阻止NuGet包

Question

After finally recovering from the System.Net.Http package hell we would like to block the package entirely.

I'm looking for a way to block the package from ever installing, so not blocking or locking a version but the entire package (due to a dependency or developer error). The block should be in the solution folder of the application so that every developer will have the block once updating from SVN.

I've looked at the NuGet.config and .nuspec documentation but was unable to find such a feature. My Google-fu also didn't yield any results. So I was wondering if there was anybody here that knows if and how it can be done.

I've opened up a GitHub issue

Answer 1

I can maybe offer a workaround. We wanted a similar thing (prevent referencing WinForms dependencies) and added a unit test that checks whether specific assemblies are referenced:

private static readonly IEnumerable<string> BlockedAssemblies = new List<string>
{   
    "System.Net.Http"
};

[Test]
public void SpecificAssembliesAreNotReferenced()
{
    var asm = Assembly.Load("Your.Assembly.File");

    var refs = asm.GetReferencedAssemblies();
    foreach(var a in refs)
    {
        Assert.False(BlockedAssemblies.Contains (a.Name), $"{a.Name} must not be referenced.");
    }
}

It's not perfect, and doesn't actually block the package from being downloaded, but it prevents accidental referencing and usage of an assembly.