[Project Support]: Windows Community Toolkit - Azure Artifacts Feeds NuGet Auth Error

[michael-hawker]

Project

Windows Community Toolkit

Project Url

https://github.com/CommunityToolkit/Labs-Windows

Description

Around the end of March, consumers of our Azure Artifacts feed reported issues consuming packages from it in Visual Studio, issue in our repo is here.

warning NU1900: Error occurred while getting package vulnerability data: Response status code does not indicate success: 401 (Unauthorized).

A community member (thanks @beeradmoore) diagnosed this was due to the underlying VulnerabilityInfo/6.70 component of the NuGet server index.json, see that summary here: CommunityToolkit/Labs-Windows#662 (comment)

---

I think the issue is that https://pkgs.dev.azure.com/dotnet/696bc9fd-f160-4e97-a1bd-7cbbb3b58f66/_packaging/9c12ba9d-e4eb-4290-9266-e0fb1a871009/nuget/v3/vulnerabilities/index.json which is referenced in https://pkgs.dev.azure.com/dotnet/CommunityToolkit/_packaging/CommunityToolkit-Labs/nuget/v3/index.json requires a login.

If that isn't expected, it would be some Azure config change in the feed.

EDIT: From the urls linked in the main feed. I don't know nuget spec or what are meant to work or not.

Name	Works
PackagePublish/2.0.0	✅
LegacyGallery/2.0.0	✅
RegistrationsBaseUrl/3.0.0-beta	404
RegistrationsBaseUrl/3.6.0	404
RegistrationsBaseUrl/Versioned	404
SearchQueryService/3.0.0-beta	✅
PackageBaseAddress/3.0.0	404
VulnerabilityInfo/6.7.0	❌

EDIT 2:

When I try login via the web form it presents I get the error. Hopefully this helpful to find the right person to ping.

Selected user account does not exist in tenant '.NET Foundation' and cannot access the application '499b84ac-1321-427f-aa17-267ca6975798' in that tenant. The account needs to be added as an external user in the tenant first. Please use a different account.

MainLatest feed also hits up a different vulnerabilities/index.json but results in the same unauthorised.

---

There's no configuration we've changed in this period, and there's no settings or options we can see in the portal for any of this underlying configuration.

So either something changed in the main .NET Foundation tenant or some change happened within ADO that we weren't notified of.

Expectation: Users can access the Azure Artifacts feed without authentication, as before.

Due By

ASAP

[ChrisSfanos]

Thanks @michael-hawker - I'm going to post something internal at MSFT and see what I can find

[dpaulino]

I've been hitting this a lot. Quite annoying. I'm glad there's a temporary workaround, but hopefully a proper fix is provided ASAP.

[joseborges]

Same here... thanks for looking into it!

[matthewacme]

I've been hitting this a lot. Quite annoying. I'm glad there's a temporary workaround, but hopefully a proper fix is provided ASAP.

What exactly is the work around?

[beeradmoore]

I believe the workaround was to create a nuget.config (EDIT: here). This is how I was consuming these feeds to begin with so I don't think that it's a valid workaround.

Either when other users tried it VS was not using the nuget.config as expected, VS not checking for updates as expected, or the endpoint was not returning 401 unauthorised for a brief moment when that user tried it.

[joseborges]

Dominic Maas said this on discord:

you can work around it by adding <NuGetAudit>false</NuGetAudit> to your csproj, may also need to ignore the warning NU1900

[tintse-thxsky-MSFT]

Sorry for the inconvenience.
The VulnerabilityInfo/6.70 resource component in the NuGet server's index.json was inadvertently made available due to a misconfiguration. It has now been removed from the index.json, and the authentication error should be mitigated.

Please @ me if you encounter any further authentication issues while fetching the NuGet vulnerability index in Azure Artifacts feeds.

[beeradmoore]

Thanks @tintse-thxsky-MSFT , @michael-hawker , and everyone else involved getting this sorted.

I was able to confirm I can fetch from feeds without issue now.

[glennawatson]

Is it safe to close this issue now?

[michael-hawker]

@glennawatson yup, I think we're all set, thanks!