Question
Limits of PackageSourceMapping: Unresolved Source Priority
Cig Moss
0 reputation · 07 Apr 2020, 19:26 UTC
36K views0
Goal
Reduce alert noise by limiting which package sources NuGet queries during restore, using the PackageSourceMapping feature introduced in NuGet 5.8.0.
Current Constraints
- PackageSourceMapping maps specific package IDs to designated feeds, preventing the client from querying unrelated sources.
- When multiple sources are mapped to the same package ID, NuGet does not document a deterministic priority order; the source chosen can vary between restore runs.
- Inconsistent source selection leads to unpredictable alert origins and can affect reproducibility of restores.
Unresolved Behavior
The lack of a defined priority mechanism for overlapping mappings creates uncertainty when configuring alerts that rely on source identity.
Questions
- What deterministic priority does NuGet use when multiple sources are mapped to the same package ID?
- How can we enforce a consistent source selection across restore runs without modifying the underlying client?
- Is there a way to specify the order of mapped sources in the NuGet.Config file to control alert origin?
nuget