Packaging Icon, License and Documentation within the nupkg
Anand Gaurav edited this page Sep 14, 2018
·
5 revisions
Pages 155
Home
Contributing
Specs
Incubation
Reviewing
- Centrally-managing-NuGet-package-versions
- Package Applicability
- dotnet list package --vulnerable
- Machine-readable output for dotnet list package
- Support Package Renames
- Advanced Search on NuGet.org
Reviewed
Implemented
- Enhanced package upload workflow
- Register package signing certificates
- Organizations on NuGet.org
- 2 Factor Auth for NuGet.org sign in
- Add nuget sources command to the dotnet CLI
- Author Package Signing
- Backporting PC to msbuild restore
- Deprecate packages
- Dotnet list package
- Enable repeatable package restore using lock file
- NuGet Client Package Debugging
- NuGet Package Debugging & Symbols Improvements
- NuGet Package Identity Verification
- NuGet Package Signing Client Policy
- NuGet Sign Command
- NuGet Verify Command
- Storing trusted repository
- Package Signatures Technical Details
- Package signing
- Packages.config SHA Validation
- Packaging Icon, License and Documentation within the nupkg
- Repository Signatures and Countersignatures Technical Specification
- Repository Signatures
- Show outdated packages
- Symbols Package Upload and Delete Workflow
Templates
Clone this wiki locally
- Status: Reviewed
- Author(s): Karan Nandwani (@karann9)
Issue
The work for this feature and the discussion around the spec is tracked by 3 issues
- Icon - Package Icon should be able to come from inside the package #352
- License - Package trust - Licenses #4628
- Documentation - Nuspec - documentation / readme url #6873
Problem
- Icons - package authors are required to find a place to host an image, only to point to it for the package icon. Additionally, loading images from external URLs have potential security and privacy concerns for package consumers.
- License - it is possible to update the page contents at the referred license URL raising legal concerns for package consumers.
- Documentation - it is not possible for package authors to update the documentation on the package details page without going to NuGet.org. This information is not surfaced in Visual Studio to package consumers.
Who is the customer?
- NuGet package consumers that consume packages using Visual Studio package manager UI (VS-PMUI) from NuGet.org (v3 feed) and folder based feeds
- NuGet package authors that push to NuGet.org
Solution
Packaging Icon within the nupkg