NuGet

OrbitalReg serves NuGet through the V3 protocol. Packages are read via the PackageBaseAddress flat container; there are no V2 read endpoints (V2 is accepted for nuget push only).

Repository types

• Local — dotnet nuget push, then dotnet restore.
• Remote — proxies and caches an upstream such as https://api.nuget.org/. The version list ({id}/index.json) is the union of cached and upstream versions, and a .nuspec is fetched from the upstream on a cache miss, so dotnet restore works for packages that were never cached. Versions inside a release hold are removed from the list and their exact download answers 403.
• Virtual — members are read in priority order for the version list, .nupkg and .nuspec. Put an internal (local) and a public (remote) repo behind one source URL.

Search and autocomplete (/query, /autocomplete) cover locally stored and cached packages of the repo, or of all members of a virtual repo. The upstream search service is not merged in.

nuget.config

<configuration>
  <packageSources>
    <clear />
    <add key="orbital" value="https://orbitalreg.example.com/nuget/acme/all-nuget/v3/index.json" />
  </packageSources>
  <packageSourceCredentials>
    <orbital>
      <add key="Username" value="any" />
      <add key="ClearTextPassword" value="%ORBITALREG_TOKEN%" />
    </orbital>
  </packageSourceCredentials>
</configuration>

Use <clear /> so no other source can answer for your package ids.

Dependency confusion

If a package id has versions in a local member of a virtual repo, only the local members answer for that id. A same-named package on the upstream is never listed and never fetched, even when it has a higher version. Ids that no local member holds fall through to the remote members.