🚀 Blog Post: Moving from NuGet Package Management to Artifactory in the Enterprise

Introduction

Why Switch?
NuGet has long been the default for .NET developers, but enterprises often need centralized control, retention policies, and security features that go beyond what NuGet.org offers. JFrog Artifactory provides a robust solution for hosting, caching, and managing packages across teams, ensuring compliance and scalability.

🔑 Key Considerations

• Repository URLs: Artifactory NuGet repositories must be accessed via api/nuget/ URLs. Forgetting this prefix is a common cause of failed connections.
• Authentication: Artifactory requires credentials or API keys. Ensure developers and pipelines use secure tokens rather than plain passwords.
• Version Retention: Old package versions can accumulate. Configure retention policies to avoid bloated feeds.
• Feed Views: Use views (e.g., @Prerelease, @Release) to separate stable from experimental packages.

⚠️ Common Pitfalls

• Mixing Feeds: Pointing projects to both NuGet.org and Artifactory without upstream sources can cause version conflicts.
• Pipeline Breakage: Hardcoded NuGet sources in YAML pipelines often fail after migration. Update them to Artifactory endpoints.
• Visual Studio Defaults: Developers may forget to switch their package source in Visual Studio, leading to inconsistent builds.
• Permissions: Artifactory enforces roles. Ensure contributors have publishing rights, and consumers have read-only access.

🖥️ Visual Studio Setup

1. Open Tools → NuGet Package Manager → Package Manager Settings.
2. Under Package Sources, add a new source:

• Name: Artifactory
• Source: https://.jfrog.io/artifactory/api/nuget/

1. Ensure the source is selected when restoring or adding packages.
2. For NuGet v3 API, configure Visual Studio accordingly to support modern clients.

🔧 Azure DevOps & Pipelines

• Artifacts Hub: Create a feed in Azure DevOps or connect directly to Artifactory. Use upstream sources if you still need NuGet.org.
• Pipeline YAML: Replace nuget restore sources with Artifactory URLs. Example:
  `yaml
• task: NuGetCommand@2
  inputs:
  command: ‚restore‘
  restoreSolution: ‚/*.sln‘
  feedsToUse: ’select‘
  vstsFeed: “
  `
• Retention Policies: Configure automatic cleanup of old packages.
• Automation: Publish packages directly from build pipelines to Artifactory, ensuring consistent availability across environments.

✅ Summary
Switching from NuGet to Artifactory is not just a technical migration—it’s a cultural shift toward centralized, secure, and scalable package management. Keep in mind:

• Update Visual Studio sources with the correct api/nuget prefix.
• Adjust Azure DevOps pipelines to reference Artifactory feeds.
• Avoid pitfalls like mixed feeds, missing permissions, and retention mismanagement.

By following best practices, enterprises gain better control, improved security, and streamlined workflows for package management. The transition may require upfront effort, but the long-term benefits in consistency and governance are well worth it.

Views: 0