dotnet tool installs unlisted and depreciated version

[fabiomadge]

Describe the bug

Installing without a specified version doesn't get me the latest listed version. I would expect to get 4.1.0, which I get when browsing NuGet, or doing dotnet tool search dafny, but I get 4.1.0.50509 instead.

To Reproduce

dotnet tool install --tool-path . dafny

[baronfel]

The NuGet API has that version as the most recent (you can see this in this manifest at the very bottom of the list): https://api.nuget.org/v3-flatcontainer/dafny/index.json, so our behavior is at least consistent with that. I think the presence of that NuGet-style version is throwing things off - I would check with the package authors to see more about when that package was created.

[fabiomadge]

I'm somewhat to blame there. 4.1.0.50509 was released by mistake because of broken release automation. 4.1.0 was released after and is what I want our users to see.

[baronfel]

Ok, gotcha. I think this is another symptom of the fact that we use 'restore' under the hood here. Restore is allowed to retrieve unlisted versions because for a normal project you don't want to break consumers. Tools shouldn't behave in that same way, however, and when we rewrite these experiences to use the NuGet APIs directly instead of indirectly, we can and will enforce this filtering you intended.

I strongly expect this is a duplicate of an issue we've got linked in the .NET 8 Tools epic, I'll try to link it shortly.

[KalleOlaviNiemitalo]

@baronfel, perhaps you mean #32092, where the "DepMan" tool had version 0.0.4 in a private feed and unlisted version 1.0.0 at nuget.org, and .NET SDK chose to install 1.0.0.

[nagilson]

@baronfel Should we close this in favor of #32092 ?

[baronfel]

Yes, good call.