Hosting Nuget package feed on Apache server: questions about some Atom elements

Dec 11, 2010 at 5:42 PM


I want to host my own Nuget package feed, but I can't use Nuget.Server because the feed will be hosted on an Apache server with only PHP available. So, unless you know an existing PHP library that can do it, I have to generate the feed myself in PHP. Not fun, but I can do it...

However, I have some questions about some of the elements used in the Atom feed :

  • What are these elements for ?
        <link rel="edit-media" title="Package" href="Packages(Id='NHibernate.Core',Version='')/$value" />
        <link rel="edit" title="Package" href="Packages(Id='NHibernate.Core',Version='')" />
    Are they mandatory ? Will Nuget work OK if I omit them ?
  • What is the PackageHash property ? I guess it's just a hash for integrity check, but which algorithm is used to compute it ?
  • How are the dependencies specified ? From what I can see, it's just the package ids and their versions, separated by pipes. But how do you specify minVersion/maxVersion ? I can find any example of that in the official Nuget feed.

Any help would be appreciated !


Dec 11, 2010 at 5:57 PM

The first challenge you'll face is that what we have isn't a static atom feed, but an odata feed. Our clients expect that we'll be able to query on that feed using the odata query syntax so a regular atom feed won't cut it.

The package hash is SHA512.

Dependencies are separated by | and are in the format id:versionspec. More information can be found on there version spec here.

Hope that helps

Dec 11, 2010 at 6:21 PM

Thanks for your quick answer, it's very helpful.

Obviously it will be hard to implement the OData query protocol in PHP, but my feed will only contain a few packages (5 to 10), so it doesn't matter if searching doesn't work...

Dec 11, 2010 at 6:32 PM

It's not just searching. The package manager itself using the client side Query Provider in order to locate packages to install so I'm not sure what will work.

Dec 11, 2010 at 6:47 PM

I suggest you run NuGet with fiddler on so you can see the http requests being made.  That'll give you an idea of the expectations on the feed.  Not that it's conceivable that you could implement a subset of OData that's just good enough for the NuGet client.  At the very least, you'll have to support queries to get a specific package id record.

Dec 11, 2010 at 6:49 PM

I wonder if in the future our client could support static feeds as an option.  Basically, it would download the whole thing and query locally.  This would work fine for small feeds.  But it requires client changes.

Dec 11, 2010 at 6:57 PM

We can definitely support this but I'm not sure how you turn it on. We'd need to come up with some kinda uri scheme so we'd know up front what kinda feed we're going against.

Dec 11, 2010 at 7:25 PM

Thanks for your input.

@davidebbo, I followed your suggestion to use Fiddler to check the queries actually being made by Nuget. It queries the following URL when it retrieves the list:$count$orderby=Rating%20desc,Id&$skip=0&$top=30

So I guess I'm stuck... unless I really implement the OData protocol, it doesn't seem feasible. I'll try to see if I can host my feed on a Windows server, but I'm not very optimistic about that...


Dec 11, 2010 at 9:24 PM

Here is a random idea: it should be possible to write a generic static to OData feed proxy.  It would be a server that acts a full NuGet OData server, but its implementation would be to suck static feeds from random other places, and to expose them as full OData.  Of course, someone would need to write and host such thing, but in theory it could be done :)

Jul 11, 2011 at 1:45 PM

I wonder if there is a spec for NuGet OData protocol? Is it backward compatible? 

Dec 5, 2013 at 12:11 PM
If you need it, i created a small Php-based nuget server you can download it on The installation is simple and, for me it works!
If you need help just write me about it!