Improve detection of nuget source URL from Artifactory

[fgreinacher]

Tell us more.

Renovate currently tries to derive the source URL of a NuGet dependency via the PackageBaseAddress resource, see https://github.com/renovatebot/renovate/blob/main/lib/modules/datasource/nuget/v3.ts#L203-L214.

This works well for packages from NuGet.org, but fails for Artifactory (and maybe others) because it does not provide this resource.

This issue has just recently been solved by Dependabot and I suggest we extend the current logic in a similar way.

I have set up a reproduction at https://github.com/fgreinacher/renovate-artifactory-source-url:

• PR using NuGet.org correctly shows the source URL and the changelog: Update dependency Newtonsoft.Json to v13.0.3 fgreinacher/renovate-artifactory-source-url#3
• PR using Artifactory is missing both: Update dependency Newtonsoft.Json to v13.0.3 - autoclosed fgreinacher/renovate-artifactory-source-url#2

[rarkins]

Reproduction forked to https://github.com/renovate-reproductions/28041 (and renovate.json syntax error fixed)

[fgreinacher]

Thanks 😀 Just be aware that this uses a 30 day trial Artifactory that I have just set up.

[rarkins]

Dependabot is not open source so we should not use their code in any way, ideally solve it independently/from first principles.

@fgreinacher is the github source repo contained in any of the JSON responses from JFrog?

Or is the idea to assume that the sourceUrl for package X on an alternative host is the same sourceUrl as package X on the default registry?

[rarkins]

We don't do etag type caching, which would require downloading it anytime the nuspec changed, but instead "once you've checked the nuspec for a sourceUrl then don't check again for a month"

[fgreinacher]

I'll send a PR so that we discuss this.

Do you want to make a feature issue out-of-this discussion @rarkins @viceice?

[rarkins]

Yes I was planning to, thanks

[viceice]

We don't do etag type caching, which would require downloading it anytime the nuspec changed, but instead "once you've checked the nuspec for a sourceUrl then don't check again for a month"

that file is version specific, so on every new release we need to fetch again.

[rarkins]

I would still choose to cache the result for a long period, because it's unlikely to change

[fgreinacher]

This is the upstream Artifactory ticket: https://jfrog.atlassian.net/browse/RTFACT-26507

We gave it a little push from our Artifactory team, let's see how it goes.