Nexus NuGet protocol issue

[Andrew Ducker]

Hi, I've hit an issue with Nexus and NuGet.

I have multiple repositories:
nuget-dotnet-firstparty
nuget-dotnet-thirdparty
nuget-dotnet-generated
etc
and a group repository called:
nuget-dotnet
which brings all of the above together.

This is all on the server "DepServer".

When I try to do a "nuget restore" when the client has access to nuget-dotnet (the group repository) only I get the following:
WARNING: Error downloading 'MyPackage.1.2.3' from 'https://DepServer:8443/repository/nuget-dotnet-firstparty/MyPackage/1.2.3'.
The HTTP request to 'GET https://DepServer:8443/repository/nuget-dotnet-firstparty/MyPackage/1.2.3' has timed out after 100000ms

Now, the client has no references to "nuget-dotnet-firstparty", and so no security access set up for it.  But it shouldn't need it, because it has access to the group.

I couldn't work out why it was that it was having this issue, so I went looking through the information on the server via the nuget protocol.  What I found was:

https://DepServer:8443/repository/nuget-dotnet/
points to
https://DepServer:8443/repository/nuget-dotnet/Packages
Each entry has a link with a title of V2FeedPackage an an href of "Packages(Id='MyPackage',Version='1.2.3')"
Following one of those URLs shows that a line with  - content type="application/zip" and a src of  "https://DepServer:8443/repository/nuget-dotnet-firstparty/MyPackage/1.2.3"


However, as the client has no access to the "nuget-dotnet-firstparty" repository, only to the group repository, that's when the error occurs.

Is this a bug in the Nexus implementation of the nuget protocol?  Or have I misunderstood something?  I thought the whole point of a group was that I wouldn't need to give access to every repo, just the group one.

(I'm using OSS 3.6.0-02 - I can't see a bugfix for this issue in the release notes, or I'd have upgraded already.)

Thanks for any help you can provide!

Andy

[Peter Lynch]

Thanks for your report. Your understanding on how it should work is correct. I have created an issue to track about this:

https://issues.sonatype.org/browse/NEXUS-16317 

--
You received this message because you are subscribed to the Google Groups "Nexus Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to nexus-users+unsubscribe@glists.sonatype.com.
To post to this group, send email to nexus...@glists.sonatype.com.
To view this discussion on the web visit https://groups.google.com/a/glists.sonatype.com/d/msgid/nexus-users/f2f39b37-7d39-45b1-96c1-a9dd5677672f%40glists.sonatype.com.
For more options, visit https://groups.google.com/a/glists.sonatype.com/d/optout.

[Andrew Ducker]

Thanks Peter.

Any idea what the timeline might be for a fix?  As you might expect this is breaking our build process - if the fix is a few days away then we'll just wait, if it's going to be weeks then we'll set up a workaround.

Andy

To unsubscribe from this group and stop receiving emails from it, send an email to nexus-users...@glists.sonatype.com.

[Peter Lynch]

The fix or patch from our side is more than likely not a few days away. I would go with a work around for now.

To unsubscribe from this group and stop receiving emails from it, send an email to nexus-users+unsubscribe@glists.sonatype.com.

To post to this group, send email to nexus...@glists.sonatype.com.

To view this discussion on the web visit https://groups.google.com/a/glists.sonatype.com/d/msgid/nexus-users/c8556aba-4db7-4946-af15-514b54d30ae3%40glists.sonatype.com.