Intro

AvantiPoint Packages is the evolution of the work done to port the BaGet project to .NET 5 and the special needs encountered when setting up Sponsor Connect. Over time it became clear that we really needed an In-House and Customer facing feed in addition to Sponsor Connect. Rather than reinvent the wheel this was broken off into something that was decoupled, and easy to reuse.

While AvantiPoint Packages is based on the BaGet project a lot of effort has gone into specializing the package feed for real world line of business applications. This could easily be used by industry partners like Infragistics, Telerik and Syncfusion, or it could be equally useful for your in-house development team. So what exactly were the problems that AvantiPoint Packages solves that you don't get in BaGet?

  1. Authentication. While many package feeds such as NuGet.org can operate just fine in the open for anyone to freely browse and download packages, many times it is important to secure the package feed so that only customers or internal developers can access your intellectual property.
  2. Authorization. Authentication may tell you that you know who the user is but it doesn't mean that the user should have access to do something. There are two ways that we provide hooks for Authorization.
    • We understand that users of a Package feed have 2 roles. That of a Package Consumer, and that of a Package Publisher
    • We understand that while a user may have package consumer rights they may not have rights to consumer all packages. For instance let's say you were a control vendor. The user may be a customer with a valid license, however that license may only be good for Xamarin and thus they should not have access to a package for WPF development.
  3. Lifecycle event hooks. Packages / Symbols are uploaded and downloaded. Sometimes it's nice to be able to hook into these events. Perhaps you want to confirm the package was published or that their account accessed the feed from a previously unrecognized IP address.
  4. Upstream Package Feeds. While BaGet does actually have some limited support for enabling upstream package feeds, this is limited to a single unauthenticated feed. AvantiPoint Packages provides you a way to register as many upstream sources as you would like, any or all of which can be authenticated or unauthenticated.