Scott Hanselman

Introducing NuGet Package Management for .NET - Another piece of the Web Stack

October 06, 2010 Comment on this post [69] Posted in ASP.NET | ASP.NET Ajax | ASP.NET MVC | Nupack
Sponsored By

NuGet

Microsoft's been filling out the Web Stack with more and more right-sized LEGO pieces lately, and today ScottGu announced the developer preview of NuGet. It's a piece of the stack that's been notably missing for years and after using it for a while now, I'm not sure how I lived without it.

NuGet is a package management system for .NET. The goal of NuGet is to make the process of incorporating third party libraries into your solutions as simple as possible.

Package Management itself is not a new concept. From Apt and "deity" before it at the system-level on *nix, to Ruby Gems, Maven, Synaptic, portage, dpkg, rpm and others, it's a well understood space. There are package managers for operating systems that install machine-wide libraries, and there are package managers for developers and their projects that manage dependencies and install libraries. NuGet takes inspiration from Ruby Gems and adds some .NET specifics.

NuGet - The Idea

Here's how it works. Notice the "Package Manager Console" window at the bottom of Visual Studio 2010. That's PowerShell. (It'll be in View | Other Windows for this release)

MvcApplication4 - Microsoft Visual Studio (4)

I type List-Package and NuGet goes to a central ATOM feed and retrieves a list of packages like this (not complete, I snipped it for the example)

Id Version Description
-- ------- -----------
Antlr 3.1.1 ANother Tool for Language Rec...
Artem.XmlProviders 2.5 Implementation of XML ASP.NET...
AutoMapper 1.1.0.118 A convention-based object-obj...
Castle.Components.Validator 1.1.0 The Validator component is us...
Castle.Core 1.2.0 Core of the castle project
Castle.DynamicProxy 2.2.0 Castle DynamicProxy is a libr...
Castle.Ioc 2.1.1 Castle Project offers two Inv...
EFCTP4 1.0 This CTP is a an early previe...
elmah 1.1 ELMAH (Error Logging Modules ...

tarantino-db-deployer 1.0.146.0 This is a database migration ...
WebFormsMVP 0.9.7.2 A simple Model-View-Presenter...
xunit 1.6.1 xUnit.net is a developer test...

At this point, as an example, perhaps I want to get the ELMAH (Error Logging Modules and Handlers) open source library setup in my MVC project. I have long said that ELMAH, as a project, deserves way more attention than it gets.

One of the reasons that it doesn't get used - as is the case with many .NET open source libraries - is that it takes too much effort to get it working. Unzip it, put it in a folder somewhere in your project, figure out what needs to be added to web.config, you know.

With NuGet, I type "Install-Package elmah" and it's done. If I wanted to be extra cool with PowerShell aliases I could have just typed "install-packageelmah."

PM> Install-Package elmah
Successfully added 'elmah 1.1' to MvcApplication4

And that's it. Elmah is automatically brought down to my machine, a reference is added to my project and everything it needs is merged non-destructively into my web.config.

MvcApplication4 - Microsoft Visual Studio (5)

I'll run my app and hit /elmah.axd just to prove it.

Error log for  on HANSELMAN-W500 (Page #1) - Windows Internet Explorer

Complex Packages and their Dependencies

Looks good. But what if I want to add a more complex project, maybe NHibernate.Linq. From the Package Manager Console I'll start typing install-package nh and get Intellisense for all the packages that are available.

image

And the console reports:

PM> Install-Package NHibernate.Linq
'NHibernate.Core (>= 2.0)' not referenced. Retrieving dependency...Done 'log4net (= 1.2.1)' not referenced. Retrieving dependency...Done 'Iesi.Collections (= 1.0)' not referenced. Retrieving dependency...Done 'Antlr (>= 3.0)' not referenced. Retrieving dependency...Done Successfully added 'log4net 1.2.1' to MvcApplication4 Successfully added 'Iesi.Collections 1.0' to MvcApplication4 Successfully added 'Antlr 3.1.1' to MvcApplication4 Successfully added 'NHibernate.Core 2.1.2' to MvcApplication4 Successfully added 'NHibernate.Linq 1.0' to MvcApplication4

Notice that NHibernate.Linq knows its dependant on a bunch of other things. All those packages got pulled in and put in the packages folder. Notice the nupkg file there? That's just a ZIP file. Let's look inside.

A nupkg file open in Windows Explorer

Unzipping the nupkg we see lots of stuff. The binary is in there, but also a nuspec file that looks like this. Dig around in there and you'll find some standard packaging namespaces from openformats.org.




NHibernate.Linq
1.0
NHibernate Linq support is based on the existing, proven in production, Linq provider in NHibernate Contrib. The plans to overhaul that and merge that into NHibernate’s proper for the next release are still active, but the project team feels most strongly that production quality Linq support is something that we ought to provide for our users now.

Ayende

en-US
false
2010-10-03T16:32:29
2010-10-03T16:32:29




NuGet walks its way up the dependency chain and gets all the packages it needs, installing each. Packages can add scripts, content, references, and even run postscripts (ahem) written in PowerShell if they need something fancy.

I can even remove all that and its dependancies.

PM> Remove-Package NHibernate.Linq -RemoveDependencies

Let's add a few more interesting packages to my project. First, I'll add David Ebbo's wonderful T4MVC templates.

PM> install-packageT4MVC
Successfully added 'T4MVC 2.6.30' to MvcApplication4

David's project isn't actually DLLs, it's a T4 template and a config file, but no problem, it's added to the project.

T4MVC in my project

Next I'll add the Entity Framework "Magic Unicorn" library that I love so much.

PM> install-packageEFCTP4

You are downloading EFCTP4 from Microsoft, the license agreement
to which is available at ....Check the package for additional dependencies,
which may come with their own license agreement(s).
Your use of the package and dependencies constitutes your acceptance
of their license agreements. If you do not accept the license agreement(s),
then delete the relevant components from your device.
Successfully added 'EFCTP4 1.0' to MvcApplication4

Note that this package includes some licensing stuff, as do many OSS projects, so I'm told as I get it. Finally I'll add SQL Compact Edition 4 as well with a little...

PM> install-packageSQLCE
Successfully added 'SQLCE 4.0.8402.1' to MvcApplication4

I've added NHibernate.Linq and four dependencies, then removed them all. I've added T4MVC, SQL Compact, Entity Framework CTP 4, and ELMAH.

We see we can add basically anything to a solution and it's only modifying the solution, and the packages folder next to it. Nothing is being added to the GAC (Global Assembly Cache) and no one is installing anything or messing with things system-wide. NuGet is about affecting local projects and solutions...and possibly adding functionality to enable me to make changes even faster...

Can you say Scaffolding?

I'll add one more interesting package. It's not a library like EFCTP4, or a database like SQLCE, or a T4 template like T4MVC. It's actually an example of PowerShell scripts that extend the Package Manager Console itself with new commands that interact with my project.

Note: This is just a sample/example, because we want to see and hear what you want, and how you want to use it. Talk is cheap, show me the code! ;)

install-package MvcScaffold

Typing

PM> install-packageMvcScaffold

adds new commands to my console via a PowerShell script. It adds Add-MvcView, so I could so something basic like

PM> Add-MvcView Empty
Added file 'Views\Empty.aspx'

But that's not interesting. Let's assume I have a Code First class like this in my project and I've compiled once (in fact, a sample model is included with the EFCTP4 package):

using System.Data.Entity;

namespace MvcApplication4.Models {
public class Product {
public int ID { get; set; }
public string Name { get; set; }
public double Price { get; set; }
}
public class MyProductContext : DbContext {
public DbSet Products { get; set; }
}
}

Since I've got a nice Product, why not:

PM> Scaffold-MvcViews -ModelType Product  Added file 'Views\Product\List.aspx'
Added file 'Views\Product\Details.aspx'
Added file 'Views\Product\Edit.aspx'
Added file 'Views\Product\Create.aspx'
Added file 'Views\Product\Delete.aspx'

Which gives me a nice scaffolded set of views generated from T4 Code Templates (or your custom ones, if you like)

image

Pretty sweet. A lot has been done and prepped for me and all from the Package Manager Console within VS. I can personally see folks creating templates or meta-packages that encapsulate some CRUD (Create, Read, Update, Delete) best practices and sharing them via NuGet packages.

Can Haz UI?

I've focused on the Command Line, because it's awesome and "computers need to be hard©" but you could have certainly added your packages like this:

Add Package Reference in the Solution Explorer

Clicking Add Package Reference brings up this dialog box. Look familiar?

Add Package Reference Dialog

From here I can search for packages, install, as well as see what packages I've already got installed. I can also check for updates and download new versions.

NuGet Developer Preview

Now this is just a Developer Preview, but look at it generically. We can interact with Visual Studio from PowerShell, package up Open Source libraries, scripts, content or perhaps even meta-packages (install-package hanselpack or install-package dearReaderLibs).

Phil talks about the Guiding Principles for NuGet on his blog. There will be a central feed with no central approval process for adding libraries. The community will police and moderate packages. But, anyone can host a feed. You can host an internal feed at your work, or even just point NuGet at a file system folder and share packages across your group.

Open Source

NuGet is interesting for a couple of reasons. NuGet isn't a classic Microsoft closed-source project; it's been accepted into the CodePlex Outercurve Foundation and is entirely hosted and managed in a Mercurial Repository at the CodePlex.com Forge. Developers from inside Microsoft and developers from outside Microsoft have been committing to the same repository. All the bugs and issues are managed transparently on that projects.

Yeah, we're slow, but we're working to turn this ship around. NuGet can, and has, accepted contributions, most recently from some folks on the "Nu" open source project. In fact, working with the Nu folks caused us to change the name of this project from its original name of "NPack" to NuGet. There's been a lot of "Source Opened" at Microsoft and a lot of "Open Source but No Takebacks" with some Open Source, but with NuGet I'm stoked to see us start giving (and taking back) in a more open way.

As Phil says, go over to the NuGet website on CodePlex and check out our guide to contributing to NuGet. It's early, and there's a LOT of work to be done, but we're planning to make this available for use in all editions of Visual Studio 2010.

Get the NuGet Preview today with ASP.NET MVC 3 Beta

Go get ASP.NET MVC 3 Beta and NuGet is included inside. Here's the direct download link.

To summarize:

  • NuGet is open source and in the Outercurve Foundation
  • NuGet integrates with VS and with PowerShell
  • NuGet will have a community managed gallery without central approving authority
  • NuGet won't mess up your computer or install anything outside your solution
  • You can host your own feeds, or read packages out of a network share/folder

The whole team - inside and outside Microsoft - really hopes you like it.

Personal Aside: Changing Jobs

An a related aside, one of the reasons I came to Microsoft was to work on and encourage open source like NuGet. For the last few years I've been working in MSDN and STO (Server and Tools Online) most recently leading a community team with a great bunch of folks, including Joe Stagner, Jon Galloway, Rey Bango, Jesse Liberty, and Pete Brown. This week I'm leaving MSDN to go to work as Community Architect for the Web Platform and Tools (WPT) team under ScottGu, Bill Staples and Omar Khan. Pete will take over as the lead of my team and they'll all join Developer Guidance (née Patterns and Practices). We'll hang out a lot together, though, I have no doubt, and I'll be at the Patterns and Practices Symposium as well as PDC 2010 this year.

The WPT team includes ASP.NET, IIS, as well as open source projects like NuGet, ASP.NET MVC and Orchard. I'll be promoting Open Source inside and outside Microsoft, making sure the customers voice is heard as products are architected, as well as speaking and teaching whenever they'll let me. I won't be moving to Seattle. ;)

About Scott

Scott Hanselman is a former professor, former Chief Architect in finance, now speaker, consultant, father, diabetic, and Microsoft employee. He is a failed stand-up comic, a cornrower, and a book author.

facebook twitter subscribe
About   Newsletter
Hosting By
Hosted in an Azure App Service
October 06, 2010 19:08
Very cool. GEM for .NET. I hope this takes off!
October 06, 2010 19:15
Scott, congrats on the move to WPT! You're the perfect guy for the job :)
October 06, 2010 19:15
Just clicked your link to http://www.asp.net/mvc/mvc3 and I get taken to a site that says "Placeholder". I found the MVC3 beta download here instead: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=0abac7a3-b302-4644-bd43-febf300b2c51
October 06, 2010 19:19
Gems allows people to add repositories to a config file so you can host your own gems... That feature would be great for those of us that share a lot of internal libraries,. hopefully it will be in there?
October 06, 2010 19:22
This looks awesome, but as a "nu" user I'm a bit confused.
Does this work with nu gems? Is it supposed to supersede it?
Also, does it work without VS? Meaning, can I manage the packages in a command line?
October 06, 2010 19:22
NuPack is something I have bean yearning for a while now. I question though. How can you set up a local repository?

Where I work, we use IVY dependency management for our backend (Java/Linux) system. This seems like it could be the piece we have been looking for on the Windows/.net side.
Joe
October 06, 2010 19:24
I am unable to install it from your direct link. I am getting the following error:

Blocking Issues:

This product requires Microsoft ASP.NET Web Pages 1.0. Please install the missing component, then try to install this product again.


October 06, 2010 19:30
Thanks for showing me the ropes at Microsoft, Scott. Looking forward to seeing you at PDC. :)
October 06, 2010 19:37
You might also want to check out the OpenWrap project as an alternative to NuPack: http://serialseb.blogspot.com/2010/07/intro-to-what-openwrap-is.html
October 06, 2010 19:40
Henok, currently you need Web Pages (Razor) 1.0 to install MVC 3 because MVC needs Razor, and NuPack is along for the ride, In the future this will be cleaner. Use Web Platform installer if you want a one-click install experience. It's a preview for now, so there's some install dancing.
October 06, 2010 19:42
If you want *just* NuPack with nothing else, you can get the VSiX here: http://nupack.codeplex.com/releases/view/52016
October 06, 2010 19:45
This is absolutely awesome! I have been on the MS stack since the VB5 days and I am extremely happy to see the incorporation of good open source projects to help make our lives better!

Keep up the good work Scott and I'm looking forward to good things from you and your new team!
October 06, 2010 19:48
does the name come from a the nubular .net based on gems & rake? http://nu.wikispot.org/

that was aimed at the same niche.


+1 this has been a sorely missing piece in .net for a good while.

I take it that this should also work for project types? (other than web)
October 06, 2010 19:50
This looks fantastic for both internal and external usage. Can you point us to some guidance on how to set up an internal feed? I've got a dozen or so internal libraries that I would love to configure using NuPack.
October 06, 2010 19:50
This initiative borrows VERY heavily from Seb Lambla's OpenWave that's been around for at least 6 months....
October 06, 2010 19:52
Great stuff Scott, all the best on your nu move.
October 06, 2010 19:55
One thing I noticed that concerns me is that installing a package puts both the package files and a .nupkg file in my /packages folder. This means I am essentially checking in the packages twice into source control which is going to be slower and bulkier than necessary.

Is there any harm in excluding .nupkg files from source control checkins? When are these package files used after an install?
October 06, 2010 20:14
This is very awesome. You didn't exactly point it out but it looks like this will work with adding javascript libraries such as jquery jquery ui and some of the plugins as that is often a pain when spinning up small projects.
October 06, 2010 20:27
Scott, where does this leave coapp (www.coapp.org) ?
October 06, 2010 20:40
Are you sure that "Community Architect" is a real job title? Or it's just to impress the chicks?
October 06, 2010 20:52
Oh, it's CPAN!

Finally.
October 06, 2010 21:38
Scott,

Let's say I already have log4net in my solution and the package also needs it. Is it possible to tell the package to use existing reference as I do not want to have two copies of the same library or do I need to do it manually after referencing the package?
October 06, 2010 21:54
Hmm, this does sound very much like http://nu.wikispot.org/, but withouth the ruby hassle - I like that a lot!
October 06, 2010 21:56
Scott,

Thanks!
October 06, 2010 22:05
Michael Herndon - Yes, the Nu team is involved and we merged all the names.

Ian - It borrows more from gems. Package Management like apt-get and deity before it in 1997 is a pretty well understood space. It's not rocket science. OpenWrap takes a different approach, hooking into MSBuild and creating references, much like Maven. There's also been Nu, Horn and other package management systems before, so there will always be familiar themes.

digiduck - The nupkg file has some metadata information in it that's not expanded, and they are used at uninstall time. File an issue, though at CodePlex, because you bring up an interesting post about file size.

Christof - Great question. We're working with Garrett. The basic idea is this. CoApp is system level package management ala apt-get. It's done at install time and affects the system, so if FireFox needs an SSL library at install time, it uses CoApp to get it. NuPack is developer-time and local to projects, like gems. So if I developer wants a library in their current project, they get it with NuPack. Make sense?

Bret - Yes, you're right! I missed that. This will be a nice way to update javascript libraries of all flavors.

Eduardo - It's entirely designed to impress the chicks. And maybe a few dudes.

Giorgi - Good question. I'll look into that. It's a valid use case we should track in Issues.

October 06, 2010 22:24
Let me start by saying that this is good news for the .NET developers out there.

As a former one of those (rails nowadays, but still have Scott here in my reader list) I think it would a tiny but important point to perhaps give a bit more of 'hat-tip' to those that have traveled this path before. Package management comes from the various lively non-Microsoft, open source communities. Nothing in this is Nu is very new, and it would be at least polite to acknowledge that, i.e. Microsoft has not (wisely) invented this stuff so why not give credit where it's due at least in terms of history? Where's the harm in mentioning that in this blog post or in the project page (i.e. more)?

One of the reasons I think why non-Microsoft developers are so mean to Microsoft guys is that they give the impression of basically stealing and running with things that work, i.e. like a very slow burglar. While I know that not to be true, it does seem as if there are two worlds of which Microsoft is some shadowing mirror development shop which tends to follow on with in-house (always with the in-MShouse, sigh) clones about 3+ years after something is established.

Anyway, minor point but something to consider - standing on the shoulders of giants is fine, but don't forget to look down occasionally and say 'thanks'.

Also, as I'm thrashing around widely like a madman already, if Microsoft keeps sucking in and providing these projects centrally then don't be surprised when you find your community dependent on you and a little barren. Something it's good not to have a father-child relationship with your customer, but be a sibling instead (I say this as Scott, you'll be able to help with this as part of a new job perhaps). Encourage, grow and sponsor, but resist the urge to 'bundle it in-house'. The ones that say that MS developers 'prefer it all from one central place' are fools and should be ignored. :)
October 06, 2010 22:55
David - Extremely valid point David, thanks for your comment. I'll update the first part of my post with even more clarity to your point. And it's something important to us all to remember.
October 06, 2010 22:57
This is definitely very cool. It reminds me a great deal about the 'elpa', emacs lisp package archive, which works as a repository and installer of emacs lisp packages, as the name implies. I wish you great luck in your new professional endeavours!

Cheers,

Ruben
Latest at my blog: And e/2 Appears from Nowhere! (follow up to 'And e Appears from Nowhere')
October 06, 2010 23:09
Pretty cool. Why powershell? I would love for it to be GUI with powershell behind the scenes and have the ability to use either.
October 06, 2010 23:38
Thank you Scott - and just in-case you don't know, or aren't told enough, what you and Phil and others do is really helping Microsoft and the communities. Keep fighting the good fight and keep nudging that big ol tanker in the right direction...
October 07, 2010 0:20
Out of interest, which is the "central repository" and how do people get their code onto it? The nice thing about RubyGems.org is that I can just easily create a new gem and push it, without other people have to import my repository (like on apt-get, where people need to edit sources.list as the official repos are rather closed to developers).

Might be an idea to work with the CodePlex.com guys to get an official NuPack CodePlex Repository that is built into NuPack by default and allows people with CodePlex Accounts to add new "gems".
October 07, 2010 0:25
I would like to know more from the "package builder" view. How do I build, test and deploy a package?
October 07, 2010 0:43
Michael Stum - As this is alpha-time, for now the central repository is just a box somewhere hosted. It'll probably end up at nupack.com or something and will be in a gallery application, like rubygems.org. You'll be able to push your packages up there. And, as I said, folks can have their own repros also. We're talking to the CodePlex.com guys and make it easy to publish packages.

Morgan - You can Create your own package here.
October 07, 2010 2:24
YES!!!
October 07, 2010 2:37
Am I the only one that initially read this as "GuPack" and thought, "Oh no, Scott Gu's head is getting bigger!" LOL!

Just kidding. This is just simply awesome. I love that PowerShell is working its way into more an more areas. Give me the GUI for when I want to make things nice and easy to start off but PS when I want to get into the nitty gritty.

However, you all are making me work harder! 10 years ago Microsoft launched something new that was relevant to my work only like every few years. I had plenty of time to learn the dos and don'ts. Now it seems like every week there's some new freakin' cool technology that I have to use. Both a blessing and a curse. I have that trepidation that if I don't learn the new tools I'm not being as efficient as I could be. Definitely a bad feeling for a developer. Anyway, keep up the great work and I'll just have to dust off my GTD book.
October 07, 2010 3:50
It's good to see Microsoft finally getting in on the package management scene; there's been a lot of activity in the Alt.Net space over the past 6 months or so, but getting "sanction" from Microsoft will be a great help.

Will it be possible for orgs to create their own internal NuPack repositories? I can imagine that this would be ideal for dev teams with complex interdependencies, and would be fantastic as a means of release management.
October 07, 2010 3:53
David - Absolutely, I thought I said that in the post and in the comments, but YES.

You can:

1. Just put them all in a shared folder structure and it'll be treated as a "feed"
2. Produce a feed and run a feed server/gallery (not created yet) on your intranet
3. Run an instance of the (not created yet) feed server/gallery.
October 07, 2010 4:45
I downloaded the .vsix but it only shows up in Visual Web Developer Express and not Visual C# Express or Express for Windows Phone.

Is this a restriction with the CTP version? If yes, will it be lifted in the beta?
October 07, 2010 5:20
Eddie - Sounds like an oversight. Can you log a bug at CodePlex?
October 07, 2010 7:47
We've barely had time to enjoy all the productivity gains from the faster add reference dialog and now we can use powershell to add dependencies... if only file->new project opportunities weren't so rare.
October 07, 2010 8:16
Issue logged. Sorry. I should have thought of that first myself.
October 07, 2010 8:29
Looks good option to me.. Will be easier to distribute code to the developers around the globe. Before compiling one wouldn't have to go and add all the library references.. will give it a try.
October 07, 2010 10:21
.NET was missing this ! awesome
Amr
October 07, 2010 10:56
This looks great! It will get a lot more people use open source projects in their code, because now there is an easy way to do this.

Also, congrats on your new job. It looks cool to me to work with the Gu.
October 07, 2010 13:37
I wonder whether I could include package references into Visual Studio templates (project and/or item template) in order to ensure updated references without having our internal developers having to worry about anything. Boy this would rock :)
October 07, 2010 16:22
Very cool, can't wait to work with that.
Hat tip for making it open source!

Now when will you have something like the rails migrations in .NET ? =)
Kay
October 07, 2010 16:47
Behind all the excitement with NuPack, your personal announcement appear to have lost ...

Congrats for the new job. I wish you all the best, and hope this move will make the involvement of your division with the OSS community even deeper and better.
October 07, 2010 16:58
Congratulations for your new position, are you going to be involved in the IronRuby / IronPython project also?
October 07, 2010 18:25
@Kay: Try Wizardby.
October 07, 2010 19:12
Awesone ! However, I see there ANTLR. How we can put StringTemplate also ? And how can I provide my .tt files ?(for example, like David Ebbo does, I have a .tt files that works with StringTemplate to generate export to Word/Excel/PDF from edmx files)
October 07, 2010 19:23
I kind of wish Apache Maven (for Java) and her "daughter" Apache Ivy had a command line dependency installer like NuPack does. Instead, they force me to dink around with XML files.

Then again, Apache loves their XML...

I do have to agree with brianary, though, the concept for NuPack sounds a lot like Perl's CPAN. The difference being that CPAN is normally machine-wide rather than just per-program/project/solution.

CPAN also occasionally suffered from dependency (or DLL) Hell, where certain packages would have dependencies on different versions of the same package, or a package version would be pulled, orphaning a package that depended on said version or newer.

Hopefully NuPack avoids this dependency Hell.

P.S. I heard from ScottGU's blog that a new beta of ASP.NET 3 and WebMatrix are out, including an updated version of Razor templates No love for them on your blog?
October 07, 2010 21:57
the link to the installer takes you to web Platform Installer 2.0
October 07, 2010 22:19
I noticed the default package list 'Demo Feed' (http://go.microsoft.com/fwlink/?LinkID=199193) doesn't contain some of the packages in your post here (elmah in particular). Is that an accident?
October 07, 2010 23:07
I just installed NuPack and noticed that EFCTP4 is not in the package list. There are two that might be related; SQLCE and SQLCE.EntityFramework. Are these the same thing or did EFCTP4 get removed from the list of packages?
October 07, 2010 23:14
This all sounds nice, but I don't see any mention of cryptography (and I'm too lazy to RTF NuPack source code). What sort of cryptography is used to secure & authenticate this whole set up? You've mentioned Linux package management systems, and they've used stuff like PGP for years to allow cheap distribution of trustworthy packages over hostile networks. Does NuPack use (require?) Authenticode? Something else? Nothing?

All I've seen so far are unverifiable feed URLs (e.g. http://173.203.67.148/feed -- no https means no server identity verification) with simple SHA checksums that are only good for ensuring that you downloaded the entire compromised packaged that an MITM attacker has prepared for you. ;-)
October 07, 2010 23:18
Hi Scott,

When I run the extension, the following error is shown:

"System.TypeLoadException: Could not load type 'System.Management.Automation.Runspaces.InitialSessionState' from assembly 'System.Management.Automation, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35'.
at NuPackConsole.Host.PowerShell.Implementation.PowerShellHostProvider.CreateHost(IConsole console)
at NuPackConsole.Implementation.PowerConsole.HostInfo.get_WpfConsole()
at NuPackConsole.Implementation.PowerConsoleToolWindow.get_WpfConsole()System.InvalidOperationException: Can't start ConsoleDispatcher. Host is null.
at NuPackConsole.Implementation.Console.ConsoleDispatcher.Start()
at NuPackConsole.Implementation.PowerConsoleToolWindow.MoveFocus(FrameworkElement consolePane)"

I double checked and I have that assembly (same version and public token) in the GAC. Any idea of what that could be?

Thanks
October 07, 2010 23:55
@Allan I'm not sure if it's a mandatory requirement or not, but do you have PowerShell installed?
October 08, 2010 0:08
@k4gdw: there were some feed issues, but EFCTP4 is in there now. You may need to restart VS.
October 08, 2010 1:05
Re-reading my post from earlier, I realize I had a derp moment when mentioniong ASP.NET MVC 3... still, no mention of the new WebMatrix beta?
October 08, 2010 1:16
I'll get around to it, but I didn't want to overduplicate all the other WebMatrix posts.
October 08, 2010 6:49
Wow, did we ever need this. All the .net pieces are coming together....
October 09, 2010 0:36
Hi Scott, please I'm having the same issue as Allen above. Any help?
October 10, 2010 8:45
+1 @ JarrettV, + 1@ David
October 11, 2010 8:51
Gems allows people to add repositories to a config file so you can host your own gems... That feature would be great for those of us that share a lot of internal libraries,. hopefully it will be in there?

www.padana.com
October 13, 2010 16:51
Wow, that's going to be a real time saver.
October 26, 2010 15:56
I simply love NuPack, it is so easy, even I can use it :-)
Thanks
BK
December 14, 2010 11:38
Hey Scott, thanks for the post.
I didn't get one thing from it - is nap command an equivalent for Add-Package, it's just an alias or what?
December 29, 2010 10:11
Hi Scott!

I think NuGet is awsome, but I've hit a roadblock with it, and is that, since it's bounded to Visual Studio, if I'm behind a proxy (which I am) I cannot download the packages. Is there a tool to work this around or we'll just have to managa some kinky way? Btw, love ur blog...

Best regards,
David
January 05, 2011 16:58
This is a very helpful post, i hope this really helps me to complete my project.

Comments are closed.

Disclaimer: The opinions expressed herein are my own personal opinions and do not represent my employer's view in any way.