NuGet sources in Rider. Attempting to configure the Source that is used to work outside Rider.

Problem

There are scenarios when a NuGet.config is a part of the repository. Having a specific configuration written there might restrict declare strict limitations for the restore operation to work.

Consider this NuGet.config which is a part of repository:

<configuration>
  <packageSources>
  <clear/>
    <add key="SomeFeed" value="https://obfuscated.com/artifactory/api/nuget/v3/obfustacted" protocolVersion="3"/>
  </packageSources>
  <packageSourceCredentials>
    <SomeFeed>
      <add key="Username" value="%SOME_ENV_VAR_USER%"/>
      <add key="ClearTextPassword" value="%SOME_ENV_API_TOKEN%"/>
    </SomeFeed>
  </packageSourceCredentials>
  <packageSourceMapping>
    <packageSource key="SomeFeed">
      <package pattern="*"/>
    </packageSource>
  </packageSourceMapping>
</configuration>

Such a configuration ensures the authentication will use environment variables %SOME_ENV_VAR_USER% and %SOME_ENV_API_TOKEN% as a credentials for the SomeFeed. If authentication passes, machine can restore nugets from the SomeFeed source.

However, one might want to configure the same feed to be used without environment variables. In order not to edit the {repository}/NuGet.config file, one will go configure the machine-wide %APPDATA%/Nuget/NuGet.config configuration file. With below sample content:

<configuration>
  <packageSources>
    <add key="AlternativeName" value="https://obfuscated.com/artifactory/api/nuget/v3/obfustacted" protocolVersion="3"/>
  </packageSources>
  <!-- Optionally, one will write credentials here. If no credentials are specified at this step, client (IDE/Terminal) later will prompt for credentials
  <packageSourceCredentials>
    <AlternativeName>
      <add key="Username" value="username@domen.com"/>
      <add key="ClearTextPassword" value="literalPasswordOrToken"/>
    </AlternativeName>
  </packageSourceCredentials>
  -->
</configuration>

User configures IDE to use this feed. Ensures the credentials are specified correctly, but still IDE fails to observe/restore packages using the AlternativeName feed.

Cause

The issue arrises because of this section in the {repository}/NuGet.config (that is still existing and is respected):

<packageSourceMapping>
    <packageSource key="SomeFeed">
      <package pattern="*" />
    </packageSource>
</packageSourceMapping>

It states that ANY NuGet package matching "*" pattern MUST be restored from the source with key=SomeFeed, which in fact restricts packages to be restored from any feed other than SomeFeed=> restore can't be done using the AlternativeName source.

Resolution

To resolve the issue:

1. Modify packageSourceMapping in the NuGet.config file in the project repository:

   Ensure the packageSourceMapping allows packages to be restored from additional sources, or adapt the mapping to align with the source key used in %AppData%\NuGet\NuGet.Config.

   <packageSourceMapping>
     <packageSource key="SomeFeed">
       <package pattern="*" />
     </packageSource>
     <packageSource key="AlternativeName">
       <package pattern="*" />
     </packageSource>
   </packageSourceMapping>
   

   • Alternatively, remove the packageSourceMapping section if it is unnecessary.

2. Environment variables:

   Ensure that SOME_ENV_VAR_USER and SOME_ENV_API_TOKEN variables are properly set within Rider’s execution environment. These variables should contain valid credentials. So that Rider can use the SomeFeed source, no need to declare AlternativeName source.

   • If environment variables are being set by a specific script, ensure the script used to set them executes correctly before starting Rider.