Repository navigation
C#: Rollback NuGet CLI proxy usage. - #22888
michaelnebel wants to merge 3 commits into
Conversation
There was a problem hiding this comment.
🟢 Approval recommended
The rollback is narrowly scoped, affected call sites are consistent, and no blocking issues remain.
No open issues 🎉
What changed in this PR
Restores the C# extractor’s previous packages.config restore behavior by rolling back NuGet CLI proxy and certificate environment setup, since NuGet does not honor SSL_CERT_FILE.
Changes:
- Remove NuGet subprocess proxy configuration and its associated factory and caller plumbing, while preserving feed-manager proxy support.
- Add a change note documenting the rollback.
| File | Description |
|---|---|
csharp/ql/lib/change-notes/2026-10-26-nugetcli-proxy-config-rollback.md |
Documents the rollback. |
csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs |
Removes proxy injection and subprocess environment configuration. |
csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs |
Removes the unused proxy field and updates the factory call. |
Review effort: Max
mbg
left a comment
mbg
left a comment
There was a problem hiding this comment.
A couple of comments: one about whether this should affect just the mono case or not, and one suggestion for the changelog.
| // Configure the proxy settings, if applicable. | ||
| registryProxy?.SetProcessEnvironment(pi); | ||
|
|
There was a problem hiding this comment.
We know that running this with mono doesn't work because mono doesn't respect the environment variable for the certificate. But does it work without mono and would it make sense to keep that case?
There was a problem hiding this comment.
As far as I can tell SSL_CERT_FILE is not respected by the NuGet CLI on any operating system (not on windows either). The support was introduced with dotnet nuget. I have asked various AIs as well; They claim the same, with the reasoning "It is not supported due to lack of documentation that it should be supported".
Have you found other information?
There was a problem hiding this comment.
Have you found other information?
No, I don't know what the situation with NuGet itself is. I just had theunderstanding that it definitely was a problem with mono and that it was the initial blocker, but had no insights into whether it does or doesn't work even without mono in the picture.
…llback.md Co-authored-by: Michael B. Gale <mbg@github.com>
This is rollback of this PR.
The NuGet CLI doesn't use the content of
SSL_CERT_FILE.