C#: Preserve semantics of reachability for default feeds when using [mono] nuget.

Author: michaelnebel

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FeedManager.cs

@@ -17,7 +17,6 @@ internal sealed partial class FeedManager : IDisposable
         private readonly IFileProvider fileProvider;
         private readonly DependencyDirectory emptyPackageDirectory;
         private readonly ImmutableHashSet<string> privateRegistryFeeds;
-        private readonly ImmutableHashSet<string> defaultFeeds;
         private readonly IFeedManagerIO feedManagerIo;
 
         /// <summary>
@@ -75,6 +74,12 @@ internal sealed partial class FeedManager : IDisposable
 
         private readonly Lazy<ImmutableHashSet<string>> lazyReachableDefaultFeeds;
 
+        /// <summary>
+        /// Gets the list of default NuGet feeds that are configured in the environment.
+        /// This is either the public NuGet feed or a set of feeds specified by the environment.
+        /// </summary>
+        public ImmutableHashSet<string> DefaultFeeds { get; init; }
+
         /// <summary>
         /// Gets the list of reachable default NuGet feeds.
         /// </summary>
@@ -88,7 +93,7 @@ public FeedManager(ILogger logger, IDotNet dotnet, IDependabotProxy? dependabotP
             this.feedManagerIo = feedManagerIo;
             privateRegistryFeeds = dependabotProxy?.RegistryURLs ?? [];
             HasPrivateRegistryFeeds = privateRegistryFeeds.Count > 0;
-            defaultFeeds = dependabotProxy?.RegistryBaseURLs.Any() == true
+            DefaultFeeds = dependabotProxy?.RegistryBaseURLs.Any() == true
                 ? dependabotProxy.RegistryBaseURLs
                 : [PublicNugetOrgFeed];
             emptyPackageDirectory = new DependencyDirectory("empty", "empty package", logger);
@@ -107,7 +112,7 @@ public FeedManager(ILogger logger, IDotNet dotnet, IDependabotProxy? dependabotP
                 var reachableFallbackFeeds = GetReachableFallbackNugetFeeds();
                 return reachableFallbackFeeds.ToImmutableHashSet();
             });
-            lazyReachableDefaultFeeds = new Lazy<ImmutableHashSet<string>>(() => CheckSpecifiedFeeds(defaultFeeds));
+            lazyReachableDefaultFeeds = new Lazy<ImmutableHashSet<string>>(() => CheckSpecifiedFeeds(DefaultFeeds));
         }
 
         public FeedManager(ILogger logger, IDotNet dotnet, IDependabotProxy? dependabotProxy, IFileProvider fileProvider)
@@ -311,8 +316,8 @@ private List<string> GetReachableFallbackNugetFeeds()
             var fallbackFeeds = EnvironmentVariables.GetURLs(EnvironmentVariableNames.FallbackNugetFeeds).ToHashSet();
             if (fallbackFeeds.Count == 0)
             {
-                fallbackFeeds.UnionWith(defaultFeeds);
-                logger.LogInfo($"No fallback NuGet feeds specified. Adding default feeds: {string.Join(", ", defaultFeeds.OrderBy(f => f))}");
+                fallbackFeeds.UnionWith(DefaultFeeds);
+                logger.LogInfo($"No fallback NuGet feeds specified. Adding default feeds: {string.Join(", ", DefaultFeeds.OrderBy(f => f))}");
 
                 var shouldAddNugetConfigFeeds = EnvironmentVariables.GetBooleanOptOut(EnvironmentVariableNames.AddNugetConfigFeedsToFallback);
                 logger.LogInfo($"Adding feeds from nuget.config to fallback restore: {shouldAddNugetConfigFeeds}");

csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs

@@ -165,15 +165,18 @@ private bool TryRestoreNugetPackage(string packagesConfig)
 
                 List<string> sourcesArgument = [];
                 var feedsToUse = feedManager.FeedsToUse(packagesConfig).ToList();
-                var useDefaultFeeds = feedsToUse.Count == 0 && feedManager.ReachableDefaultFeeds.Count > 0;
+                var defaultFeeds = feedManager.CheckNugetFeedResponsiveness
+                    ? feedManager.ReachableDefaultFeeds
+                    : feedManager.DefaultFeeds;
+                var useDefaultFeeds = feedsToUse.Count == 0 && defaultFeeds.Count > 0;
 
                 // Explicitly construct the sources to be used for the restore command when checking feed
                 // responsiveness, using private registries, or falling back to default feeds.
                 if (feedManager.CheckNugetFeedResponsiveness || feedManager.HasPrivateRegistryFeeds || useDefaultFeeds)
                 {
                     if (useDefaultFeeds)
                     {
-                        feedsToUse.AddRange(feedManager.ReachableDefaultFeeds);
+                        feedsToUse.AddRange(defaultFeeds);
                     }
                     var restoreFeeds = feedManager.RestoreFeeds(feedsToUse);
                     sourcesArgument = restoreFeeds.SelectMany<string, string>(feed => ["-Source", feed]).ToList();

csharp/extractor/Semmle.Extraction.Tests/FeedManager.cs

@@ -205,9 +205,13 @@ public void TestDefaultFeeds1()
             var feedManager = MakeFeedManager();
 
             // Execute
+            var defaultFeeds = feedManager.DefaultFeeds;
             var reachableDefault = feedManager.ReachableDefaultFeeds;
 
             // Verify
+            Assert.Equal([
+                "https://api.nuget.org/v3/index.json"
+            ], defaultFeeds);
             Assert.Equal([
                 "https://api.nuget.org/v3/index.json"
             ], reachableDefault);
@@ -225,10 +229,15 @@ public void TestDefaultFeeds2()
             var feedManager = new FeedManager(logger, dotnet, dependabotProxy, fileProvider, feedManagerIo);
 
             // Execute
+            var defaultFeeds = feedManager.DefaultFeeds;
             var reachableDefault = feedManager.ReachableDefaultFeeds;
             var reachableFallback = feedManager.ReachableFallbackFeeds;
 
             // Verify
+            Assert.Equal([
+                "https://example.com/base1",
+                "https://example.com/base2"
+            ], defaultFeeds);
             Assert.Equal([
                 "https://example.com/base2"
             ], reachableDefault);