[GH-ISSUE #8144] [Feature] Inspect NuGet `.nupkg` packages and dependency metadata as read-only Evidence #4689

New issue

Open

opened 2026-10-31 00:52:29 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:52:29 +00:00

Owner

Originally created by @jayykernel on GitHub (Oct 30, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8144

Before submitting

I searched the open and closed issues and pull requests for a related proposal.
I understand the contribution scope must be reviewed before integration; open questions are welcome here.
This request contains no credentials or private package contents.

Area

Evidence, artifacts, or reconstruction

Problem

REA's managed-runtime/package umbrella (#42) identifies NuGet as an important .NET package ecosystem, but I could not find a focused, read-only workflow for inspecting a supplied .nupkg and returning its package-level facts as structured Evidence. A NuGet package contains more than assemblies: its nuspec metadata, target-framework asset groups, dependency declarations, build/analyzer assets and package content determine how consumers actually receive the code.

Use cases

Inspect a third-party NuGet package before adding it to a project.
Understand which assemblies and assets are selected for a target framework.
Review declared dependencies and version ranges without restoring packages or contacting feeds.
Compare package versions and identify changes in shipped assemblies, resources or dependency declarations.

Desired outcome

Add a focused inspector for caller-provided .nupkg files. Parse the ZIP container and .nuspec metadata, inventory framework-specific assets and dependency groups, and emit typed Evidence with exact input identity and explicit unsupported/ambiguous cases. This should be a scoped child of #42, not a new package-management or restore system.

Acceptance criteria

Reads package identity, version, authors/description where present, license expression/file references, repository metadata and declared dependency groups from the nuspec.
Inventories assemblies, native assets, analyzers, build/buildTransitive assets, content files and framework-specific paths without loading or executing them.
Reports target-framework groups and dependency version ranges as declarations; does not claim to perform NuGet's full restore-time asset selection unless that behavior is explicitly implemented and tested.
Handles malformed archives, missing/ambiguous nuspec files, duplicate paths and invalid metadata with typed errors or explicit limitations.
Performs no network access, package restore, installation or code execution.
Includes representative fixtures for multi-target packages, dependency groups, native assets and malformed packages, with deterministic CLI/MCP Evidence tests.
Documents that package metadata is publisher-provided and does not establish package safety.

This narrows the NuGet/package-ecosystem direction in #42 to one independently implementable read-only artifact inspector. It does not duplicate managed IL decompilation or dependency resolution.

Originally created by @jayykernel on GitHub (Oct 30, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8144 ### Before submitting - [x] I searched the open and closed issues and pull requests for a related proposal. - [x] I understand the contribution scope must be reviewed before integration; open questions are welcome here. - [x] This request contains no credentials or private package contents. ### Area Evidence, artifacts, or reconstruction ### Problem REA's managed-runtime/package umbrella (#42) identifies NuGet as an important .NET package ecosystem, but I could not find a focused, read-only workflow for inspecting a supplied `.nupkg` and returning its package-level facts as structured Evidence. A NuGet package contains more than assemblies: its nuspec metadata, target-framework asset groups, dependency declarations, build/analyzer assets and package content determine how consumers actually receive the code. ### Use cases - Inspect a third-party NuGet package before adding it to a project. - Understand which assemblies and assets are selected for a target framework. - Review declared dependencies and version ranges without restoring packages or contacting feeds. - Compare package versions and identify changes in shipped assemblies, resources or dependency declarations. ### Desired outcome Add a focused inspector for caller-provided `.nupkg` files. Parse the ZIP container and `.nuspec` metadata, inventory framework-specific assets and dependency groups, and emit typed Evidence with exact input identity and explicit unsupported/ambiguous cases. This should be a scoped child of #42, not a new package-management or restore system. ### Acceptance criteria - Reads package identity, version, authors/description where present, license expression/file references, repository metadata and declared dependency groups from the nuspec. - Inventories assemblies, native assets, analyzers, build/buildTransitive assets, content files and framework-specific paths without loading or executing them. - Reports target-framework groups and dependency version ranges as declarations; does not claim to perform NuGet's full restore-time asset selection unless that behavior is explicitly implemented and tested. - Handles malformed archives, missing/ambiguous nuspec files, duplicate paths and invalid metadata with typed errors or explicit limitations. - Performs no network access, package restore, installation or code execution. - Includes representative fixtures for multi-target packages, dependency groups, native assets and malformed packages, with deterministic CLI/MCP Evidence tests. - Documents that package metadata is publisher-provided and does not establish package safety. ### Related work This narrows the NuGet/package-ecosystem direction in #42 to one independently implementable read-only artifact inspector. It does not duplicate managed IL decompilation or dependency resolution.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4689

No description provided.

Rows
Columns

[GH-ISSUE #8144] [Feature] Inspect NuGet .nupkg packages and dependency metadata as read-only Evidence #4689