RDK0009 — Incomplete symbol package

Severity: warning · Command: redecker inspect

A package publishes symbols, but they do not cover everything it ships.

Shipping no symbols is fine

This rule says nothing about a package with no .snupkg. That is a choice, and a common one — of 232 sampled packages shipping lib/ assemblies, 174 publish no symbols at all.

What it reports is the partial case. Of the 58 that do publish symbols, 57 cover every assembly they ship. Complete coverage is the convention, so a gap is a real signal rather than a matter of taste — almost always a multi-targeting build where one leg did not produce a PDB, or a lib/ folder added without the packaging catching up.

Satellite assemblies are excluded

The single "partial" package in that sample was Microsoft.VisualStudio.Validation, whose 26 uncovered assemblies are all satellites:

lib/net8.0/de/Microsoft.VisualStudio.Validation.resources.dll
lib/net8.0/zh-Hans/Microsoft.VisualStudio.Validation.resources.dll

Those correctly have no PDBs — a resource assembly has no code to step through. Only assemblies sitting directly in lib/<framework>/ are considered, which excludes locale folders by construction, and *.resources.dll is excluded by name as well.

Assemblies outside lib/ are ignored entirely. A tool package bundles its dependencies, and requiring a PDB for somebody else's Newtonsoft.Json.dll would make the rule useless on every tool package ever published.

Where it runs

Against nuget.org, symbols are fetched from the symbol endpoint — they are not on the flat container, where the obvious URL 404s:

redecker inspect Serilog --to 4.2.0

Against your own output, the .snupkg is picked up from beside the .nupkg, which is exactly where dotnet pack leaves it. No network needed:

dotnet pack -c Release
redecker inspect --file ./artifacts/packages/Contoso.Widgets.1.0.0.nupkg

Example

warning RDK0009: the symbol package covers 1 of 2 shipped assemblies
    lib/net472/Contoso.Widgets.dll has no matching .pdb in the symbol package. Consumers stepping
    into it get no source. Publishing no symbols at all is a choice; publishing some is usually an
    oversight — of 58 sampled packages that publish symbols, 57 cover everything they ship.

Why a warning

Missing symbols degrade debugging. They do not break a build, fail an install, or silently disable an analyzer, which is what every other rule in this set describes. Severity should mean what it says.

Not in the corpus sweep

The sweep runs rules that need only the package. This one needs a second archive per package, which would double the traffic against nuget.org for every run. The evidence above came from a one-off survey of 232 packages instead.