Repository navigation
Package signing validation fails #781
Description
Describe the bug
Attempting a fresh install of the tool yields a signing error:
> dotnet tool install -g Microsoft.Web.LibraryManager.Cli
Failed to validate package signing.
Verifying Microsoft.Web.LibraryManager.Cli.2.1.175
Signature type: Author
Subject Name: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
SHA256 hash: AA12DA22A49BCE7D5C1AE64CC1F3D892F150DA76140F210ABD2CBFFCA2C18A27
Valid from: 9/29/2020 7:00:00 PM to 10/5/2023 7:00:00 AM
Signature type: Repository
Subject Name: CN=NuGet.org Repository by Microsoft, O=NuGet.org Repository by Microsoft, L=Redmond, S=Washington, C=US
SHA256 hash: 5A2901D6ADA3D18260B9C6DFE2133C95D74B9EEF6AE0E5DC334C8454D1477DF4
Valid from: 2/15/2021 6:00:00 PM to 5/15/2024 6:59:59 PM
warn : NU3018: The author primary signature found a chain building issue: RevocationStatusUnknown: An incomplete certificate revocation check occurred.
error: NU3037: The author primary signature validity period has expired.
error: NU3028: The author primary signature's timestamp found a chain building issue: ExplicitDistrust: The trust setting for this policy was set to Deny.
warn : NU3018: The repository countersignature found a chain building issue: RevocationStatusUnknown: An incomplete certificate revocation check occurred.
error: NU3037: The repository countersignature validity period has expired.
error: NU3028: The repository countersignature's timestamp found a chain building issue: ExplicitDistrust: The trust setting for this policy was set to Deny.
Package signature validation failed.To Reproduce
On a new machine run the global tool install command: dotnet tool install -g Microsoft.Web.LibraryManager.Cli
Expected behavior
Running a global install, dotnet tool install -g Microsoft.Web.LibraryManager.Cli, results in the tool being available
Activity
jimmylewis commentedon Feb 23, 2025
Not a new machine but I uninstalled and removed it from my local package cache first (though it doesn't look like tool installation uses the package cache). Here's what I get:
jimmylewis commentedon Mar 25, 2025
I see this has gotten a couple upvotes, but it doesn't repro for me. Can someone share some additional details about their environment, or possibly a nuget.config file where this occurs, or possibly the output of
dotnet nuget trust listin the same directory? Trying to figure out if there's a setting that enables this behavior.