Scott Hanselman

Hosting your own NuGet Server and Feed for build artifacts with BaGet

January 31, '20 Comments [11] Posted in DotNetCore | NuGet
Sponsored By

BaGet is a great NuGet alternativeNuGet is the package management system underlying the .NET programming platform. Just like Ruby Gems or NPM Packages, you can bring in 3rd party packages or make your own. The public repository is hosted at http://nuget.org BUT the magic is that there's alternatives! There are lots of alternative servers, as well as alterative clients like Paket.

There's a whole ecosystem of NuGet servers. You can get filtered views, authenticated servers, special virus scanned repositories, your own custom servers where your CI/CD (Continuous Integration/Continuous Deployment) system can publish daily (hourly?) NuGet packages for other teams to consume.

Ideally in a team situation you'll have one team produce NuGet Packages and publish them to a private NuGet feed to be consumed by other teams.

Here's just a few cool NuGet servers or views on NuGet.org:

  • FuGet.org
    • FuGet is "pro nuget package browsing!" Creating by the amazing Frank A. Krueger - of whom I am an immense fan - FuGet offers a different view on the NuGet package library. NuGet is a repository of nearly 150,000 open source libraries and the NuGet Gallery does a decent job of letting one browse around. However, https://github.com/praeclarum/FuGetGallery is an alternative web UI with a lot more depth.
  • Artifactory
    • Artifactory is a, ahem, factory for build artifacts of all flavors, NuGet being just one of them. You can even make your own internal cache of NuGet.org. You can remove or block access to packages you don't want your devs to have.
  • NuGet Gallery
    • You can just run your OWN instance of the NuGet.org website! It's open source
  • NuGet.Server
    • NuGet.Server is an MVP (Minimum Viable Product) of a NuGet Server. It's small and super lightweight but it's VERY limited. Consider using BaGet (below) instead.
  • GitHub Packages
    • GitHub has a package repository with a small free tier, and it also scales up to Enterprise size if you want a "SaaS" offering (software as a service)
  • Azure Artifacts
    • Azure Artifacts can also provide a SaaS setup for your NuGet packages. Set it up and forget it. A simple place for your automated build to drop your build artifacts.
  • MyGet
    • MyGet can hold packages of all kinds, including NuGet.They are well known for their license compliance system, so you can make sure your devs and enterprise are only using the projects your org can support.\
  • Sleet
    • Sleet is a NuGet v3 static feed generator. It's a Nuget Server, that's totally STATIC. Just like a static site generator this means that you can make feeds and host them directly on Azure Storage or Amazon S3 with no compute required.
  • LiGet
    • A NuGet server with a Linux-first approach
  • BaGet (pronounced baguette)
    • This is one of my favorites. It's a new fresh NuGet server written entirely in ASP.NET Core 3.1. It's cross platform, open source, and runs in Azure, AWS, Google Cloud, behind IIS, or via Docker. Lovely!  It's also a great example of some thoughtfully architected code, good plugin model, nice separation of concerns, and a good test suite. If you are using NuGet.Server now, move over to BaGet!

Let's focus on BaGet for now! Go give them some love/stars on GitHub!

Setting up a cross platform personal NuGet Server with BaGet

BaGet is a lovely little server. So far it supports:

The most initially powerful feature in my opinion is the Read-through caching.

This lets you index packages from an upstream source. You can use read-through caching to:

  1. Speed up your builds if restores from nuget.org are slow
  2. Enable package restores in offline scenarios

This can be great for folks on low bandwidth or remote scenarios. Put BaGet in front of your developers and effectively make a NuGet "edge CDN" that's private to you.

If you are familiar with Docker, you can get a BaGet NuGet server up in minutes. You can also use Azure or AWS or another cloud to store your artifacts in a scaleable way.

NOTE: You'll notice that the docs for things like "running BaGet on Azure" aren't complete. This is a great opportunity for YOU to help out and get involved in open source! Note that BaGet has a number of open issues on their GitHub *and* they've labeled some as "Good First Issue!"

If you want to try running BaGet without Docker, just

  1. Install .NET Core SDK
  2. Download and extract BaGet's latest release
  3. Start the service with dotnet BaGet.dll
  4. Browse http://localhost:5000/ in your browser

That's it! All the details on Getting Started with BaGet are on their GitHub. Go give them some love and stars.

About Scott

Scott Hanselman is a former professor, former Chief Architect in finance, now speaker, consultant, father, diabetic, and Microsoft employee. He is a failed stand-up comic, a cornrower, and a book author.

facebook twitter subscribe
About   Newsletter
Sponsored By
Hosting By
Dedicated Windows Server Hosting by SherWeb
Tuesday, February 04, 2020 8:24:53 PM UTC
And if you want to search for .NET global tools from NuGet, there’s ToolGet: https://www.toolget.net
Tuesday, February 04, 2020 8:38:35 PM UTC
TeamCity also supports a NuGet feed if you're using it to build packages already, it works well.
Jesse Mandel
Wednesday, February 05, 2020 3:46:13 AM UTC
I've been using ProGet for some time now, and it's pretty good. The symbols server was at some point one of the only few options available : https://inedo.com/proget
Wednesday, February 05, 2020 6:30:48 AM UTC
Hey Scott,
thanks for listing out several Nuget alternatives.
Please add a warning to "Artifactory" at the moment the "Nuget" implementation is badly implemented.
If you are using it as your corporate Nuget-Proxy you can't proxy several feeds like Azure Artifacts as they don't handle the protocolls metadata. See this open and ignored issue: https://www.jfrog.com/jira/browse/RTFACT-17258

Kind regards,
Bjego
Bjego
Wednesday, February 05, 2020 6:50:41 AM UTC
Are there some tasks in Azure DevOps build pipeline that do NuGet package scanning using some central database like OSS Index ?

I know its possible to add specific NuGet packages as "scanners" to the Visual Studio project, but I was looking for that as a separate build task.
Roger
Wednesday, February 05, 2020 7:44:05 AM UTC
We also use ProGet as internal NuGet feed incl. read-through caching and as a symbol server.
Christoph Fink
Wednesday, February 05, 2020 8:56:06 AM UTC
Scott, it is a shame that some limitations are deteriorating the Azure DevOps experience. F.e: for .NET Core assemblies, source indexing is currently not enabled for Portable PDBs as SourceLink doesn't support authenticated source repositories. Are there any plans to support this?
Manuel Abadia
Wednesday, February 05, 2020 12:49:37 PM UTC
There's also this: http://nugetserver.net/. A service wrapper of the NuGet.Server package. I've also used ProGet in the past and really liked it.
Friday, February 07, 2020 12:53:58 PM UTC
A nice fork of this project is LiGet. Also has caching proxy which is a life saver when you have to use corporate proxy
Iskander Yarmukhametov
Sunday, February 09, 2020 8:17:27 PM UTC
I use BaGet on AWS/EC2 - custom build. I do NOT install the dotnetcore SDK but instead compile BaGet --self-contained and deploy that way. The deployable is larger, but I like the flexibility of being able to destroy the EC2 instance if needed and redeploying within minutes. I have also forked BaGet and have implemented a hook into Hashicorp Vault for the ApiKey and Database connection information so that I do not have any secrets on the file system. This works fantastic.
Monday, February 10, 2020 12:05:42 PM UTC
Given nuget.org is a MS run thing why doesn't MS improve it such that all these others aren't necessary?

It's kind of like asking someone to sideload an app on their phone asking them to use some third party run service.
Peter
Comments are closed.

Disclaimer: The opinions expressed herein are my own personal opinions and do not represent my employer's view in any way.