Home: dotnet pack does not support owners property

[livarcocc]

_From @rjgotten on March 11, 2019 15:16_

Steps to reproduce

Try to create a package with dotnet pack based on csproj metadata properties.
Try to define owners separate from authors. E.g. where a package has a wide group of contributors but a limited set of core maintainers (or a company or other entity) that have full ownership.

Expected behavior

There should be an <Owners> metadata property in the csproj format which maps to the <owners> node in the nuspec format.

Actual behavior

There is no way to set owners separate from authors without resorting to using an external nuspec file.

Environment data

dotnet --info output:

.NET Core SDK (reflecting any global.json):
 Version:   2.1.504
 Commit:    91e160c7f0

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.17134
 OS Platform: Windows
 RID:         win10-x64
 Base Path:   C:\Program Files\dotnet\sdk\2.1.504\

Host (useful for support):
  Version: 2.1.8
  Commit:  209f8aa25c

_Copied from original issue: dotnet/cli#10964_

[anangaur]

Owners is a NuGet Gallery concept. Once you upload a package to NuGet.org or any other NuGet Gallery that supports users/owners, this field should be set automatically on the Server. This field should **not** be set in the nuspec and if set will be ignored.

[rjgotten]

@anangaur
Owners is a NuGet Gallery concept. Once you upload a package to NuGet.org or any other NuGet Gallery that supports users/owners, this field should be set automatically on the Server. This field should *not* be set in the nuspec and if set will be ignored.

Here's what the nuspec reference at https://docs.microsoft.com/en-us/nuget/reference/nuspec has to say:

owners
A comma-separated list of the package creators using profile names on nuget.org. This is often the same list as in authors, and is ignored when uploading the package to nuget.org.

That description only states it is ignored by nuget.org when uploaded to the official gallery. Not that it is ignored when building the package itself. Moreover it states that the owners field is _often_ the same as the authors field. Which implies it is not _always_ the same, i.e. it is expected to be able to carry different meaning.

Furthermore:
If the field is supposed to not be set in the nuspec file - i.e. if it should not be used when building the package - and if it is meant to be _always_ ignored in all cases - and not only by nuget.org which is somewhat of an exception because it handles package ownership in a different manner - then why does it remain in the nuspec definition at all?

And a much more pertinent question:
_Why_ is it then implicitly generated and placed in the nupkg file's embedded nuspec file, using a copy of the authors field? (Yes it is there. Open the nupkg as a zip-file and have a look.)

Neither the actual implementation nor the documentation matches your statement. To me it really looks like you're grasping for an excuse to drop what is an implementation oversight. And I must say: I find that unacceptable. It brings back memories of the old joke: _"How many Microsoft engineers does it take to switch a broken lightbulb? Zero; they make darkness the new standard."_

So I'm going to ask again: provide a way to set the owners from the csproj metadata - just as there is a way to set it directly in the nuspec file - and resolve this impedance mismatch.

[anangaur]

I am reopening the issue based on your comment. Though I am not convinced that this is a metadata that needs its place in csproj, but good to have the discussion going and do the **right** thing.

Where do you typically upload/put this package? I am asking this to understand where would you typically look at the owner information with rest of the package details. Does it have any impact on the package consumer while installing the package? Should it? Btw, currently owner info does not show up on NuGet Package Manager UI. Hence curious.

In my mind, the owner information if/when available to the consumers should have some backing from a service where the ownership is vetted in some form and not something that comes from a free text field.

[rjgotten]

I happened to come across the owner information anomaly while inspecting version information for a previously built package in Nuget Package Explorer, and things rolled from there.

As far as I'm concerned, this is a matter of having the right data in the package, preserved over time. Also in earlier released versions of the package. Incase the Package Manager UI ever _changes_ to incorporate the owner, or any other UI starts incorporating it. (Well; Package Explorer seems to already incorporate it, atleast.)

I'm also not entirely sure of the _legal_ problems wrongly declared ownership over a package and the code/product it contains could have. But if I were a betting man, I'd say the odds of someone atleast _trying_ to abuse that at one point are - sadly - pretty good.

Those alone should be enough motivation to - as you write - at the very least get clear what the right thing to do is. And then ensure that everything does the right thing; i.e. the official gallery at nuget.org; the Package Manager UI; the nuspec reference; the dotnet pack command; etc. etc.

In my mind, the owner information if/when available to the consumers should have some backing from a service where the ownership is vetted in some form and not something that comes from a free text field.

This is why it's a good thing that a public stream like nuget.org ignores the owners field and supplants it with the data of the account that was used to publish the package.

[anangaur]

Those alone should be enough motivation to - as you write - at the very least get clear what the right thing to do is. And then ensure that everything does the right thing; i.e. the official gallery at nuget.org; the Package Manager UI; the nuspec reference; the dotnet pack command; etc. etc.

Totally agree to this part - We do need to clean up our act on owner/author issues and come up with a consistent messaging and recommendation around them to avoid the perennial confusion.

[anangaur]

The following issue was created to start showing owner info on VS: https://github.com/NuGet/Home/issues/7957

[anangaur]

Closing this issue as we are tracking the showing the owner field on Visual Studio PM UI as part of #7957