{"id":56166,"date":"2012-05-18T00:00:00","date_gmt":"2012-05-18T07:00:00","guid":{"rendered":"http:\/\/devblogs.microsoft.com\/nuget\/package-restore-and-consent"},"modified":"2012-05-18T00:00:00","modified_gmt":"2012-05-18T07:00:00","slug":"package-restore-and-consent","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/dotnet\/package-restore-and-consent\/","title":{"rendered":"Package Restore and Consent"},"content":{"rendered":"

A little while back, our team had the pleasure of talking about NuGet with some privacy experts. These are folks who are passionate about your privacy and laws that protect your privacy.<\/p>\n

As we were describing NuGet’s package restore feature, the privacy experts became interested in the details surrounding the package restore workflow \u2013 particularly the part where NuGet goes online to the NuGet gallery to fetch missing packages. Here\u2019s the scenario that raised their interest:<\/p>\n

    \n
  1. Developer A creates a project, installs NuGet packages, and enables package restore<\/li>\n
  2. Developer A checks the project into version control. The NuGet packages aren’t included because of the package restore setting<\/li>\n
  3. Developer B checks the project out of source control and builds<\/li>\n
  4. Because package restore is enabled, NuGet goes online to the gallery, downloads and installs the required packages, and continues with the build.<\/li>\n<\/ol>\n

    That last point is where the concern was raised. In this scenario, Developer B has never said to NuGet, “Sure, you can go online on my behalf.” This can be a big deal because the simple act of making a request over the Internet can reveal information about the user (for example, from the user\u2019s IP address, we can approximate her location). In some regions and countries, revealing this kind of information is a big no-no<\/a>.<\/p>\n

    Now, none of us are lawyers and certainly not the type that work in international privacy issues. We just want to build a great product that developers can feel confident using, regardless of where they are. Hence the package restore consent feature.<\/p>\n

    What did we do exactly?<\/h2>\n

    Our goal is that when someone builds a project that uses NuGet package restore, the person overseeing the build provides explicit consent to enable package restore to go online to download NuGet packages.<\/p>\n

    You\u2019ll note that I was specific about who needs to provide the consent. When we were initially brainstorming solutions, we had talked about simply writing the consent flag into the NuGet config file or into build targets. However, these options would enable Developer A to effectively consent on behalf of Developer B, because these files are pulled down from version control, and that would defeat the purpose of requiring explicit consent. Therefore, we\u2019ve provided 2 ways to specify package restore consent. The first approach is to check the box in NuGet\u2019s package manager configuration dialog box as follows:<\/p>\n

    \"Package<\/p>\n

    Checking this box will write the following XML into your NuGet.Config file (in your user profile directory tree)<\/p>\n

    <packageRestore> \n   <add key=\"enabled\" value=\"true\" \/> \n<\/packageRestore><\/pre>\n
    For scenarios where developers are building on their own machines, this will be the way to provide consent for package restore. However, there are cases where it’s not actually a person who’s doing the building and who therefore can’t provide consent this way. (And where Visual Studio isn’t even installed.) The prototypical example is a build server. In that case, NuGet will also look for an environment variable called EnableNuGetPackageRestore. To enable package restore for scenarios where the Visual Studio option is not practical, set this variable to true.<\/p>\n
    What if I haven\u2019t given consent?<\/h2>\n
    If you try to build a project that uses package restore and you haven\u2019t given consent to NuGet to download packages, you will get a build error that looks like the following:<\/p>\n
    \"Build<\/p>\n
    The build error describes the issue and provides instructions for providing consent. As the package restore consent feature rolls out, you will probably see this error, particularly on build servers, so we wanted to give you advance warning in this post.<\/p>\n
    It\u2019s coming<\/h2>\n
    In NuGet 1.8, we\u2019ve added all of the logic for supporting the consent requirement. However, we won\u2019t start actively enforcing the constraint (that is, causing build failures) until NuGet 2.0. This delay gives you time to provide consent for both your developer machines and your build infrastructure, and will help avoid sudden and unexpected build breaks when we release NuGet 2.0.<\/p>\n","protected":false},"excerpt":{"rendered":"
    A little while back, our team had the pleasure of talking about NuGet with some privacy experts. These are folks who are passionate about your privacy and laws that protect your privacy. As we were describing NuGet’s package restore feature, the privacy experts became interested in the details surrounding the package restore workflow \u2013 particularly […]<\/p>\n","protected":false},"author":4266,"featured_media":58792,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[7874,646],"tags":[],"class_list":["post-56166","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-nuget","category-visual-studio"],"acf":[],"blog_post_summary":"
    A little while back, our team had the pleasure of talking about NuGet with some privacy experts. These are folks who are passionate about your privacy and laws that protect your privacy. As we were describing NuGet’s package restore feature, the privacy experts became interested in the details surrounding the package restore workflow \u2013 particularly […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/posts\/56166","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/users\/4266"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/comments?post=56166"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/posts\/56166\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/media\/58792"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/media?parent=56166"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/categories?post=56166"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/dotnet\/wp-json\/wp\/v2\/tags?post=56166"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}