Nuget Support

[WanielDeiss]

Is there any plan to support Nuget in the registries?

[baruchiro]

It is not in high priority, but it could be a good start for contributors. If you can add StackOverflow examples with links, install commands, and advisories showing an analysis of the Nuget package, the issue will be ready for implementation.

[amielnoy]

This is a good start point
https://learn.microsoft.com/en-us/nuget/nuget-org/publish-a-package
you need to get api key to publish a package

[baruchiro]

@amielnoy This project is not about publishing packages, but it is about finding suggestions for packages and analyzing the suggestions.

I can't see how documentation about publishing a Nuget package will help us.

I'm looking for information about what the installing commands for Nuget are looks like, with real examples from StackOverflow.

[baruchiro]

To find examples in StackOverflow, You can use Google BigQuery as StackOverflow is a public dataset (use sandbox for free).

Example query

[taliachoen]

Hello,

Following the discussion above, here are several real-world examples of NuGet package installation commands, taken from StackOverflow questions:

Newtonsoft.Json
Installation command:
Install-Package Newtonsoft.Json
Source: https://stackoverflow.com/questions/38296006/unable-to-install-newtonsoft-json

NUnit
Installation command:
Install-Package NUnit
Source: https://stackoverflow.com/questions/33081697/how-to-install-nunit-for-c-sharp-with-nuget-package-manager-on-visual-studio-201

Serilog
Installation command:
Install-Package Serilog
Source: https://stackoverflow.com/questions/78318208/worker-service-in-net-core-8-c-sharp-serilog-logger-write-to-file-using-setti

EntityFramework
Installation command:
Install-Package EntityFramework -Version 6.2.0
Source: https://stackoverflow.com/questions/57871406/nuget-install-package-entityframework-6-2-0-already-exists-in-folder-cspro

Let me know if you'd like me to collect more examples or focus on a specific package.

[baruchiro]

Notes:

1. For NUnit, I saw the command only in a comment.
2. For Serilog, the command is dotnet add package Serilog

Also, we need to check which providers support Nuget vulnerabilities we have, or we should integrate a new one.

[taliachoen]

I have checked whether the existing providers support NuGet vulnerabilities, and from what I found, both deps.dev and Socket do support it.

Please let me know if you’d like me to proceed with exploring how to integrate them effectively.

Thanks

[baruchiro]

Sure, let's proceed!

You can follow the current implementation for npm.
Don't forget to add tests.
If you find complex cases, it is OK to leave them for later. As it is your first development, the main goal is to contribute code, even if it is a minimal valauble (MVP)

[taliachoen]

Thanks for the support!
I cloned the project and created a local branch and added the required code. Now, I want to make sure it works properly.
Could you please advise how I can test and run the changes locally before pushing them to GitHub?

I want to ensure everything works as expected before creating the PR.

[baruchiro]

You have the instructions in the README: https://github.com/os-scar/overlay?tab=readme-ov-file#local-development