Skip to content

set-up-upstream-sources.md

Latest commit

 

History

History
174 lines (95 loc) · 7.66 KB

set-up-upstream-sources.md

File metadata and controls

174 lines (95 loc) · 7.66 KB
title Set up upstream sources for your feed
description How to set up external feeds and public registries as upstream sources for your feed
ms.service azure-devops-artifacts
ms.topic how-to
ms.date 03/21/2024
monikerRange <=azure-devops

Set up upstream sources

[!INCLUDE version-lt-eq-azure-devops]

With Azure Artifacts upstream sources, you can streamline your package management by using a single feed to store both the packages you publish and those you consume from external feeds and public registries such as npmjs.com, NuGet.org. When an upstream source is enabled on your feed, Azure Artifacts will automatically save a copy of any package installed by a collaborator or higher from upstream.

Note

Maven snapshots are not supported in upstream sources.

Enable upstream sources in a new feed

  1. Sign in to your Azure DevOps organization, and then navigate to your project.

  2. Select Artifacts, and then select Create Feed.

  3. Provide a Name for your feed and select its Visibility and Scope settings. Make sure to check the Include packages from common public sources checkbox to enable upstream sources.

  4. Select Create when you're done.

    :::image type="content" source="../media/new-feed-dialog-azure-devops.png" alt-text="A screenshot showing how to create a new feed.":::

Note

You must be a feed owner or a feed administrator to add or remove upstream sources.

Enable upstream sources in an existing feed

  1. Sign in to your Azure DevOps organization, and then navigate to your project.

  2. Select the gear icon button gear icon to navigate to your feed settings.

  3. Select Upstream sources, and then select Add upstream source.

  4. Select Public source, and then select a Public source from the dropdown menu.

  5. Select Add when you're done, and then select Save once more in the top right corner to preserve your changes.

Note

Custom public upstream sources are only supported with npm registries.

Add a feed in the same organization as an upstream source

  1. Sign in to your Azure DevOps organization, and then navigate to your project.

  2. Select the gear icon buttongear icon to access your feed's settings.

  3. Select Upstream sources, and then select Add Upstream.

  4. Select Azure Artifacts feed in this organization.

  5. Select the desired Feed from the dropdown menu to add it as an upstream source. Then, select the View and choose the Package type(s) you wish to use. Optionally, you can also modify the name of your upstream source.

  6. Select Add when you're done.

    :::image type="content" source="../media/add-upstream-same-org.png" alt-text="A screenshot showing how to add a feed in your organization as an upstream source.":::

Add a feed in a different organization as an upstream source

  1. Sign in to your Azure DevOps organization, and then navigate to your project.

  2. Select the gear icon buttongear icon to access your feed's settings.

  3. Select Upstream sources, and then select Add Upstream.

  4. Select Azure Artifacts feed in another organization.

  5. Enter your Azure Artifacts feed locator in the following format:

    • Organization scoped feed:

      azure-feed://ORGANIZATION_NAME/FEED_NAME@VIEW

    • Project scoped feed:

      azure-feed://ORGANIZATION_NAME/PROJECT_NAME/FEED_NAME@VIEW

  6. Select the Package type(s) you wish to use and provide a name for your upstream source.

  7. Select Add when you're done.

    :::image type="content" source="../media/add-upstream-diff-org.png" alt-text="A screenshot showing how to add a feed in a different organization as an upstream source.":::

Note

To add a feed from a different organization as an upstream source, the target feed owner must share the target view with All feeds and people in organizations associated with my Microsoft Entra tenant by navigating to Feed Settings > Views > Select the ellipsis button on the right for the specified view > Edit .

Examples

NuGet

Npm

Python

Maven

Cargo

Universal Packages

PowerShell

Note

You must be a Feed and Upstream Reader (Collaborator), a Feed Publisher (Contributor), or a Feed Owner to install new packages from upstream. A copy of each upstream package is saved to the feed on first use. Packages already saved from upstream sources can be used by Feed Readers.

FAQs

Q: I can't find my package even though I can see it in one of my feed's upstreams?

A: Packages from upstream sources become available in the feed soon after they're published, but they only appear to readers once they’re saved to the feed.

A package is saved when a user with Feed and Upstream Reader (Collaborator) or higher permissions installs that package version. Azure Artifacts then automatically saves a copy of the package to the feed, making it permanently available to all readers and visible in the web UI.

Q: I can’t find the feed I want to configure as an upstream source?

A: Make sure that the feed owner has shared a view as an upstream source. See Add a feed in a different organization as an upstream source for more details.

Q: What are feed views?

A: Feed views let you share a subset of package versions that have been tested and validated, excluding those still in development or not meeting quality criteria. See What are feed views for more details.

Q: Can a user with the Feed Reader role download packages from an upstream source?

A: No. Feed Reader can only download packages already saved to the feed. Packages are saved when a Feed and Upstream Reader (Collaborator), Feed Publisher (Contributor), or Feed Owner installs them from upstream.

Q: What happens if a user deletes or unpublishes a package saved from an upstream source?

A: The package becomes unavailable for download, and its version number is permanently reserved. It will no longer sync from upstream, but earlier and later versions remain unaffected.

Q: What happens if a user deprecates a package saved from an upstream source?

A: A warning message is added to the package’s metadata. This warning appears whenever the package is viewed or installed from the feed.

Related articles