Bug Report: Using Semver2 build metadata with NuGet prevents ProGet from being able to interact with package via Website or nuget.exe

[Guest]

We recently started investigating using Semver2 version numbers with ProGet and have encountered issues regarding how it handles packages which have a "+" in the version number.

We have found that once we introduce a "+", we are no longer able to access the package's page on within the feed. Attempts to upload a new version are met with a HTTP 403 error, as are attempts to delete the already pushed package using nuget.exe.

Visual Studio 15.5.3 also seems to have difficulty downloading the package from ProGet.

Below I have reproduced a simple *.nuspec that repros these bugs.

<?xml version="1.0" encoding="utf-8"?>
<package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
    <metadata>
        <!-- Required elements-->
        <id>test</id>
        <version>1.0.0.0+meta</version>
        <description>test</description>
        <authors>tester</authors>

        <!-- Optional elements -->
        <!-- ... -->
    </metadata>
    <!-- Optional 'files' node -->
 </package>

We are running on Windows Server 2012 with SQL 2016

Product: ProGet
Version: 5.0.8

[thoven]

Hello Chris,

1.0.0.0+meta is not a valid SemVer2 version number because it contains a 4-part base version number.

1.0.0+meta would be valid.

1.0.0-0+meta is also valid as long as the number in the prerelease section does not have extra zeroes before it. That is, 1.0.0-01+meta is not a valid SemVer2 version number.

[Guest]

Hey Ben,
I've updated my nuspec:
<?xml version="1.0" encoding="utf-8"?>
<package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
<metadata>
<!-- Required elements-->
<id>test</id>
<version>1.0.0+meta</version>
<description>test</description>
<authors>tester</authors>

        <!-- Optional elements -->
        <!-- ... -->
    </metadata>
    <!-- Optional 'files' node -->
</package>

When I upload a package created from this nuspec, I get this result