Skip to content

protect-oss-packages-with-upstream-sources.md

Latest commit

 

History

History
261 lines (170 loc) · 10.9 KB

protect-oss-packages-with-upstream-sources.md

File metadata and controls

261 lines (170 loc) · 10.9 KB
title How to restore packages from upstream sources in your Azure Artifacts feed
description Learn how to consume packages from public registries with upstream sources in Azure Artifacts.
ms.service azure-devops-artifacts
ms.date 06/24/2025
monikerRange <=azure-devops
ms.custom sfi-image-nochange
recommendations true
ms.topic tutorial

Tutorial: How to restore packages from upstream sources

[!INCLUDE version-lt-eq-azure-devops]

Using upstream sources in Azure Artifacts enables you to manage all your application dependencies from a single feed. It simplifies consuming packages from public registries like NuGet.org or npmjs.com, while also providing protection against outages or compromised packages. You can also publish your own packages to the same feed and manage all your dependencies in one location.

This tutorial walks you through enabling upstream sources in your feed and consuming packages from public registries such as NuGet.org or npmjs.com.

Prerequisites

Product Requirements
Azure DevOps - An Azure DevOps organization.
- An Azure DevOps project.
- Allow Azure Artifacts Domain URLs and IP addresses if your organization is using a firewall or a proxy server.

Create a feed and enable upstream sources

  1. Sign in to your Azure DevOps organization, and then navigate to your project.

  2. Select Artifacts, and then select Create Feed to create a new feed.

  3. Provide a Name for your feed, choose its Visibility and Scope, and make sure you check the Include packages from common public sources checkbox to enable upstream sources.

  4. Select Create when you're done.

    :::image type="content" source="../media/new-feed-with-upstream-source.png" alt-text="a Screenshot displaying how to create a new feed and enable upstream sources in Azure Artifacts.":::

Important

To add a feed from a different organization as an upstream source, the target feed owner must share the target view with All feeds and people in organizations associated with my Microsoft Entra tenant by navigating to Feed Settings > Views > Select the ellipsis button on the right for the specified view > Edit .

Authenticate with the feed

Now that you've created your feed, select the appropriate tab based on the technology you're using and follow the instructions to set up your configuration file and connect to your feed:

npm

  1. Sign in to your Azure DevOps organization, and then navigate to your project.

  2. Select Artifacts, select your feed from the dropdown menu, and then select Connect to feed.

  3. Select npm from the left navigation pane, and follow the provided instructions in the Project setup section to set up your config file. If you don’t already have a .npmrc file, create a new one in the root of your project (the same folder as your package.json). Open your new .npmrc file and paste in the provided snippet.

    :::image type="content" source="../media/connect-to-feed-npm-registry-azure-devops-newnav.png" alt-text="A screenshot displaying how to set up your npm project in Azure Artifacts.":::

NuGet

  1. Sign in to your Azure DevOps organization, and then navigate to your project.

  2. Select Artifacts, select your feed from the dropdown menu, and then select Connect to feed.

  3. Select NuGet.exe from the left navigation pane, then copy the XML snippet provided in the Project Setup section.

  4. Create a new nuget.config file in the root of your project, and paste in the XML snippet you copied in the previous step.

Python

  1. Sign in to your Azure DevOps organization, and then navigate to your project.

  2. Select Artifacts, select your feed from the dropdown menu, and then select Connect to feed.

  3. Select pip from the left navigation pane.

  4. Create a virtual environment if you haven't done so already.

  5. Add a pip.ini (Windows) or pip.conf (Mac/Linux) file to your virtualenv and paste in the snippet provided in the Project setup section.

Maven

  1. Sign in to your Azure DevOps organization, and then navigate to your project.

  2. Select Artifacts, select your feed from the dropdown menu, and then select Connect to feed.

  3. Select Maven from the left navigation pane.

  4. Add the snippet provided in the Project setup section to the <repositories> and <distributionManagement> sections in your pom.xml. Your file should look similar to the following:

    <repository>
  <id>[FEED-NAME]</id>
  <url>https://pkgs.dev.azure.com/[ORGANIZATION-NAME]/_packaging/[FEED-NAME]/maven/v1</url>
  <releases>
    <enabled>true</enabled>
  </releases>
  <snapshots>
    <enabled>true</enabled>
  </snapshots>
</repository>

  5. Paste the provided <server> snippet into your settings.xml file. You file should look similar to this:

    <settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0
                              https://maven.apache.org/xsd/settings-1.0.0.xsd">
  <servers>
    <server>
      <id>[FEED-NAME]</id>
      <username>[ORGANIZATION-NAME]</username>
      <password>[PERSONAL_ACCESS_TOKEN]</password>
    </server>
  </servers>
</settings>

  6. Create a personal access token with Packaging > Read & write scopes and paste your personal access token into the <password> tag in your settings.xml file.

Gradle

  1. Sign in to your Azure DevOps organization, and then navigate to your project.

  2. Select Artifacts, select your feed from the dropdown menu, and then select Connect to feed.

  3. Select Gradle from the left navigation pane.

  4. Add the snippet provided in the Project setup section to the repositories and publishing sections in your build.gradle file. Your file should resemble the following:

    maven {
    url 'https://pkgs.dev.azure.com/[ORGANIZATION-NAME]/_packaging/[FEED-NAME]/maven/v1'
    name '[FEED-NAME]'
    authentication {
        basic(BasicAuthentication)
    }
}

  5. Paste the provided <server> snippet into your settings.xml file. Your file should resemble the following:

    <settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0
                              https://maven.apache.org/xsd/settings-1.0.0.xsd">
  <servers>
    <server>
      <id>[FEED-NAME]</id>
      <username>[ORGANIZATION-NAME]</username>
      <password>[PERSONAL_ACCESS_TOKEN]</password>
    </server>
  </servers>
</settings>

  6. Create a personal access token with Packaging > Read & write scopes. Paste your personal access token into the <password> tag in your settings.xml file.

Cargo

  1. Sign in to your Azure DevOps organization, and navigate to your project.

  2. Select Artifacts, select your feed from the dropdown menu, and then select Connect to feed.

  3. Select Cargo from the left navigation pane.

  4. Add the snippet provided in the Project setup section to your cargo/config.toml file in your source repository. Your config.toml file should resemble the following:

      [registries]
  FEED_NAME = { index = "sparse+https://pkgs.dev.azure.com/ORGANIZATION_NAME/PROJECT_NAME/_packaging/FEED_NAME/Cargo/index/" }
  ```

  5. Add the second snippet provided in the Project setup section to your cargo/config.toml file to replace the crates.io source with your feed. Your file should resemble the following:

    [source.crates-io]
replace-with = "FEED_NAME"

  6. Configure a credential provider

  7. Log in to the registry

Restore packages

Now that you've enabled upstream sources and authenticated with your feed, select the appropriate tab based on your package type, and follow the instructions to restore packages from public registries into your Azure Artifacts feed.

::: moniker range=">= azure-devops-2022"

npm

  1. Remove the node_modules folder from your project.

  2. Open a command prompt window and run the following command to restore your packages. Once completed, your feed should have a saved copy of any packages installed from upstream.

    npm install --force

Note

The --force flag ensures that packages are pulled from the remote source even if a local copy exists.

NuGet

  1. Clear your local cache.

    nuget locals -clear all

  2. Open a command prompt window and run the following command to restore your packages. Once completed, your feed should have a saved copy of any packages installed from upstream.

    nuget.exe restore

Python

  • Open a command prompt window and run the following command in your project directory to restore your packages. Once completed, your feed should have a saved copy of any packages installed from upstream.

    pip install

Maven

  • Open a command prompt window and run the following command in your project directory to restore your packages. Once completed, your feed should have a saved copy of any packages installed from upstream.

    mvn install

Gradle

  • Open a command prompt window and run the following command in your project directory to restore your packages. Once completed, your feed should have a saved copy of any packages installed from upstream.

    gradle build

Cargo

  • Open a command prompt window and run the following command in your project directory to restore your packages. Once completed, your feed should have a saved copy of any packages installed from upstream.

    cargo build

::: moniker-end

Related content