dotnet restore project with failing RestoreAdditionalProjectSources hangs with net8

[syrompetka]

NuGet Product Used

dotnet.exe

Product Version

dotnet 8.0-9.0

Worked before?

dotnet 6.0

Impact

None

Repro Steps & Context

I have following project:

<Project Sdk="Microsoft.NET.Sdk.Web">
  <PropertyGroup>
    <TargetFramework>net6.0</TargetFramework>
    <RestoreAdditionalProjectSources>
      https://dotnet.myget.org/F/aspnetcore-dev/api/v3/index.json;
      https://dotnet.myget.org/F/blazor-dev/api/v3/index.json;
    </RestoreAdditionalProjectSources>
  </PropertyGroup>
</Project>

Note that RestoreAdditionalProjectSources contains sources that are no longer available.

1. when I run dotnet restore NugetDemo.sln --packages Packages with dotnet 8 or 9 I get a lot of NU1301 errors and restore process never stops. The same happens when I run build from Visual Studio, but VS has timeout 10 minutes and kills restore process after that.
   If I specify --ignore-failed-sources option nothing changes but error turns into warning.

2. when I run the same command with dotnet 6 everything works fine and restore process completes successfully.

NOTE: Packages folder must be empty.

Sample solution attached.

My understanding is that RestoreAdditionalProjectSources should add additional package sources to look for packages not found in existing sources. And if all packages are found in existing sources then no request to additional ones should be made at all.

I was able to build some old unsupported projects with net6 but with net8 and higher - I can't.

NugetDemo.zip

Verbose Logs

No response

[Nigusu-Allehu]

I was able to use --ignore-failed-sources to ignore sources that do not exist. As you mentioned, it is not an error anymore but a warning.

[syrompetka]

I've attached sample project.
Also --packages Packages option was used.

The problem is:

1. restore process never stops - always retries to read not working source and spams with NU1301 error
2. restore process does not restore at all. Although with net6 it worked fine.

[nkolev92]

My understanding is that RestoreAdditionalProjectSources should add additional package sources to look for packages not found in existing sources. And if all packages are found in existing sources then no request to additional ones should be made at all.

There's no priority of sources. They're combined prior to any calls being made.

• I want to go back to the hang report. It is our suspicion that retrying is just taking long. How long did you wait before determining it does not restore?
• Can you try setting NUGET_ENABLE_ENHANCED_HTTP_RETRY to false and tell us how fast it completes?

[syrompetka]

By default it runs over 1.5 hours. I killed the proccess after that.
With NUGET_ENABLE_ENHANCED_HTTP_RETRY it takes around 20 minutes and completes without restoring dependencies.

[nkolev92]

The biggest challenge is that url seems to be accepting the connection but not returning any data, leading to a long wait client side.
Even with NUGET_ENABLE_ENHANCED_HTTP_RETRY to false, 20 mins is a long time to detect a timeout.

[syrompetka]

1. the result that the source is faulty is not cached anywhere. My guess that outer code tries to get sources for every package. And this causes multiple HTTP requests.
2. dependencies are still not restored. They are restored with net6. Also with --ignore-failed-sources option restore process completes successfully (but with many warnings) with no dependecies restored.

[nkolev92]

the result that the source is faulty is not cached anywhere

Did you validate this assumption? If so, I'm curious to learn more.

Source inaccessible issues are fail fast, so you should only be hitting retries.

dependencies are still not restored

I want to make sure I understand this.
Which dependencies are you referring to?

If a source cannot be reached, there's no guarantee a restore will be correct. --ignore-failed-sources should ideally be replaced with ensuring the sources are available.
Some docs: https://learn.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files#packagereference-and-sources

[syrompetka]

Did you validate this assumption? If so, I'm curious to learn more.

https://github.com/NuGet/NuGet.Client/blob/4e10b1165316e09b6570e51b4316d88b493889e9/src/NuGet.Core/NuGet.Protocol/Providers/ServiceIndexResourceV3Provider.cs#L73
In catch block cache is not updated.

dependencies are still not restored

I want to make sure I understand this. Which dependencies are you referring to?

project.assets.json is missing and further build fails

[nkolev92]

In catch block cache is not updated.

There's a higher level caching.
Either way though, those timeouts are really long.

project.assets.json is missing and further build fails

This suggests to me that the restore did not complete. Even with a source failure, starting with https://learn.microsoft.com/en-us/nuget/release-notes/nuget-6.3, the assets file should be created.

[syrompetka]

Well.
I was using .net SDK 8.0.302.
After upgrading to latest 8.0.404 the restore process completes in 3-5 minutes and project.assets.json is generated.
The --ignore-failed-sources option allows further build.