由于证书问题，解决 Devops Build Agent 中的 Nuget 包问题

【问题标题】：Problem resolving Nuget Packages in Devops Build Agent due to Certificate issues由于证书问题，解决 Devops Build Agent 中的 Nuget 包问题
【发布时间】：2022-01-01 03:06:28
【问题描述】：

我们使用一个 Build Agent 在 Premise 上托管 DevOps Server。如果我开始针对 .NET 5.0 项目运行 NuGet 还原，则 Build 代理的行为会很奇怪。特别针对来自 VS2019 的测试项目模板（MS-Test Testproject）。一旦我运行 Nuget 还原，它就会因大量“NU3028”“NU3034”“NU3037”问题而失败。我已经更新了 nuget.config，但似乎没有任何效果。

操作系统：Windows Server 2019 V.1809 Build 17763.2300

DevOps：Azure DevOps Server 2020 更新 1.1 V. 18.181.31626.1

Nuget：6.0.0 (x64)

DevOps 管道： Devops Pipe

输出：Pipe Output

Nuget.config：

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
    <add key="VollmerPackages" value="https://devops/Vollmer/_packaging/VollmerPackages/nuget/v3/index.json" />
  </packageSources>
<trustedSigners>
  <author name="Microsoft">
    <certificate fingerprint="3F9001EA83C560D712C24CF213C3D312CB3BFF51EE89435D3430BD06B5D0EECE" hashAlgorithm="SHA256" allowUntrustedRoot="false" />
    <certificate fingerprint="AA12DA22A49BCE7D5C1AE64CC1F3D892F150DA76140F210ABD2CBFFCA2C18A27" hashAlgorithm="SHA256" allowUntrustedRoot="false" />
  </author>
  <repository name="nuget.org" serviceIndex="https://api.nuget.org/v3/index.json">
    <certificate fingerprint="0E5F38F57DC1BCC806D8494F4F90FBCEDD988B46760709CBEEC6F4219AA6157D" hashAlgorithm="SHA256" allowUntrustedRoot="false" />
    <certificate fingerprint="5A2901D6ADA3D18260B9C6DFE2133C95D74B9EEF6AE0E5DC334C8454D1477DF4" hashAlgorithm="SHA256" allowUntrustedRoot="false" />
  </repository>
</trustedSigners>
</configuration>

如果我在我的 VS PC 上运行 Nuget 本地恢复，恢复运行不会出现任何错误。如果我在构建代理服务器上运行它，则会出现大量证书问题。

CMD 输出 Nuget restore（构建代理服务器）：

    Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': Signature Hash Algorithm: SHA256
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': Signature Hash Algorithm: SHA256
NU3034: Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': This package is signed but not by a trusted signer.
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json':
Signature type: Repository
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': Service index: https://api.nuget.org/v3/index.json
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': Owners: dotnetframework, Microsoft
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': Verifying the repository primary signature with certificate:

Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json':   Subject Name: CN=NuGet.org Repository by Microsoft, O=NuGet.org Repository by Microsoft, L=Redmond, S=Washington, C=US
NU3034: Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': This package is signed but not by a trusted signer.
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json':
Signature type: Repository
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': Service index: https://api.nuget.org/v3/index.json
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json':   SHA1 hash: 8FB6D7FCF7AD49EB774446EFE778B33365BB7BFB
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json':   SHA256 hash: 0E5F38F57DC1BCC806D8494F4F90FBCEDD988B46760709CBEEC6F4219AA6157D
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json':   Issued by: CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json':   Valid from: 10.04.2018 02:00:00 to 14.04.2021 14:00:00
NU3037: Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired.
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': Owners: dotnetframework, Microsoft
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': Verifying the repository primary signature with certificate:

Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json':   Subject Name: CN=NuGet.org Repository by Microsoft, O=NuGet.org Repository by Microsoft, L=Redmond, S=Washington, C=US
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json':   SHA1 hash: 8FB6D7FCF7AD49EB774446EFE778B33365BB7BFB
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json':   SHA256 hash: 0E5F38F57DC1BCC806D8494F4F90FBCEDD988B46760709CBEEC6F4219AA6157D
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json':   Issued by: CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json':   Valid from: 10.04.2018 02:00:00 to 14.04.2021 14:00:00
NU3037: Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired.
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': Timestamp: 05.10.2018 16:36:21

Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': Verifying repository primary signature's timestamp with timestamping service certificate:
  Subject Name: CN=Symantec SHA256 TimeStamping Signer - G2, OU=Symantec Trust Network, O=Symantec Corporation, C=US
  SHA1 hash: 625AEC3AE4EDA1D169C4EE909E85B3BBC61076D3
  SHA256 hash: CF7AC17AD047ECD5FDC36822031B12D4EF078B6F2B4C5E6BA41F8FF2CF4BAD67
  Issued by: CN=Symantec SHA256 TimeStamping CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US
  Valid from: 02.01.2017 01:00:00 to 02.04.2028 01:59:59

NU3028: Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamping certificate is not trusted by the trust provider.
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': Timestamp: 13.12.2018 23:56:51

Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': Verifying repository primary signature's timestamp with timestamping service certificate:
  Subject Name: CN=Symantec SHA256 TimeStamping Signer - G2, OU=Symantec Trust Network, O=Symantec Corporation, C=US
  SHA1 hash: 625AEC3AE4EDA1D169C4EE909E85B3BBC61076D3
  SHA256 hash: CF7AC17AD047ECD5FDC36822031B12D4EF078B6F2B4C5E6BA41F8FF2CF4BAD67
  Issued by: CN=Symantec SHA256 TimeStamping CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US
  Valid from: 02.01.2017 01:00:00 to 02.04.2028 01:59:59

NU3028: Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamping certificate is not trusted by the trust provider.
Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json': Signature Hash Algorithm: SHA256
NU3034: Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json': This package is signed but not by a trusted signer.
Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json':
Signature type: Repository
Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json': Service index: https://api.nuget.org/v3/index.json
Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json': Owners: dotnetframework, Microsoft
Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json': Verifying the repository primary signature with certificate:

Package 'runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': Signature Hash Algorithm: SHA256
Package 'System.Threading.Tasks.Extensions 4.0.0' from source 'https://api.nuget.org/v3/index.json': Signature Hash Algorithm: SHA256
NU3034: Package 'System.Threading.Tasks.Extensions 4.0.0' from source 'https://api.nuget.org/v3/index.json': This package is signed but not by a trusted signer.
Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json': Signature Hash Algorithm: SHA256
Package 'System.IO.FileSystem 4.0.1' from source 'https://api.nuget.org/v3/index.json': Signature Hash Algorithm: SHA256
NU3034: Package 'System.IO.FileSystem 4.0.1' from source 'https://api.nuget.org/v3/index.json': This package is signed but not by a trusted signer.
Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json':   Subject Name: CN=NuGet.org Repository by Microsoft, O=NuGet.org Repository by Microsoft, L=Redmond, S=Washington, C=US
NU3034: Package 'runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': This package is signed but not by a trusted signer.
Package 'System.Threading.Tasks.Extensions 4.0.0' from source 'https://api.nuget.org/v3/index.json':
Signature type: Repository
NU3034: Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json': This package is signed but not by a trusted signer.
Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json':
Signature type: Repository
Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json': Service index: https://api.nuget.org/v3/index.json
Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json': Owners: dotnetframework, Microsoft
Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json': Verifying the repository primary signature with certificate:

Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json':   Subject Name: CN=NuGet.org Repository by Microsoft, O=NuGet.org Repository by Microsoft, L=Redmond, S=Washington, C=US
Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json':   SHA1 hash: 8FB6D7FCF7AD49EB774446EFE778B33365BB7BFB
Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json':   SHA256 hash: 0E5F38F57DC1BCC806D8494F4F90FBCEDD988B46760709CBEEC6F4219AA6157D
Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json':   SHA1 hash: 8FB6D7FCF7AD49EB774446EFE778B33365BB7BFB
Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json':   SHA256 hash: 0E5F38F57DC1BCC806D8494F4F90FBCEDD988B46760709CBEEC6F4219AA6157D
Package 'System.IO.FileSystem 4.0.1' from source 'https://api.nuget.org/v3/index.json':
Signature type: Repository
Package 'System.IO.FileSystem 4.0.1' from source 'https://api.nuget.org/v3/index.json': Service index: https://api.nuget.org/v3/index.json
Package 'System.IO.FileSystem 4.0.1' from source 'https://api.nuget.org/v3/index.json': Owners: dotnetframework, Microsoft
Package 'System.IO.FileSystem 4.0.1' from source 'https://api.nuget.org/v3/index.json': Verifying the repository primary signature with certificate:
....

任何建议将不胜感激

顺便说一句，如果我使用 dotnet restore 代替 nuget restore，它甚至不会改变。两者在服务器上的行为相同。构建服务器上安装了最新的 SDK 6.0.100....

更新： 通过将所有 SHA256 指纹添加到“trustedSigners”块并将“allowUntrustedRott”设置为 true，找到了一种忽略所有即将出现的与证书相关的问题的方法，我忽略了错误和安装的软件包。对于不受信任的证书，这仍然是一个丑陋的解决方法，但这是我迄今为止发现的唯一可能性。

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <packageSources>
      <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
      
    </packageSources>
    <config>
      <add key="signatureValidationMode" value="accept" />
    </config>
    <packageRestore>
        <add key="enabled" value="True" />
        <add key="automatic" value="True" />
    </packageRestore>
    <trustedSigners>
      <author name="Microsoft">
        <certificate fingerprint="3F9001EA83C560D712C24CF213C3D312CB3BFF51EE89435D3430BD06B5D0EECE" hashAlgorithm="SHA256" allowUntrustedRoot="true" />
        <certificate fingerprint="AA12DA22A49BCE7D5C1AE64CC1F3D892F150DA76140F210ABD2CBFFCA2C18A27" hashAlgorithm="SHA256" allowUntrustedRoot="true" />
      </author>
      <repository name="nuget.org" serviceIndex="https://api.nuget.org/v3/index.json">
        <certificate fingerprint="0E5F38F57DC1BCC806D8494F4F90FBCEDD988B46760709CBEEC6F4219AA6157D" hashAlgorithm="SHA256" allowUntrustedRoot="true" />
        <certificate fingerprint="5A2901D6ADA3D18260B9C6DFE2133C95D74B9EEF6AE0E5DC334C8454D1477DF4" hashAlgorithm="SHA256" allowUntrustedRoot="true" />
        <certificate fingerprint=" CF7AC17AD047ECD5FDC36822031B12D4EF078B6F2B4C5E6BA41F8FF2CF4BAD67" hashAlgorithm="SHA256" allowUntrustedRoot="true" />
        <certificate fingerprint="C474CE76007D02394E0DA5E4DE7C14C680F9E282013CFEF653EF5DB71FDF61F8" hashAlgorithm="SHA256" allowUntrustedRoot="true" />
      </repository>
    </trustedSigners>
</configuration>

【问题讨论】：

    标签： nuget certificate devops trusted


    【解决方案1】：

    Symantec SHA256 TimeStamping Signer - G2, 的发行人是她：https://crt.sh/?q=Symantec+SHA256+TimeStamping+CA，由https://crt.sh/?caid=1110 自己发行

    将第一个放在LocalMachine 的ROOT 存储中，第二个放在IntermediateCA 中。

    似乎 CTL 更新已禁用：https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn265983(v=ws.11)

    【讨论】：

    • 我会试一试，但我主要关心的是今年早些时候的 Microsoft 证书问题。 Nuget 表示新版本将解决微软证书过时的问题，但它不起作用。
    猜你喜欢
    • 2021-01-22
    • 1970-01-01
    • 2020-05-13
    • 1970-01-01
    • 2018-04-02
    • 2020-03-26
    • 2017-05-28
    • 2021-11-19
    • 1970-01-01
    相关资源
    最近更新 更多
    热门标签
    Java Python linux javascript Mysql C# Docker 算法 前端 SpringBoot Redis Vue spring 设计模式 .net core .net kubernetes c++ 数据库 数据结构 大数据 js 机器学习 微服务 Android Go 程序员 面试 JVM ASP.net core 云原生 人工智能 后端 PHP git CSS golang k8s Nginx Django mybatis 深度学习 多线程 React 架构 devops 爬虫 云计算 Spring Boot LeetCode