Fsharp: FSI package restore from private feed with password

[zyzhu]

Is your feature request related to a problem? Please describe.
Restore nuget package from private feed like the following
#r nuget:RestoreSources=<source>,UserName=<user>,Password=<pass>"

Describe the solution you'd like
In dotnet try Jupyter sample notebook, you can set the source like the following
#r "nuget:RestoreSources=https://dotnet.myget.org/F/dotnet-corefxlab/api/v3/index.json"
But for private feed, I don't see a way to set username and password there. I know it might not be a good practice to put password in notebook. But the option shall be available.

Describe alternatives you've considered
I also added the source and password to global nuget.config on the desktop using nuget command line. But I cannot get it working in notebook. It needs documentation.

Additional context

[abelbraaksma]

I don't see a way to set username and password there.

Have you tried just using the http protocol way of adding a password? It works in any browser (as it should, it's in the rfc), wouldn't be surprised if it worked here too:

http://usernamehere:[email protected]/x/y/z

[zyzhu]

@abelbraaksma Thanks for the suggestion. But it did not seem to work.

I use Azure Artifacts as private nuget feed. In order to consume these packages in IfSharp notebook, I use Azure DevOps to generate a token and put them in the paket.dependencies like myget documentation.
https://docs.myget.org/docs/how-to/using-paket-with-myget-feeds
source https://www.myget.org/F/paket-demo/api/v2 username: "username_here" password: "password_here"

User name is a dummy and password is the token generated by Azure DevOps

[cartermp]

This should be a consideration for the .NET kernel all-up. @jonsequitur should this issue move over to try?

[jonsequitur]

Related: https://github.com/dotnet/try/issues/622

[zyzhu]

@cartermp The use case should not be on Kernel only. Once FSI in Visual Studio supports direct NuGet restore, it shall support private feed as well.

[abelbraaksma]

User name is a dummy and password is the token generated by Azure DevOps

Got it, sounds like not the typical http style challenge / response verification then.

[zpodlovics]

Would it be possible to have a pluggable (eg.: with new plugin registration support) mechanism for private feeds? One private feed require username/password, other require ntlm, other require kerberos, other require certificate, other use some custom mechanism.

[cartermp]

@zyzhu that makes sense. We have some long-term plans to find a way to consolidate the individual FSI and CSI processes so that some central concerns can be handled in a single place, rather than having two implementations like we do today. This may make more sense in that sort of world, but I'm not sure yet.

[zyzhu]

Consider tagging this one with Area-FSI so that the issue won't get lost. Thanks.

[cartermp]

@jonsequitur did we talk about this one at some point?

[zyzhu]

Today, I've tried to follow steps in the following link to add private feed with password using nuget command. My private repo is added to global nuget repository in local computer.
https://docs.microsoft.com/en-us/azure/devops/artifacts/nuget/nuget-exe?view=azure-devops
nuget sources add -name {your feed name} -source {your feed URL} -username {anything} -password {your PAT}
Then #r "nuget:package" works now in dotnet/interactive notebook. Hopefully it will work out of box in FSI under Visual Studio too.

There is no need to add "#i nuget url" as notebook does check global nuget settings.

However, it is still great to let kernel respects a local nuget.config so that other users can clone the repo and get going without messing with global nuget setting.

[cartermp]

I would expect that to work in VS as well, since it's all the same mechanism. Although the work to add #i support is underway here: https://github.com/dotnet/fsharp/pull/9950