NullReferenceException in dotnet workload install when a feed URL contains leading whitespace

[nkolev92]

@rmarinho commented on Tue, 13 May 2025 12:23:09 GMT

NuGet Product Used

dotnet.exe

Product Version

9.0.203

Worked before?

No response

Impact

It bothers me. A fix would be nice

Repro Steps & Context

If we have a nuget.config and we pasted a wrong link for a feed, for example with an extra space. the nuget client seems to fail with a NRE , A better exception should be given to developers to help fix the issue.

For example trying to install a workload and specifying a nuget.config to use

sudo dotnet workload install maui --version 10.0.100-preview.4.25262.2 --configfile ~/.config/NuGet/NuGet.Config --verbosity diag

Nuget.config with error extra space on dotnet10-preview4

<configuration>
  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
    <add key="dotnet10-preview4" value=" https://pkgs.dev.azure.com/dnceng/public/_packaging/10.0.100-preview.4.25258.110-shipping/nuget/v3/index.json" protocolVersion="3" />
    <add key="dotnet10-workloads" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet10-workloads/nuget/v3/index.json" protocolVersion="3" />
    <add key="dotnet10" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet10/nuget/v3/index.json" protocolVersion="3" />
    <add key="net9" value="https://pkgs.dev.azure.com/dnceng/internal/_packaging/9.0.300-rtm.25252.6-shipping/nuget/v3/index.json" protocolVersion="3" />
  </packageSources>
  <packageSourceCredentials>
    <net9>
      <add key="Username" value="rumar@microsoft.com" />
      <add key="ClearTextPassword" value="" />
    </net9>
  </packageSourceCredentials>
</configuration>

Verbose Logs

➜  ~ sudo dotnet workload install maui --version 10.0.100-preview.4.25262.2 --configfile ~/.config/NuGet/NuGet.Config
Password:

Welcome to .NET 10.0!
---------------------
SDK Version: 10.0.100-preview.4.25258.110

Telemetry
---------
The .NET tools collect usage data in order to help us improve your experience. It is collected by Microsoft and shared with the community. You can opt-out of telemetry by setting the DOTNET_CLI_TELEMETRY_OPTOUT environment variable to '1' or 'true' using your favorite shell.

Read more about .NET CLI Tools telemetry: https://aka.ms/dotnet-cli-telemetry

----------------
Installed an ASP.NET Core HTTPS development certificate.
To trust the certificate, run 'dotnet dev-certs https --trust'
Learn about HTTPS: https://aka.ms/dotnet-https

----------------
Write your first app: https://aka.ms/dotnet-hello-world
Find out what's new: https://aka.ms/dotnet-whats-new
Explore documentation: https://aka.ms/dotnet-docs
Report issues and find source on GitHub: https://github.com/dotnet/core
Use 'dotnet --help' to see available commands or visit: https://aka.ms/dotnet-cli
--------------------------------------------------------------------------------------

Installing workload version 10.0.100-preview.4.25262.2.
Workload installation failed. Rolling back installed packs...
Workload installation failed: Failed to install workload version 10.0.100-preview.4.25262.2: Object reference not set to an instance of an object.

[nkolev92]

@donnie-msft commented on Fri, 16 May 2025 22:23:36 GMT
I've reproduced this issue on 10.0.100-preview.4.25211.20 , 9.0.204, and 8.0.409.

Command used: dotnet workload install maui --version 10.0.100-preview.4.25262.2 --configfile ..\nuget.config --verbosity diag
Note that dotnet add package does not reproduce this issue.

[nkolev92]

@nkolev92 commented on Thu, 29 May 2025 21:10:15 GMT
Team Triage:
The workloads implementation is on the .NET SDK side, and given that add package doesn't have that problem, it's probably best for the .NET SDK to investigate first.
We'll move this issue to that repo.

[marcpopMSFT]

dotnet tool install is affected as well. I assume the right solution is to just ignore spaces at the beginning and end of the feed details as that's better than erroring and making the customer fix it.

[marcpopMSFT]

@nkolev92 looks like I was too optimistic in giving this to copilot as the fix is needed on the nuget side from what I can tell. It definitely still repros with the copilot fix:
#49315 (comment)

Should I close and file an issue on nuget?

[nkolev92]

We can reopen the NuGet side issue.