Power....InstallPackage:InstallPackage) [Install-Package], Exception
    + FullyQualifiedErrorId : NoMatchFoundForCriteria,Microsoft.PowerShell.PackageManagement.Cmdlets.InstallPackage

Installing package with NuGet Gallery package source (succeeds)

[D:\MySandboxes\TFS\Development\DevOps\]
>Install-Package Resta.UriTemplates -Source MyNuGet -Destination "."
The package(s) come(s) from a package source that is not marked as trusted.
Are you sure you want to install software from 'MyNuGet'?
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "No"): a

Name                           Version          Source           Summary
----                           -------          ------           -------
Resta.UriTemplates             1.3.0            MyNuGet          .NET implementation of the URI template spec (RFC6570). Supports up to level 4 template expressions.

Answer 1

So after doing some additional testing, I did discover that using the nuget.exe CLI worked where the Install-Command cmdlet was failing me.

I'm unfortunately still not entirely sure why this behavior is happening.

Below is my version of Install-Package

>Get-Command -name 'Install-Package'

CommandType     Name                                               Version    Source
-----------     ----                                               -------    ------
Cmdlet          Install-Package                                    1.4.3      PackageManagement

And also my version of nuget.exe

>nuget
NuGet Version: 5.2.0.6090

Finally, here's output from the nuget.exe command succeeding.

[C:\Users\srz\]
>nuget install Microsoft.Extensions.Primitives -Version 3.0.1 -Source "External"
Feeds used:
  C:\Users\srz\.nuget\packages\
  http://azuredevops/Development/_packaging/External/nuget/v3/index.json



Attempting to gather dependency information for package 'Microsoft.Extensions.Primitives.3.0.1' with respect to project 'C:\Users\srz', targeting 'Any,Version=v0.0'
Gathering dependency information took 651.6 ms
Attempting to resolve dependencies for package 'Microsoft.Extensions.Primitives.3.0.1' with DependencyBehavior 'Lowest'
Resolving dependency information took 0 ms
Resolving actions to install package 'Microsoft.Extensions.Primitives.3.0.1'
Resolved actions to install package 'Microsoft.Extensions.Primitives.3.0.1'
Retrieving package 'Microsoft.Extensions.Primitives 3.0.1' from 'External'.
  GET http://azuredevops/Development/_packaging/abc123/nuget/v3/flat2/microsoft.extensions.primitives/3.0.1/microsoft.extensions.primitives.3.0.1.nupkg
  OK http://azuredevops/Development/_packaging/abc123/nuget/v3/flat2/microsoft.extensions.primitives/3.0.1/microsoft.extensions.primitives.3.0.1.nupkg 229ms
Installing Microsoft.Extensions.Primitives 3.0.1.
Adding package 'Microsoft.Extensions.Primitives.3.0.1' to folder 'C:\Users\srz'
Added package 'Microsoft.Extensions.Primitives.3.0.1' to folder 'C:\Users\srz'
Successfully installed 'Microsoft.Extensions.Primitives 3.0.1' to C:\Users\srz
Executing nuget actions took 635.5 ms

Answer 2

The Upstream source feature works well in my side. However, I didn't get this promote info during install package.

The package(s) come(s) from a package source that is not marked as trusted.
Are you sure you want to install software from 'MyNuGet'?
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "No"): a

This seems related to your local security setting. Have no idea how to enable or disable. However, according to your description and situation. In my opinion, I was wondering if there is a jump during your installing package with Azure DevOps Artifacts package source.

Since unlike directly connect NuGet Gallery, you need first access Azure DevOps Artifacts Feed first, then through upstream source to fetch that package. You could not select the trust info, it choose default (default is "No"). Finally, you could not install that package.

You could turn off your local security setting and try it again, which may do trick. If due to policy, you could not turn it off.

As a workaround, you could create a need feed with upstream off and upload your package in feed as package source.