Can Nuget prerelease packages be overwritten on Artifactory?

1
votes

Nuget packages are immutable. All documentation makes this very clear.

I am investigating an issue on my internal Nuget server where prerelease packages can be overwritten. Normally, when trying to upload a package with an existing version, the upload will fail. The Nuget server in question is an Artifactory server.

I immediately assume this to be a bug, but in searching to find other people encountering the same issue, I instead turn up posts from people implying this is normal.

This person asks how to always get the latest version when repeatedly publishing v1.0.0-prerelease.

This person found an Artifactory bug where prerelease packages can't be overwritten if they have a dot in the name.

Another Artifactory bug where STABLE packages can be overwritten because they are incorrectly identified as prerelease

I have yet to find any actual documentation saying prerelease packages can be overwritten on Nuget or Artifactory. I would not expect to, but those posts take it as a fact!

1
nugetartifactory

1 Answers

0
votes

Upon more research and testing, the conclusion is this appears to be an undocumented feature of Artifactory.

The closest they come to documenting this is here: https://www.jfrog.com/confluence/display/RTF/Managing+Permissions#ManagingPermissions-PreventingOverwritingDeployments

You can prevent a user or group from overwriting a deployed release or unique snapshot by not granting the Delete permission. Non-unique snapshots can always be overwritten (provided the Deploy permission is granted).

That section of the documentation is not specific to any kind of repository. It is never specifically clarified anywhere that Nuget prerelease packages are considered "snapshots", but the terms "prerelease" and "unstable" are not used anywhere in the documentation (for any repository type).

Since this cannot be turned off, my team went with using automatically-generated versioning for prerelease packages to avoid having issues caused by package overwrite.

nuget.org does not allow any overwriting of prerelease packages.