Azure DevOps Artifacts Feed fills with NuGet Gallery packages

0
votes

Currently I try to establish on my Azure DevOps Server (self-hosted) a nuget/dotnet pack build- and release pipeline.

  • build pipeline build the sources, pack them to nupkg and upload it to the drop artifacts.
  • release pipeline grep that nupkg from the drop folder and perform a nuget push, when the package get updated.

So I create a artifacts feed, test the pipelines, run agents connected to the feed and build solutions, everything was fine. Some hours later, I check my feed and recognize that the feed contains standard packages from the NuGet Gallery.

enter image description here

First I thought, I pushed accidently with my pipelines, so I removed the feed and a bit later (after background cleanup) I create a new one with the same name. Few minutes later, the packages from NuGet Gallery were inside again without running my pipelines.

How is that possible, do I misunderstanding something?

Config for my self-hosted agents \AppData\Roaming\NuGet\NuGet.Config:

<configuration>
  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
    <add key="MyFeed1" value="https://mylocalurl.de/ColA/_packaging/ProjA/nuget/v3/index.json" />
  </packageSources>
</configuration>```
1
azure-devops

1 Answers

1
votes

Azure DevOps Artifacts Feed fills with NuGet Gallery packages

This is an expected behavior.

That because your private Nuget Feed set nuget.org as an Upstream source by default if you set Package from public sources enable when you create the this feed:

enter image description here

Then go to Setting->Upstream source, you will find there are three public sources listed:

enter image description here

enter image description here

You could use the source filter to select the source of the package.

When we download any packages from the Upstream sources, Azure Artifacts feed will cache these packages automatically when we download any packages from the Upstream sources, so that we could see it next time and no need to download it from the Upstream sources again.

If you do not want use cache those packages, you could select the next option Only use packages published to this feed when you create the feed.