Swap authors for owners in Visual Studio Package Manager UI

[JonDouglas]

NuGet Product(s) Involved

Visual Studio Package Management UI

The Elevator Pitch

Currently in the Visual Studio Package Manager UI, we show the authors field which is a comma delimited list that is commonly used to help a developer know who "authored" the package.

This concept is a bit outdated as NuGet.org provides a owners field in the search service that provides an up-to-date maintainer list that can be used as a primary and if a server doesn't provide it, can fallback on authors. This is not to be confused with the local owners nuspec field.

https://learn.microsoft.com/en-us/nuget/api/search-query-service-resource#search-result

Some further details as pointed out by @zivkan might be that we would only display owners for sources that support it and are fetched from the remote and ignore some nuspec metadata in the global packages folder.

This will help reduce confusion of a field that is commonly used to impersonate notable entities or have changed in ownership in the years since it was published where the original author is still listed.

Related: #10260

Additional Context and Details

No response

[zivkan]

We also need to remember that nuget.org is not the only package feed out there, and we need to take into account how other package sources work. In most cases, they blindly copy the package's nuspec owners field. Many nuget server implementations don't have a concept of different owners for different packages.

What behaviour do we want when a package on a non-nuget.org source has an owners field? What behaviour do we want when the package doesn't have the owner field?

I 100% agree that the proposal is correct for nuget.org. My concern is what the ideal behaviour is for all non-nuget.org sources.

[baronfel]

For what it's worth, on the Template Engine we are also evaluating when and where to surface Owners instead of Authors, since as @JonDouglas pointed out from a NuGet.org perspective Owners are the unit of trust - they define the package prefix reservations. Our discussion is here, but since our search functionality for Templates is very strongly bound to NuGet.org we decided that showing the Owner and highlighting it in the search UI in some fashion was preferable.

[joelverhagen]

I 100% agree that the proposal is correct for nuget.org. My concern is what the ideal behaviour is for all non-nuget.org sources.

Yes, this is a real concern, worth pondering. The general process for this is for package sources to advertise or opt-in to preferring owners over authors by having a new Search resource version (SearchQueryService/6.5.0 or something like that) which NuGet.org would advertise but other feeds would not (immediately) have. And in our protocol docs we would say owners is preferred over authors by the NuGet client experience starting with resource version SearchQueryService/6.5.0.

[nkolev92]

@JonDouglas
There seems to be quite a few duplicates of this:

Can we consolidate the issue?
#10260 and #10666 are what I found.

[JonDouglas]

@nkolev92 This is different. Not to be confused with the two other owners issues 🤦‍♂️

This one specifically is about showing NuGet.org owners in place of .nuspec authors.

https://devblogs.microsoft.com/nuget/managing-package-owners/

https://learn.microsoft.com/en-us/nuget/api/search-query-service-resource#search-result

[nkolev92]

I was looking at it from a different perspective. Even though they're asking for slightly different things, they have the similar motivation and they are in a way mutually exclusive. We can only do 1.

I think #10260 has the same motivation as this, even though the title is slightly different.

Like for example, fixing this issue, would automatically warrant closing #10260, becasue we wouldn't deprecate authors, but we'd be showing owners from nuget.org

Similar to #10666, we don't want to remove the owners, we just want to use verified owners.