Following Latest build instructions results in NU1507 Message about 2 package sources defined when using CPM

[ElanHasson]

When using central package management, following the latest build instructions results in a message:

error NU1507: Warning As Error: There are 2 package sources defined in your configuration. When using central package management, please map your package sources with package source mapping (https://aka.ms/nuget-package-source-mapping) or specify a single package source. The following sources are defined: nuget.org, dotnet8 .

I understand CPM isn't supported in templates from #1253 and is being tracked as NuGet/Home#12967, however I think a good outcome from this issue would be adding guidance to the instructions on how specifically to map properly (and also continue to use nuget.org) as there are several package sources and a scary message. 🐲

aspire/NuGet.config

Lines 5 to 12 in 51912ed

	<!--Begin: Package sources managed by Dependency Flow automation. Do not edit the sources below.-->
	<!-- Begin: Package sources from dotnet-runtime -->
	<!-- End: Package sources from dotnet-runtime -->
	<!--End: Package sources managed by Dependency Flow automation. Do not edit the sources above.-->
	<add key="dotnet-public" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json" />
	<add key="dotnet-eng" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" />
	<add key="dotnet8" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet8/nuget/v3/index.json" />
	<add key="dotnet-libraries" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-libraries/nuget/v3/index.json" />

This seems to work:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <packageSources>
        <clear />
        <add key="nuget" value="https://api.nuget.org/v3/index.json" />
        <add key="dotnet-public" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-public/nuget/v3/index.json" />
        <add key="dotnet-eng" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-eng/nuget/v3/index.json" />
        <add key="dotnet8" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet8/nuget/v3/index.json" />
        <add key="dotnet-libraries" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-libraries/nuget/v3/index.json" />
        <add key="orleans-nightly" value="https://orleans.pkgs.visualstudio.com/orleans-public/_packaging/orleans-nightly/nuget/v3/index.json" />
    </packageSources>
    <packageSourceMapping>
        <packageSource key="dotnet-public">
            <package pattern="*" />
        </packageSource>
        <packageSource key="dotnet8">
            <package pattern="*" />
        </packageSource>
        <packageSource key="dotnet-libraries">
            <package pattern="Microsoft.DeveloperControlPlane*" />
            <package pattern="System.CommandLine" />
        </packageSource>
        <packageSource key="dotnet-eng">
            <package pattern="*" />
        </packageSource>
        <packageSource key="orleans-nightly">
            <package pattern="Microsoft.Orleans.*" />
        </packageSource>
        <packageSource key="nuget">
            <package pattern="*" />
        </packageSource>
    </packageSourceMapping>
    <disabledPackageSources />
</configuration>

[davidfowl]

cc @joperezr

[joperezr]

Thanks for reporting this issue @ElanHasson. It isn't very clear to me what exactly is expected here from Aspire side, I don't think that in our dogfooding docs we talk about CPM, but I'm assuming that is something you onboarded on separately in your project? From your description, the issue is not unique to Aspire, and instead you'll hit this with any different project which requires an extra nuget feed when using CPM. For that reason, I'm not sure exactly what is the ask here, so it'd be great if you help me understand @ElanHasson.

[ElanHasson]

Hi @joperezr

So, I use devcontainers (yes i know, limited aspire support currently) and was using the dailies via this feature I wrote.

I understand CPM isn't supported in templates from #1253 and is being tracked as NuGet/Home#12967, however I think a good outcome from this issue would be adding guidance to the instructions on how specifically to map properly (and also continue to use nuget.org) as there are several package sources and a scary message. 🐲

The above nuget.config is what I had to do to be able to consume the daily builds in my project.

Am I doing something wrong here or Is there a better way to do accomplish this?

[seantleonard]

I had something similar where when Aspire SDK was installed in Visual Studio 2022, I received this error.

To fix, I either had to uninstall the Aspire SDK or add the following to my Directory.Packages.Props file:

  <DisableImplicitLibraryPacksFolder>true</DisableImplicitLibraryPacksFolder>

there are a number of issues that report something similar. Mine just happened to be caused by Aspire SDK.

• MAUI is not compatible with ManagePackageVersionsCentrally sdk#27840
• Better integrate SDK-delivered packages with NuGet Package Source Mapping sdk#24797
• Mysterious new NuGet source (/usr/local/share/dotnet/library-packs) sdk#28642