Sources in 'dotnet list package' need to include package source mapping details

[erdembayar]

Currently it only displays sources but if package source mapping is enabled then we need to inform about it for precision.
For example: if someone is checking for dependency confusion attack then it helps to narrow down there it came from.

https://github.com/NuGet/Home/pull/11446/files#r798101062
Given GH is not good at keep track of comment/discussion I'll include screenshot too.

[nkolev92]

The command in quesiton here is list package.
We have an equivalent list sources command.

We'll likely have an equivalent list source-mappings.

Curious what @JonDouglas thinks, but my proposal would be that we don't add it right now and close this for nwo.

[erdembayar]

The command in quesiton here is list package. We have an equivalent list sources command.

We'll likely have an equivalent list source-mappings.

Curious what @JonDouglas thinks, but my proposal would be that we don't add it right now and close this for nwo.

If we dig down there're so many edge cases.

[nkolev92]

Can you clarify what you mean by edge cases?

[erdembayar]

Can you clarify what you mean by edge cases?

I just mean something like this. Package source mapping + some scenario.

[JonDouglas]

Yes I think it's a good issue to track. As Nikolche mentions, there will likely be other commands that give different outputs closer to what you might see in a nuget.config.

This is a good start to track the addition of seeing sources clearly defined in CLI. It may turn out similar to transitive dependencies and where they came from. i.e.

But with source used to resolve or in order if mapped multiple.

[nkolev92]

My suggestion actually was to close it, because this is the last thing we'd do, but don't feel too strongly :D