dotnet / dotnet/sdk

dotnet tool install shouldn't use local config for global tools

Open
#53,126 0 comments 2 reactions 0 assignees View on GitHub
Area-Tools untriaged
Dominant language
C#
Stars
3.2k
Forks
1.3k
PR merge metrics
PR metrics pending

Description

I ran into this unexpected situation where I tried to install a global tool (`dotnet tool install -g xxx`) but it failed because I was in a project directory which had a nuget.config pointing to an internal source.

I believe this behavior is wrong, and probably even unsecure. It is expected that dotnet will use the local nuget.config when installing a local tool, because the tool is scoped to the current folder. However, when installing a global tool, the user is unlikely to consider that the local directory is going to influence the result, and therefore will be less careful. It can even become a security risk if there is a leftover nuget.config file in the downloads or temp directory.

I believe `dotnet tool install -g` should only use the userprofile nuget.config.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.