About redesign a cross platfrom apikey and password authentication in nuget.config

[John0King]

background

Today, we can only use ClearTextPassword in nuget.config , for a team that share a private nuget feed without manully input password.
but it'll leak the password in git. and apikey in nuget.config depends on WinDPApi which it's not cross platfrom.

my idea

my idea is that let the nuget system understand the environment variables and the dotnet secret.

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="nuget" value="https://api.nuget.org/v3/index.json" />
    <add key="myfeed" value="http://mynugetfeed/packages/nuget/index.json" allowInsecureConnections="true" />
  </packageSources>
  <packageSourceCredentials>
    <gitlab>
      <add key="Username" value="$(env:myfeed_username)" /> <!--  read from environment variables -->
      <add key="ClearTextPassword" value="$(scret:myfeed_password)" /><!--  read from dotnet secret -->
      <add key="ApiKey" value="$(scret:myfeed_apikey)" /><!-- we can choose to use  (username + password ) or (apikey)  -->
    </gitlab>
  </packageSourceCredentials>
</configuration>

for set those key , the default way is to use "dotnet secret" to store the value var CLI

dotnet nuget credentials --source myfeed --type secret  --api-key AbcDef
# or
dotnet nuget credentials --source myfeed --type secret  --username user --password <password>

what guid should nuget use ?

I think for nuget there should be a fixed GUID for dotnet secret