Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dotnet nuget verify command is not using the nuget.config #10774

Closed
erdembayar opened this issue Apr 15, 2021 · 5 comments · Fixed by NuGet/NuGet.Client#4396
Closed

dotnet nuget verify command is not using the nuget.config #10774

erdembayar opened this issue Apr 15, 2021 · 5 comments · Fixed by NuGet/NuGet.Client#4396
Assignees
Labels
Functionality:Signing Priority:1 High priority issues that must be resolved in the current sprint. Product:dotnet.exe Type:Bug

Comments

@erdembayar
Copy link
Contributor

Details about Problem

NuGet product used (dotnet.exe):

Product version: 5.9

Worked before? If so, with which NuGet version: n/a

Repro steps and/or sample project

Let we have broken/missing tag in nuget.config file, then nuget.exe check it before doing verify but dotnet.exe start doing verify action without checking it. I believe we should check integrity of nuget.config before doing any action since so many logics depend on it.

nuget59 verify -all ..\TestSigned\TestSigned.1.0.0.nupkg

NuGet.Config is not valid XML. Path: 'C:\Users\eryondon\source\repos\SigningDemo\nuget.config'.
The 'trustedSigners' start tag on line 15 position 4 does not match the end tag of 'trustedSigner'. Line 21, position 5.

dotnet nuget verify ..\TestSigned\TestSigned.1.0.0.nupkg

error: NU3018: The author primary signature found a chain building issue: UntrustedRoot: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
error:
error: Package signature validation failed.

Verbose Logs

@nkolev92
Copy link
Member

Related to #10773

@nkolev92 nkolev92 changed the title dotnet nuget verify command is not checking integrity of nuget.config file dotnet nuget verify command is not using the nuget.config Apr 19, 2021
@nkolev92 nkolev92 added this to the Sprint 2021-04 milestone Apr 19, 2021
@nkolev92 nkolev92 added the Category:Quality Week Issues that should be considered for quality week label Apr 19, 2021
@nkolev92 nkolev92 added Priority:1 High priority issues that must be resolved in the current sprint. and removed Priority:2 Issues for the current backlog. Category:Quality Week Issues that should be considered for quality week labels Nov 4, 2021
@nkolev92 nkolev92 added this to the Sprint 2021-12 milestone Nov 4, 2021
@erdembayar erdembayar self-assigned this Nov 5, 2021
@erdembayar
Copy link
Contributor Author

@aortiz-msft @nkolev92 @kartheekp-ms
Do I need to address #10011 issue too here? If no then I cost 1, if yes then I cost 3 just in case.

@kartheekp-ms
Copy link
Contributor

kartheekp-ms commented Jan 5, 2022

Do I need to address #10011 issue too here? If no then I cost 1, if yes then I cost 3 just in case.

IMHO, I think we should address both because we try to maintain feature parity between nuget.exe and dotnet.exe.

@nkolev92
Copy link
Member

nkolev92 commented Jan 5, 2022

I'd try to fix both.

Given that it's a problem for both, my guess is that the issue is in the shared code anyways.

@erdembayar
Copy link
Contributor Author

I'll try to address too 10111. Considering I need to add tests for both nuget verify and dotnet nuget verify and need to learn about verify code increased costing to 4.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Functionality:Signing Priority:1 High priority issues that must be resolved in the current sprint. Product:dotnet.exe Type:Bug
Projects
None yet
Development

Successfully merging a pull request may close this issue.

5 participants