A tip about package source mapping feature is displayed in VS when the repo has only one package source

[kartheekp-ms]

NuGet Product Used

Visual Studio Package Management UI

Product Version

VS Internal preview version

Worked before?

No response

Impact

Other

Repro Steps & Context

1. Create a sample Console application
2. Add a NuGet.Config file to that has only nuget.org as package source to the sample application created above.

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
  </packageSources>
</configuration>

3. Right click on the sample project and selected Manage NuGet Packages..
4. In the browse tab, select any package.
5. In Package details pane on the right side notice the information icon that says Package source mapping is off.

I think it is not required to configure package source mapping when the repo has only feed configured. The docs also suggest that Package Source Mapping is a tool that can be used to improve your supply chain security, especially if you use a mix of public and private package sources.

Verbose Logs

No response

[donnie-msft]

Could you use the DCR template and that way you can propose an alternative for this scenario? If customers don't opt-in to source mapping when there's 1 source, then when adding another package source, they would have to retroactively map everything at that point. It's an option but I don't think we have community input suggesting that yet. If folks want to upvote/comment here that would be a good signal that the "Off" message is intrusive and they'd prefer to opt-in later.