Dotnet restore nuget packages at build

Hi!

On Fedora there is no build time network access according to Fedora Packaging Guidelines :: Fedora Docs.
So how should one resolve dotnet nuget packages in a c# project? I do this for other platforms in the build script by running dotnet restore, but that downloads the nuget packages. How should this be done on Fedora?

My spec file: bookmark-dlp/bookmark-dlp.spec at unstable · Neurofibromin/bookmark-dlp · GitHub

Thanks for any advice!

Typically you would package, as rpms, the dependencies as well as your app.

There at least two reasons to not allow downloads.
The build is no longer reproducible as the downloaded content can change.
You open up to supply chain attacks.

  1. I will second to what Barry wrote. The process is called unbundling. You package the dependencies first and the BuildRequire them in your spec file so they are available in build time.

  2. If that is too much work for you, you can build the package in Copr https://copr.fedorainfracloud.org/ where you can tick “enable network access”. Projects and packages does not need to follow Packaging Guideliness and can be lower quality compared to main Fedora Linux.

Thank you, I’ll give Copr a try.