arcade: Intermittent NU3004 errors (fixed?)

Time to time I see errors like this one in the Arcade CI build:

error NU3004: Package 'vswhere 2.6.7' from source 'https://api.nuget.org/v3/index.json': This repository indicated that all its packages are repository signed; however, this package is unsigned.

Doesn’t make much sense to me as it happens only sometimes… The package is definitely signed.

Failure example: https://dev.azure.com/dnceng/public/_build/results?buildId=172551

About this issue

Original URL
State: closed
Created 5 years ago
Comments: 20 (17 by maintainers)

Commits related to this issue

Update version of .NET SDK * Updating due to issue dotnet/arcade#2638 — committed to StephenBonikowsky/wcf by StephenBonikowsky 5 years ago

Most upvoted comments

@riarenas yes I’ll get someone on this this morning.

MattGal on May 9, 2019

@tmat, there are 2 known scenarios where you might get this error erroneously:

You’re running a NuGet 5.0 client on the same machine as a NuGet 4.7-4.9 client. A bug in HTTP caching would enable a 4.7-4.9 client to incorrectly use a cached 5.0 resource. A fix should be available in NuGet 5.0.2 and 5.1. I worked with @MattGal on this, and I wonder if this is another report of the same issue. One workaround is to clear just the HTTP cache before calling NuGet (e.g.: `nuget.exe locals http-cache -clear).
You’re using NuGet.exe on Mono to restore signed packages. This was a bug; signed package verification should have been disabled when NuGet.exe runs on Mono. A fix should be available in NuGet 5.0.2 and 5.2.

dtivel on Apr 29, 2019

Chatted with @loic-sharma.

Even though I can’t find the logs I’d imagine it’s possible that you are hitting this bug. https://github.com/NuGet/Home/issues/7997

Basically, if on the same machine, multiple client version of dotnet.exe are being used in a span of 30 minutes you can run into it. Basically I think you need one of 2.1.500/2.2.100 (not latest patch) to run after a 3.0.0 P4-P5/2.2.300/2.1.700.

@loic-sharma also pointed out that we should probably have a better description of this scenario somewhere. Ideally a nuget tracking issue and/or a docs update for the NU3004 warning. //cc @rrelyea

nkolev92 on Apr 29, 2019