Offline Options for NuGet Server

suggestions.md

Temporary NuGet Server Workarounds

There are a few different ways you can provide a package source to your project that do not require nuget.telerik.com to be available.

Step 1 - Getting the Packages

NuGet packages can always be downlaoded directly from your product's Downloads page. Take the following steps:

1. Go to Your Account | Downloads
2. Select the product you're using.
3. Scroll down and download all the .nupkg files that your project needs. Some product have these all packages in a zip, while others have individually downloadable files.

Tip

When downloading your packages, don't forget to also get any dependent packages. For example, the Telerik Document Processing Libraries packages also available on that same page. These extra packages are usually towards the bottom or bundled in the ZIP.

Step 2 - Choosing a Package Source Option

You have a few different ways to set package sources in a nuget.config file. If the official Telerik feed is unavailable to you, most commonly in "air-gapped" environments, these approaches are a good solution.

Here are two options we can suggest.

Option 1 - Offline Package Source (recommended)

This option is our recommended approach when your CI system doesn't have built-in package/artifact management. You can use nuget package files in a local folder as a package source.

1. In your source code's root directory, create a folder named MyOfflinePackages, and a new subfolder named Telerik.
2. Copy all of the .nupkg files you downloaded in Step 1 into the MyOfflinePackages\Telerik subfolder.
3. Edit your project's nuget.config file to include MyOfflinePackages as a package source.
4. Comment out the https://nuget.telerik.com/v3/index.json package source.

For example:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear/>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" /> 
    
    <!-- Temporarily comment out the server package source, this will prevent errors -->
    <!-- <add key="TelerikServerFeed" value="https://nuget.telerik.com/v3/index.json"  protocolVersion="3" /> -->
    
    <!-- TEMPORARY LOCAL PACKAGE SOURCE -->
    <add key="my-local-folder-feed" value="..\MyOfflinePackages" />
  </packageSources>
  ...
</configuration>

Important

I used the relative path "..\MyOfflinePackages" in the example. Make sure yours matches where you put the folder in relation the nuget restore command is expecting it. For example, if the project is two levels deep, and you put the folder at the top level, then you need to up two folders, like this "..\..\MyOfflinePackages".

Option 2 - Custom Artifacts Feed

If you are using Azure DevOps, Team City, GitHub Actions, or AWS, you can use that system's built-in packages feed instead of nuget.telerik.com.

• Azure DevOps Artifacts are in the same project that the pipelines exist in.
  • See the "Using Azure Artifacts" section at the bottom of my blog post for exact instructions => https://www.telerik.com/blogs/azure-devops-and-telerik-nuget-packages
• GitHub Actions can use packages from that repo's packages feed, see https://github.com/features/packages
• AWS has CodeArtifact, see https://aws.amazon.com/codeartifact/
• TeamCity lets oyu enable a custom feed, see https://www.jetbrains.com/help/teamcity/using-teamcity-as-nuget-feed.html#Enabling+NuGet+Feed

Step 3 - Package Source Mapping - Protecting Against High Network Usage

Due to the way dotnet restore and nuget restore work, it is going to use all of the package sources when searching for a package. So this means your build is also going to search nuget.telerik.com for all the non-Telerik/Kendo stuff, causing dozens to hundreds of irrelevant calls to the server. This can lead to thousands of calls a day if you have multiple builds.

If you're behind a large buld system like Azure DevOps, AWS, etc, there isn't much you can do about the outbound network traffic. For these systems, we usually whitelist the known ranges. However, if you have an on-prem build server, or self-hosted runner/agent, then all your traffic to the datacenter is going to come from one or two IP addresses.

To address this, we strongly recommend adding a packageSourceMapping section to your nuget.config file. this will restrict searching the Telerik server for only packages that come form the Telerik server

<?xml version="1.0" encoding="utf-8"?>
<!-- Helpful docs https://docs.microsoft.com/en-us/nuget/reference/nuget-config-file -->
<configuration>
  <packageRestore>
    <add key="enabled" value="True" />
    <add key="automatic" value="True" />
  </packageRestore>
  <packageManagement>
    <add key="format" value="0" />
    <add key="disabled" value="False" />
  </packageManagement>
  <!-- Learn how to set a package source https://docs.microsoft.com/en-us/nuget/reference/nuget-config-file#packagesources -->
  <packageSources>
    <clear/>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
    <add key="Telerik_Feed" value="https://nuget.telerik.com/v3/index.json"  protocolVersion="3"/>
  </packageSources>
  
  <packageSourceCredentials>
	  <Telerik_Feed>
		  <add key="Username" value="%TELERIK_USERNAME%" />
		  <add key="ClearTextPassword" value="%TELERIK_PASSWORD%" />
	  </Telerik_Feed>
  </packageSourceCredentials>
  
  <!-- Learn how package source mapping works https://docs.microsoft.com/en-us/nuget/consume-packages/package-source-mapping?Wt.mc_id=DX_MVP5000553 -->
  <packageSourceMapping>
    <!-- Use the nuget.org for everything else -->
    <packageSource key="nuget.org">
      <package pattern="*" />
      <!-- These are the only 2 packages on nuget.org that needs to be matched before falling to the next mapping-->
      <package pattern="Telerik.FontIcons" />
      <package pattern="Telerik.SvgIcons" />
    </packageSource>
    
    <!-- This mapping group will use the 'Telerik_Feed' package source for ONLY relevant packages.
        It avoids erroneously searching the Telerik server for non-Telerik packages-->
    <packageSource key="Telerik_Feed">
      <package pattern="JustMock*" />
      <package pattern="Telerik*" />
      <package pattern="Kendo*" />
    </packageSource>
  </packageSourceMapping>
</configuration>

Warning

Be sure to double check the packageSourceMapping section's key matches the same key in the packageSources section's key. In the above example, the key is Telerik_Feed, yours might be something different, like Telerik.com or Telerik.

Note

If you are currently using a local folder or alternate feed option from Step 2, make sure the key matches that one (e.g. my-local-folder-feed)