Cannot install older versions of packages when using Azure Artifacts

[mkcello96]

Description

When using azure artifacts, the version dropdown does not appear to do anything. Whenever I install a package it defaults to the newest available one even though I have selected an older one.
I did see the section in the README about turning off supportsPackageIdSearchFilter, which seemed to help see other versions but the issue still remains when trying to download them. And I also fiddled with other settings like packageDownloadUrlTemplateOverwrite and was still unsuccessful.
If it helps, here are the structures for our links that we are trying to use:

• feed URL: https://pkgs.dev.azure.com//_packaging//nuget/v3/index.json

• here is the URL to get a specific version of the package, like the packageDownloadUrlTemplateOverwrite config option describes: https://feeds.dev.azure.com//_apis/packaging/Feeds//packages/{0}/versions/{1}

• NuGet Package: CSharpVitamins.ShortGuid 1.1.0

• NuGetForUnity Version: 4.0.2

• Unity Version: 2021.3.16f1

• Operating System: Windows

[JoC0de]

Hi thanks for creating the detailed issue.
Seams a little bit strange. I need more information to figure out what the problem is.

1. So the feed URL is: https://pkgs.dev.azure.com/_packaging/nuget/v3/index.json (no //)?
2. When you open the feed URL (service index) in your browser you should get a response like the one from nuget.org https://api.nuget.org/v3/index.json.
3. The service index should contain a RegistrationsBaseUrl and a PackageBaseAddress. If it has a PackageBaseAddress you shouldn't need to set packageDownloadUrlTemplateOverwrite.
4. If you open <RegistrationsBaseUrl>/<package ID (lower case)>/index.json e.g. https://api.nuget.org/v3/registration5-semver1/csharpvitamins.shortguid/index.json you should see all versions of the package (for packages with many versions it is paginated).
5. Ist the package you try to install a pre-release version?
6. Can you install the package using the official nuget.org Feed?
7. Eventually you can find some information about the error inside the Verbose log (can be enabled in the settings).

[mkcello96]

Thanks for getting back to me.

1. Sorry my formatting of the URLs got a bit messed up - the double-slashes have a project name inbetween them that I had redacted out. So they are https://pkgs.dev.azure.com/PROJECTNAME/_packaging/PROJECTNAME/nuget/v3/index.json and https://feeds.dev.azure.com/PROJECTNAME/_apis/packaging/Feeds/PROJECTNAME/packages/{0}/versions/{1}
2. Yes they're similar when I put them in a browser. The nuget one has a bit more data is all.
3. I do see both a a RegistrationsBaseUrl and a PackageBaseAddress in the browser like you're saying. There are a few different RegistrationBaseUrls, same as in the nuget index.
4. Yes that seems to work - I got the versions listed.
5. No, it's an old version. I see it in the listed versions w/ my service index.
6. Yes using nuget works.
7. I do have verbose logging enabled but do not see any errors when hitting the "install" button. I see info-level logs when searching for the library. There are a few 401 unauthorized logs that point to other libraries when searching (not the one that I'm trying to install), so I guess it could be related to that? But I don't see errors indicating that when installing.

[JoC0de]

1. Did you try removing the packageDownloadUrlTemplateOverwrite? Because it should be automatically determined from the PackageBaseAddress, so it should look more like https://pkgs.dev.azure.com/{ORGANIZATION}/{PROJECTNAME}/_packaging/{FEEDNAME}/nuget/v3/flat2/{0}/{1}/{0}.{1}.nupkg where {0} it the package id and {1} is the package version.
2. 401 error normally means that you don't specify credentials that are required for the feed. Do you have credentials specified for the feed like in

   NuGetForUnity/README.md

   Lines 170 to 182 in 441f6df

   	<?xml version="1.0" encoding="utf-8" ?>
   	<configuration>
   	<packageSources>
   	<add key="github" value="https://nuget.pkg.github.com/NAMESPACE/index.json" supportsPackageIdSearchFilter="false" />
   	</packageSources>
   	<packageSourceCredentials>
   	<github>
   	<add key="userName" value="USERNAME" />
   	<add key="clearTextPassword" value="TOKEN" />
   	</github>
   	</packageSourceCredentials>
   	...
   	</configuration>

3. Do you have multiple active packages sources so the package can be downloaded from different source as the one used to search.
4. Eventually you have some versions of the NuGet package inside the Cache (%localappdata%\NuGet\Cache) so you can install only the cached version. Probably you cant install anything if you disable "install from cache".

[mkcello96]

Thanks for the continued help -

1. Yes I've tried removing packageDownloadUrlTemplateOverwrite and it does not change anything. When I go to my service index in the browser my package base address looks like this, it's similar but slightly different: https://pkgs.dev.azure.com/PROJECTNAME/_packaging/FEEDID/nuget/v3/flat2/. The FEEDID is a guid, and there is no {ORGANIZATION} like in your example.
2. We are using https://github.com/microsoft/artifacts-credprovider for authorization and so I am assuming the username/password does not need to be filled in. I did get the prompt to sign in when I first started up NuGet for Unity and I am assuming that authorization got cached somewhere as I have not seen the prompt again. But maybe I need a better way of ensuring it isn't broken.
3. I am only aware of the one package source that we use.
4. I did try enabling "install from cache" (I had it disabled) and I see the same issue. The cache will only have older versions in it if I installed them using the nuget index.

[JoC0de]

1. So the NuGet.config only contains one add in the packageSources element?
2. Do you have a different package installed that has a dependency on the package (A higher version than you try to install)?
3. If you disable the cache and delete all installed versions of the package, you can see the package in the search result -> select a older version -> click install -> but a different version is installed afterwards?
4. How do you know that the wrong version is installed afterwards?
5. Can you provides some verbose logs?