Why are some versions of 'packages' in the NuGet repo, but not here

[nigellh]

Hi

I investigate open source software our development teams use to ensure that it is being used correctly as per the license and copyright. I was looking at the following NuGet packages:

awssdk.core 3.7.0.3
awssdk.core 3.7.107.8
awssdk.core 3.7.107.11
awssdk.dynamodbv2 3.7.0.3
awssdk.s3 3.7.0.32
awssdk.s3 3.7.106.1
awssdk.s3 3.7.0.28
awssdk.s3 3.7.107.2
awssdk.s3control 3.7.6.73
awssdk.simplenotificationservice 3.7.1.7
awssdk.sqs 3.7.0.8

All of them and their versions can be found on www.nuget.org. For example - https://www.nuget.org/packages/AWSSDK.Core/3.7.0.3

The entry on NuGet points me to the aws-sdk-net repo here on Github and I can find the relevant code for these in it. But I cannot find any of these versions of the SDK listed.

That appears to mean I no longer have access to the original source for them.

Why are these versions removed from the SDK, but not from the NuGets that they apply to in that repo?

No criticism, just trying to understand and figure out how we easily get access to the original source code of these NuGets.

Many thanks.

[normj]

By not in the SDK do you mean the version numbers for the service packages are not found in the change log? If we do a core package update and we want all of the service packages to be updated to require the latest code we will have something like the following saying all service packages are updated. I know it does make it harder to find the specific version but the change log would grow huge if we listed all 400+ service packages every time we did a core update.

• Core 3.7.500.20
  • Updating endpoints.json file.
  • All services packages updated to require new Core

[nigellh]

@normj Thanks for the reply/ If I use the drop down on the code page to view the tags in the SDK, none of the above tags show. e.g. 3.7.0.3. Perhaps Core is not the best example. Using. awssdk.simplenotificationservice 3.7.1.7

I got the the NuGet repo and find - https://www.nuget.org/packages/AWSSDK.SimpleNotificationService

On there I can find that version - https://www.nuget.org/packages/AWSSDK.SimpleNotificationService/3.7.1.7

On that page is (Applies to the generic package page too):

Selecting Project Website takes me to https://github.com/aws/aws-sdk-net/

I find the code for this NuGet here - https://github.com/aws/aws-sdk-net/tree/main/sdk/src/Services/SimpleNotificationService

But if I search for this version in the tags I get

To create a proper record of this package / version in our system, we need to include the download location to the source code of the package. The download location on the NuGet page is the runtime version, not the source.

I am guessing that for some reason, version 3.7.1.7 has been removed from Github, but not the NuGet repo. Trying to understand why or what I am missing.

Many thanks, N

[dscpinheiro]

It's probably a bit confusing, but the tags on this GitHub repository are the SDK product version, not the individual package or Core versions (and as Norm mentioned each product version can include all packages).

So for example version 3.7.301.0 of SimpleNotificationService included support for marking phone numbers as sensitive inputs, and that was released in https://github.com/aws/aws-sdk-net/blob/main/changelogs/SDK.CHANGELOG.ALL.md#377500-2024-02-16-1921-utc. I can then inspect the SDK code for that 3.7.750.0 tag: https://github.com/aws/aws-sdk-net/tree/3.7.750.0

I don't know if there's an easy way to automate what you're trying to do, but the source code from previous versions are not removed from GitHub.