3

Closed

package download does not work from galleries with https (only) and auth

description

Hey,

We have a private nuget gallery hosted behind https with auth.

When using nuget.exe or the VS extension this happens to download packages:

D:\temp> nuget install PackageID
Please provide credentials for: https://privatenugetgallery/api/v2 UserName: nhhagen Password: ************ Attempting to resolve dependency 'DotNetZip (= 1.9.1.8)'.
Unable to connect to the remote server

It does not matter if the dependencies are hosted on nuget.org or our internal gallery.

If I enable the http endpoint of privatenugetgallery/api/v2 with no need for user/pass on the web server (not as a feed) it works fine.

It turns out after using fidler that nuget is trying to download the package from this url: http://privatenugetgallery/api/v2/package/PackageId/Version.

Why is nuget not using the feed url that I have configured (https://privatenugetgallery/api/v2). I hope it is possible to expose a nuget feed over https only, as this will ensure encrypted password transfer.
Closed Feb 22 at 9:54 PM by RanjiniM
Fixed. No repro.

comments

aldion wrote Jul 10, 2012 at 12:31 AM

Couldn't find a repro, at least with nuget.exe 2.0.
  • tried with a proxy, and tried with auth through MyGet feed.
  • 1 package + 1 dependency, both hosted on myget also cases with the dependency hosted on nuget.org.
  • tried with source in nuget.org and specified with -source.
it kept https for package download blob (except for the 302, 200 for connection close after downloading the package.)

JeffHandley wrote Jan 23 at 9:27 PM

@nhhagen - Last we tried, we could not reproduce this issue. Can you try with the latest NuGet release (2.2) and let us know if this is still fails?

If we don't hear that it's still causing you problems by 2/1, we'll close this out as not being able to reproduce it.

Thanks!

nhhagen wrote Jan 23 at 10:01 PM

@JeffHandley thanx for looking at this again, I'll see if can activate our NuGet gallery (a rather old snapshot of the NuGet.org site).

Our production private NuGet gallery is now running on MyGet.org enterprise. That runs on http as far as I can see.

As far as I understand NuGet.exe supports https with user and pass?

XavierDecoster wrote Jan 24 at 6:40 AM

@nhhagen just FYI, MyGet also supports HTTPS, just give it a try ;)

dotnetjunky wrote Jan 31 at 10:20 PM

@nhhagen: Can you try with your MyGet feed with HTTPS on the latest NuGet 2.2?

Sign in to add a comment