Source Priority Seems to be ignored when dependencies are present

[dcjulian29]

What You Are Seeing?

I have a "meta" package (myvm-development) that includes several other packages as dependencies. When I install this package https://gist.github.com/dcjulian29/a3ac471e51d1fa425dea3c2b62b0cb00, the executor package from the chocolatey source is installed. When I install it explicitly https://gist.github.com/dcjulian29/093d69c2ce3ef05df8afa02b8af336dc, it uses my source. My source has a priority of 1, and the chocolatey source has a priority of 2.

What is Expected?

Given that my source has a lower priority, installing packages that exist on both sources should be installed from my source in both scenario.

How Did You Get This To Happen? (Steps to Reproduce)

choco install myvm-development -y -dv choco install executor -y -dv

Output Log

With Dependencies: https://gist.github.com/dcjulian29/a3ac471e51d1fa425dea3c2b62b0cb00

Without Dependencies: https://gist.github.com/dcjulian29/093d69c2ce3ef05df8afa02b8af336dc

[ferventcoder]

@dcjulian29 that's definitely not how it should work. With your meta package, how is the dependency defined? Does it have a version range?

[dcjulian29]

It doesn't... but my "executor" package has a newer version number...

<?xml version="1.0" encoding="utf-8"?>
<package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
  <metadata>
    <id>myvm-development</id>
    <version>2017.3.1</version>
    <authors>Julian Easterling</authors>
    <owners>Julian Easterling</owners>
    <description>This package gets called for the initial configuration of my development virtual machines.</description>
    <tags>myvm development</tags>
    <dependencies>
      <dependency id="mysettings-ntfs" />
      <dependency id="mysettings-ipv6" />
      <dependency id="dotnet4.6.2" />
      <dependency id="powershell" />
      <dependency id="pscx" />
      <dependency id="myscripts-binaries" />
      <dependency id="sysinternals" />
      <dependency id="mysettings-console" />
      <dependency id="mysettings-explorer" />
      <dependency id="mysettings-notepadplusplus" />
      <dependency id="powershellhere" />
      <dependency id="mysettings-devwallpaper" />
      <dependency id="executor" />
      <dependency id="syncthing" />
      <dependency id="myscripts-development" />
      <dependency id="posh-mymodules" />
    </dependencies>
  </metadata>
</package>

[ferventcoder]

A guesstimation here. Are most of the dependencies on dot org? I wonder if it picks up something from one of the other packages also having a dependency on executor.

Or there is some bug in the resolver where once it has evaluated a secondary source, it uses it for other dependencies as well.

Either way we need to fix it. Thanks for filing that.

[dcjulian29]

It is a mixture... most of the "my" packages are from my source where the others are from the community source.