Why does pacakge publishing require view permissions on user anonymous?

[Jin]

I found it quite strange that publishing requires view_feed permissions on user anonymous. Removing the permissions would cause server to prompt for credentials which causes buildmaster to fail.

What I am trying to do is to publish to a ProGet feed from BuildMaster where the feed is private. But because of the permissioning issue I have to configure my feed to have view_feed permissions for anonymous. While no one is able to download the actual package, having the packages listed is also not ideal.

Is there any solution for this?

Product: ProGet
Version: 3.6.1

[Alana]

You can specify the username/password in the -ApiKey with user:pass, thus logging in when doing a push.

Alternatively, if you don't want to authenticate at all, just use ProGet's drop folder, and the package will be picked up.

[Tod]

It is also worth noting that strictly speaking, pushing packages does not require the View privilege, that is a result of the NuGet client sending a GET request (i.e. "list") first before sending the PUT request to push the package -- it's the first request that gets 401ed. You can use the following PowerShell script to perform just the package upload:

$FeedUrl = 'http://proget/nuget/Default'
$FileName = 'C:\tmp\ProGet\packages\Package.1.0\Package.1.0.nupkg'
$APIKey = 'Admin:Admin'

#params([string]$FeedUrl, [string]$FileName, [string]$APIKey)

$req = [System.Net.WebRequest]::CreateHttp($FeedUrl)
$req.Method = 'PUT'
$req.ServicePoint.Expect100Continue = $false

If ($APIKey) {
    $req.Headers.Add('X-NuGet-APIKey', $APIKey)
}

$boundary = '---------------------------' + [System.Guid]::NewGuid().ToString('n')

$req.ContentType = "multipart/form-data; boundary=""$boundary"""

$utf8 = New-Object -TypeName System.Text.UTF8Encoding -ArgumentList ($false)

$reqWriter = New-Object -TypeName System.IO.StreamWriter -ArgumentList ($req.GetRequestStream(), $utf8)

$reqWriter.WriteLine("--$boundary")
$reqWriter.WriteLine("Content-Disposition: form-data; name=""package""; filename=""package""")
$reqWriter.WriteLine("Content-Type: application/octet-stream")
$reqWriter.WriteLine()
$reqWriter.Flush()

$fileStream = [System.IO.File]::OpenRead($FileName)
$fileStream.CopyTo($reqWriter.BaseStream)
$fileStream.Close()

$reqWriter.WriteLine()
$reqWriter.Write("--$boundary--")

$reqWriter.Dispose()

$response = $req.GetResponse()
$response.Dispose()