Verify feeds required for fallback archive generation
JunTaoLuo opened this issue · comments
It looks like during fallback archive generation all feeds listed at https://github.com/aspnet/Universe/blob/fb7a5b92cc42ff33271db3fb4c3981ee44c6a5c7/build/sources.props are being used. However, I'm not sure if all of these feeds are required. Theoretically we should only need the feed with the current build (via pipe build/prodcon?) and the nuget feed. We should see if we can remove some of the redundant feeds.
Using multiple feeds have led to problems with mismatching package hashes, especially when there are duplicated (same ID and version) but not identical (private builds that accidentally leaked onto myget feeds) packages among the different feeds.
Using multiple feeds have led to problems with mismatching package hashes, especially when there are duplicated (same ID and version) but not identical (private builds that accidentally leaked onto myget feeds) packages among the different feeds.
This seems like the real issue to be solved. Do we know how we ended up with multiple builds of the same package ID and verison? I don't think we can fix this by changing the feeds we use to create package archives.
Going to keep this issue around but not going to actively track it. The mismatching packages have been removed from internal feeds so going forward 2.2.0 and 2.1.6 or newer LZMAs should be correct. This will be redesigned for 3.0 so there won't be any issues either.
This issue was originally blocking hash comparison on nuget restore but it's unclear when this feature will be turned on and we will react accordingly.
Triage team: we're not sure what action we can take here, but it appears removing the duplicate packages from internal feeds has mitigated this issue.