Nuget.Server 2.11.1 crash if try to use package that require NuGet 3.4

I added the https://dotnet.myget.org/F/dotnet-core/api/v2/package/System.Reflection.Extensions/4.0.1-rc4-24131-00 in the packages folder and the below exception messages was logged. The package is not listed.

 type="System.InvalidOperationException" message="'System.Collections.Concurrent' already has a dependency defined for 'System.Runtime'." source="NuGet.Core" detail="System.InvalidOperationException: 'System.Collections.Concurrent' already has a dependency defined for 'System.Runtime'.
   at NuGet.Manifest.ValidateDependencySets(IPackageMetadata metadata)
   at NuGet.Manifest.ReadFrom(Stream stream, IPropertyProvider propertyProvider, Boolean validateSchema)
   at NuGet.LocalPackage.ReadManifest(Stream manifestStream)
   at NuGet.ZipPackage.EnsureManifest(Func`1 manifestStreamFactory)
   at NuGet.ZipPackage..ctor(Stream stream)
   at NuGet.Server.Publishing.PackageService.CreatePackage(HttpContextBase context)
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)"

[Tasteful]

@maartenba Sorry, that stacktrace was from the 2.10 version and I also see that I referencing the wrong package, the one that causing problem when I retest is the https://dotnet.myget.org/F/dotnet-core/api/v2/package/runtime.any.System.Runtime.Extensions/4.0.10-rc3-23915

And when adding that to the packages-folder the app is crashing with the following in EventViewer.

Application: w3wp.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Xml.XmlException
   at MS.Internal.IO.Packaging.PartBasedPackageProperties.ParseCorePropertyPart(System.IO.Packaging.PackagePart)
   at MS.Internal.IO.Packaging.PartBasedPackageProperties..ctor(System.IO.Packaging.Package)
   at System.IO.Packaging.Package.get_PackageProperties()
   at NuGet.OptimizedZipPackage+<>c__DisplayClassa.<EnsurePackageFiles>b__9(System.IO.Packaging.PackagePart)
   at System.Linq.Enumerable+WhereEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]].MoveNext()
   at NuGet.OptimizedZipPackage.EnsurePackageFiles()
   at NuGet.OptimizedZipPackage.GetFilesBase()
   at NuGet.Server.PackageExtensions.IsSymbolsPackage(NuGet.IPackage)
   at NuGet.Server.Infrastructure.ServerPackageRepository.AddPackagesFromDropFolder()
   at NuGet.Server.Infrastructure.ServerPackageRepository.FileSystemChanged(System.Object, System.IO.FileSystemEventArgs)
   at System.IO.FileSystemWatcher.OnChanged(System.IO.FileSystemEventArgs)
   at System.IO.FileSystemWatcher.CompletionStatusChanged(UInt32, UInt32, System.Threading.NativeOverlapped*)
   at System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean)
   at System.Threading._IOCompletionCallback.PerformIOCompletionCallback(UInt32, UInt32, System.Threading.NativeOverlapped*)

Files in bin-folder

[embix]

I encountered the infamous ParseCorePropertyPart related XmlException as well:

<error xmlns="http://schemas.microsoft.com/ado/2007/08/dataservices/metadata">
    <code/>
    <message xml:lang="de-DE">
        Fehler beim Verarbeiten dieser Anforderung.
    </message>
    <innererror>
        <message>
            Unbekanntes Stammelement im Core Properties-Teil. Zeile 2, Position 2.
        </message>
        <type>
            System.Xml.XmlException
        </type>
        <stacktrace>
            bei MS.Internal.IO.Packaging.PartBasedPackageProperties.ParseCorePropertyPart(PackagePart part) 
            bei MS.Internal.IO.Packaging.PartBasedPackageProperties..ctor(Package package) 
            bei System.IO.Packaging.Package.get_PackageProperties() 
            bei NuGet.OptimizedZipPackage.<>c__DisplayClassa.<EnsurePackageFiles>b__9(PackagePart part) 
            bei System.Linq.Enumerable.WhereEnumerableIterator`1.MoveNext() 
            bei NuGet.OptimizedZipPackage.EnsurePackageFiles() 
            bei NuGet.OptimizedZipPackage.GetFilesBase() 
            bei NuGet.Server.PackageExtensions.IsSymbolsPackage(IPackage package) 
            bei NuGet.Server.Infrastructure.ServerPackageRepository.AddPackagesFromDropFolder() 
            bei NuGet.Server.Infrastructure.ServerPackageRepository.RebuildPackageStore() 
            bei NuGet.Server.Infrastructure.ServerPackageRepository.get_CachedPackages() 
            bei NuGet.Server.Infrastructure.ServerPackageRepository.GetPackages() 
            bei NuGet.Server.DataServices.PackageContext.get_Packages() 
            bei System.Data.Services.Providers.ReflectionServiceProvider.GetResourceContainerInstance(ResourceSet resourceContainer) 
            bei System.Data.Services.RequestUriProcessor.CreateFirstSegment(IDataService service, String identifier, Boolean checkRights, String queryPortion, Boolean isLastSegment, Boolean& crossReferencingUrl) 
            bei System.Data.Services.RequestUriProcessor.CreateSegments(String[] segments, IDataService service) 
            bei System.Data.Services.RequestUriProcessor.ProcessRequestUri(Uri absoluteRequestUri, IDataService service) 
            bei System.Data.Services.DataService`1.HandleRequest()
        </stacktrace>
    </innererror>
</error>

I am running NuGet.Server v2.11.2.0 on our test environment with the same packages we use in production (NuGet.Server v2.8.60717.93). The following packages caused that error:

• Argu.1.1.2.nupkg
• FsPickler.1.4.0.nupkg
• FsUnit.1.3.1.0.nupkg
• FsUnit.1.4.0.0.nupkg
• XPlot.GoogleCharts.1.2.1.nupkg
• XPlot.GoogleCharts.Deedle.1.2.1.nupkg
• XPlot.Plotly.1.2.1.nupkg
• (not reproducible: JetBrains.Platform.Standalone.Shell.102.0.20150724.141603.nupkg)

BTW: Would be cool, if the error message contained the “broken” nugpkg. Or aggregate that kind of error and give all broken packages at once. Or put them in a legacypackages folder and don’t cache them, so we can use the nuget server again. In fact, pushing such a fishy package could be considered a denial of service attack.

Update: all (reproducibly) affected packages have a “<version>Some(1.2.3)</version>” entry instead of “<version>1.2.3</version>” in their .psmdcp metadata file which may be caused by an older version of *paket.