Search code examples
nugetnuget-packagezlib

Where are the source of the Nuget package for zlib?


I've found a bug in the Nuget native package zlib version 1.2.8.8. I might know how to fix it, but I fail to see where the sources of the package are located or even who packages it. That really clashes with my habits working with open-source software.

Where are the source of the Nuget package for zlib?


Solution

  • The package doesn't contain a link to its source, meaning the package authors decided not to share its location (possibly because it's not in a public location). On NuGet.org's package details page, which you linked to, you can see that "Microsoft" and "visualcpp" are listed under the "owners" header. They are the ones that packaged it.

    However, on the package details page, it says that it was last updated in May 2015. Also notice that the top of the page has a yellow banner saying the package is unlisted and the version history doesn't list any versions at all. This means the package owners have unlisted all versions of the package (so how did you even find it? It shouldn't have come up in search results), giving a strong hint that they don't want to maintain the package any more. Another reason I think it's unlikely they continue to maintain the NuGet packages is that zlib appears to have at least 4 CVEs in 2017 (note, 2 years after the last update to the NuGet package), and there weer updates to zlib, which presumably fixed the issues, but the package on nuget.org were not updated. I don't have the motivation to check if the CVEs are actually serious, but I hope that you do. Maybe the packages on nuget.org are no longer "safe" to use. In any case, if you really want, you can try using the "contact owners" link on nuget.org and see if they respond.

    Microsoft's C++ team created another package manager, vcpkg, which might be more suitable for you to use, although I know nothing about it other than the name and that it exists. Maybe you'll have better luck sourcing zlib from there, particularly newer versions, rather than NuGet.