Visug - organize your chickens - nuget for the enterprise

www.visug.be

NuGet for the Enterprise

Organize your chickens

www.visug.be

Who are we?

• Maarten Balliauw• Antwerp, Belgium• www.realdolmen.com • Focus on web

– ASP.NET, ASP.NET MVC, PHP, Azure, …– MVP Windows Azure (formerly ASP.NET)

• http://blog.maartenballiauw.be • @maartenballiauw

www.visug.be

Who are we?

• Xavier Decoster• Antwerp, Belgium• www.realdolmen.com • Focus on web/ALM

– Visual Studio, TFS, Scrum, ...– Silverlight, ASP.NET, ASP.NET MVC, …

• http://www.xavierdecoster.com• @xavierdecoster

www.visug.be

Agenda

• Chickens?• NuGet• Scenarios

– Host your own NuGet repository– Continuous (Package) Integration– (Ab)using NuGet

• Conclusion

www.visug.be

Welcome to Dependency Hell

“A term for the frustration of software users who have installed software packages which have dependencies on specific versions of other software packages.” Source: Wikipedia

www.visug.be

Cause and Effect

• Reinventing the wheel– We don’t need that dependency– “If they can do it, we can do it, but better” What happened to reuse of components?

• Marketing does the versioning– People are waiting for v2 to buy– Let’s call it v4 Platform Update SP3

November Edition KB2348063 RTW Refresh We lost ownership of AssemblyVersion ?

www.visug.be

Package Management

• NuGet to the Rescue!

• Simple concept– Find Packages– (Re)Use Packages– Produce Packages

“NuGet is a Visual Studio extension that makes it easy to install and update open source libraries and tools in Visual Studio.”

www.visug.be

Semantic Versioning

• Think about your versioning! (semver.org)

– Always specify lowerbound– Use a version range (lowerbound +

upperbound) when versioning of package you depend on is messed up

Major Breaking changes

Minor Backwards compatible API additions/changes

Patch Bugfixes not affecting the API

www.visug.be

Advanced usage scenarios

• Host your own NuGet repository• Continuous (Package) Integration• (Ab)using NuGet

www.visug.be

HOSTING YOUR OWN REPOSITORY

www.visug.be

Hosting your own repository

• NuGet = public feed– Privacy– Intellectual property

• NuGet maintained by package authors– Author removes v1.0.45 and you depend

on it

www.visug.be

Solutions

• Folder / File share• Orchard Gallery (or NuGet Gallery)• NuGet.Server package• MyGet

www.visug.be

NUGET.SERVER DEMOInstall-Package NuGet.Server

www.visug.be

NuGet.Server limitations

• Only 1 feed per installation• No UI: up to you to build it• No granular security: only 1 API-key

for entire feed• Conclusion: requires you to develop if

you want something more useful

www.visug.be

Meet MyGet

• www.myget.org• NaaS

– Register and off you go! (no dev)

• Supports Enterprise scenarios– Granular security– Package mirroring

www.visug.be

MYGET DEMOLog in to www.myget.org and get started

www.visug.be

CONTINUOUS (PACKAGE) INTEGRATION

www.visug.be

Typical source control...

• Contains /References (if you are lucky)– ...and also Project/_bin_deployable_assemblies

– ...and also /References/old– ...and also /..././../.././References

• Usually references GAC-ed assemblies

www.visug.be

Dependencies

• Software has dependencies. Deal with it.

• But are those YOUR intellectual property?– YOUR reason to build software?– YOUR product?

• No. They are dependencies. And they don’t belong in source control.

www.visug.be

Continuous (Package) Integration

• Can I get rid of all these referenced assemblies duplicated all-over my source control system?Yes!

• Do I need to install and maintain NuGet on all my build agents?No!

www.visug.be

NUGETPOWERTOOLS DEMO

Organize your build chickens!

www.visug.be

3rd parties don’t belong in your SCM

• Replace them with NuGet packages• Commit packages/repositories.config

files• Use NuGetPowerTools Enable-PackageRestore

• Set package-source location(s)(NuGet.settings.targets in $(SolutionDir)\.nuget folder)

www.visug.be

Problem!

• NuGet feed is subject to change...– PackageSource msbuild property to the

rescue

• Now what...– Host your own feed and mirror packages– Or use MyGet for that

www.visug.be

Organize your chickens

• Feed structuring– Scoped by quality: Build, QA, Production,

…– Scoped by audience: public, restricted

access– Other:

• Scoped by product version, milestone…• Scoped by target platform

www.visug.be

(AB)USING NUGET

www.visug.be

Guidance

• Publishing a package brings great responsibility– Breaking changes in your packages

should be versioned accordingly!– Consumers might choose to no longer

consume any packages you published

www.visug.be

Guidance

• Package Integration ≠ Integration Testing– CI builds reflect output of source control

input– Same input always produces same

output

Do not auto-update packages during automated builds

www.visug.be

(Ab)using NuGet?

• Change of perspective

NuGet is a package managerNuGet is a protocol for distributing packages

www.visug.be

EXTENDING NUGETScaffolding, CmdLets, Plug-ins, …

www.visug.be

Automate deployments

• Build results in .nupkg• Octopus deploys to its tentacles

– Test tentacles– Staging tentacles– Production tentacles

• www.octopusdeploy.com

www.visug.be

www.visug.be

Chocolatey

• NuGet– developer library packages

• Chocolatey– applications and tools packager– “yum” or “apt-get” for Windows

• www.chocolatey.org

www.visug.be

CHOCOLATEY DEMONuGet desert

www.visug.be

Orchard / WebMatrix / …

• NuGet not bound to VS• Orchard CMS: modules & themes• WebMatrix: install page helpers on

the fly• Your app: offer plugins through a

repo

www.visug.be

CONCLUSION

www.visug.be

• Dependencies & people are chickensDeal with them! NuGet can help

• Set up your own NuGet repository for various reasons

• Continuous package integration

• NuGet is a package managerNuGet is a protocol

Conclusion

www.visug.be

THANK YOU!Any questions?

http://blog.maartenballiauw.be @maartenballiauw

http://www.xavierdecoster.com@xavierdecoster