Package source mapping doesn't work with Maestro added feeds

ViktorHofer commented 1 year ago

[ ] This issue is blocking
[x] This issue is causing unreasonable pain

Came up in https://github.com/dotnet/format/pull/1987

When using NuGet Central Package Management with more than one NuGet feed, package source mapping must be used: https://learn.microsoft.com/en-us/nuget/consume-packages/central-package-management#warning-when-using-multiple-package-sources

Unfortunately, Maestro (?) doesn't support this model as it dynamically adds feeds when producing stabilized package versions (in RTM and servicing mode). Therefore, repositories that started using CPM had to add a NoWarn=NU1507 setting to make CPM work.

I see package source mapping as a useful feature that our infrastructure shouldn't block using. Here's some more history on this: https://github.com/dotnet/arcade/pull/9885#discussion_r915279839

cc @mmitche @ChadNedzlek

riarenas commented 1 year ago

Moving this issue to arcade-services where the Maestro team can take a look.

richlander commented 2 months ago

Maestro could add a package source mapping when it adds a new source.

Using the referenced PR, this would look like:

    <packageSource key="darc-pub-dotnet-runtime-488a8a3">
      <package pattern="System.*" />
      <package pattern="Microsoft.*" />
    </packageSource>

That seems pretty reasonable while enabling the broad team to adopt PSM. The value of PSM is the additional transparency with dotnet-public where we don't use wildcards.

https://github.com/dotnet/format/pull/1987/files#diff-9c5952957709545aad811b400e7e516eebade1e44fc4fbc23203403ffeb92c34L40-L63

dotnet / arcade-services

Package source mapping doesn't work with Maestro added feeds #3002