NuGet manual package folder only downloads a package called 1.1.0.0

2
votes

I have my solution setup with Enable Restore Packages, the .nuget folder and all expected contents are present. At the root level of the solution I have a Nuget.config (I couldn't use the config file in the .nuget folder because VS was not loading it) with a custom Artifactory source added and with the default nuget source disabled.

Now if I build from the command line (using msbuild) the packages are restored successfully, and if I build within Visual Studio the packages are also restore successfully. However if I click the restore button from within the Manage NuGet Packages window Nuget only downloads one package and the folder is named 1.1.0.0 which is [obviously] not a valid package and doesn't exist when restoring by either of the automatic methods.

Can someone explain what is going on here?

Edit: As per some of the comments this does not appear to be an issue strictly with NuGet but when combined with Artifactory.

After some more investigation the download of this package is also triggered in two other situations (including using Artifactory 3.0.4:

1). Restore NuGet Packages from within Visual Studio by clicking on the Restore Packages button on the Nuget Package Manager Window

3). Attempt to restore packages without being authenticated on the repo

2
visual-studio-2012nugetartifactorynuget-package-restore

2 Answers

0
votes

Although the NuGet Gallery indeed has some garbage in it, this problem is with Artifactory 3.0.3. The request for https://www.nuget.org/api/v2/Packages(Id='PACKAGE_ID',Version='PACKAGE_VERSION') has changed a bit in NuGet 2.7 and Artifactory 3.0.4 fixes that (see https://www.jfrog.com/jira/browse/RTFACT-5953). Mainly the problem in 3.0.3 was that it ignored the inside content of Pacakges() hence giving you the first result from the Gallery which is the 1 package.

0
votes

I'm also running into this issue. I think it has something to do with the fact that someone created this package:

http://www.nuget.org/packages/1/

WHY they would create it is beyond me, but it's also causing artifactory weirdness. I think it's to do with the fact that the package name is also a valid version number.