[SOLVED] NuGet.Config packageSources appears to ignore <clear /> since 2.6

NuGet.Config packageSources appears to ignore <clear /> since 2.6

Summary: We have a script that runs nuget.exe from the command line within our solutions repository. How can we configure NuGet to only use a specific package source (and not anything listed in the machine-wide or users configuration)?

From the NuGet documentation, one can read the following concerning chaining multiple config files:

NuGet first loads NuGet.config from the default location, then loads any file named NuGet.config starting from the root of the current drive and ending in the current directory. (...) When <clear /> is present for a given node, previously defined configuration items for this node are ignored.

At the root of our repository, we have added the following NuGet.Config file to make sure we only fetch NuGet packages from out own internal NuGet repository:

<!-- C:\repository_root_path\NuGet.Config -->
<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageRestore>
    <add key="enabled" value="True" />
  </packageRestore>
  <packageSources>
    <clear /> <!-- ensure only the sources defined below are used -->
    <add key="Internal package source" value="\\network_fileshare\nuget_packages\" />
  </packageSources>
  <disabledPackageSources />
  <activePackageSource>
    <add key="Internal package source" value="\\network_fileshare\nuget_packages\" />
  </activePackageSource>
</configuration>

The problem we're experiencing now, is that this yields different results depending on which version of NuGet.exe we're running. To debug, I've downloaded three separate versions of NuGet.exe and put them all in the .nuget-folder in our solution. The result is as follows:

C:\repository_root_path>Source\.nuget\nuget_2.5.40416.exe sources
Registered Sources:

  1.  Internal package source [Enabled]
      \\network_fileshare\nuget_packages\

C:\repository_root_path>Source\.nuget\NuGet_2.6.40619.exe sources
Registered Sources:

  1.  NuGet official package source [Enabled]
      https://nuget.org/api/v2/
  2.  Internal package source [Enabled]
      \\network_fileshare\nuget_packages\

C:\repository_root_path>Source\.nuget\nuget_2.7.40808.exe sources
Registered Sources:

  1.  NuGet official package source [Enabled]
      https://nuget.org/api/v2/
  2.  Internal package source [Enabled]
      \\network_fileshare\nuget_packages\
  3.  https://www.nuget.org/api/v2/ [Disabled]
      https://www.nuget.org/api/v2/

So the question is: has there been introduced a bug in NuGet between version 2.5 and 2.6 so that the <clear /> element is ignored, or is there something wrong in the NuGet.Config file we have in our solution root?

Solution

This has been confirmed as a bug in NuGet. The fix is assigned to release 2.7.2.