Bug Report: Using Semver2 build metadata with NuGet prevents ProGet from being able to interact with package via Website or nuget.exe

We recently started investigating using Semver2 version numbers with ProGet and have encountered issues regarding how it handles packages which have a "+" in the version number.

We have found that once we introduce a "+", we are no longer able to access the package's page on within the feed. Attempts to upload a new version are met with a HTTP 403 error, as are attempts to delete the already pushed package using nuget.exe.

Visual Studio 15.5.3 also seems to have difficulty downloading the package from ProGet.

Below I have reproduced a simple *.nuspec that repros these bugs.

<?xml version="1.0" encoding="utf-8"?>
<package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
    <metadata>
        <!-- Required elements-->
        <id>test</id>
        <version>1.0.0.0+meta</version>
        <description>test</description>
        <authors>tester</authors>

        <!-- Optional elements -->
        <!-- ... -->
    </metadata>
    <!-- Optional 'files' node -->
 </package>

We are running on Windows Server 2012 with SQL 2016

Product: ProGet
Version: 5.0.8

thoven

Hello Chris,

1.0.0.0+meta is not a valid SemVer2 version number because it contains a 4-part base version number.

1.0.0+meta would be valid.

1.0.0-0+meta is also valid as long as the number in the prerelease section does not have extra zeroes before it. That is, 1.0.0-01+meta is not a valid SemVer2 version number.

Hey Ben,
I've updated my nuspec:
<?xml version="1.0" encoding="utf-8"?>
<package xmlns="http://schemas.microsoft.com/packaging/2010/07/nuspec.xsd">
<metadata>

<id>test</id>
<version>1.0.0+meta</version>
<description>test</description>
<authors>tester</authors>

        <!-- Optional elements -->
        <!-- ... -->
    </metadata>
    <!-- Optional 'files' node -->
</package>

When I upload a package created from this nuspec, I get this result
Image Text