dotnet / dotnet/vscode-dotnet-runtime
Allow configurable location for dotnet downloads
- Dominant language
- TypeScript
- Stars
- 209
- Forks
- 455
- PR merge metrics
- No merged PRs in 30d
Description
### Is your feature request related to a problem? Please describe.
In our environment, we use systems like Sonatype Nexus Repository and Sonatype Nexus Firewall to scan and approve SDKs, package downloads, and so on - enforcing a more secure software supply chain. [It appears](https://github.com/dotnet/vscode-dotnet-runtime/blob/cccc18f439f6ae56a63813d9fceb0c3ca51855e0/vscode-dotnet-runtime-library/src/Acquisition/GlobalInstallerResolver.ts#L253) the .NET install extension very much requires you to use one of the public Microsoft endpoints for download rather than being able to provide an internal repository. While there is a proxy option, I'm not allowed to pull through a proxy - the source _must be_ the internal repo.
I've raised [this same thing on the `dnup` acquisition tool discussion](https://github.com/dotnet/designs/discussions/340#discussioncomment-14036193) so if the extension starts using `dnup` (or collaborates on creating it), perhaps that'd be the solution.
### A clear and concise description of what you want to happen. Include any alternative solutions you've considered.
I would like to be able to configure the location of the `https://builds.dotnet.microsoft.com` secure download location so I can use an internal/non-public endpoint of allowed packages.
### Describe the solution you'd like
Other version manager tools like [n](https://github.com/tj/n) or [nvm](https://github.com/nvm-sh/nvm) (Node) allow you to specify environment overrides (`N_NODE_MIRROR`, `NVM_NODEJS_ORG_MIRROR`) for where the list of available SDK versions is pulled and where the SDK itself is downloaded. Having either configuration or environment variables similar to this to guide how package downloads are located would solve the problem.
### Additional context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.