Our TypeScript Express deployment test is failing: https://github.com/dotnet/aspire/actions/runs/23054244349
The error is
Failed to prepare: Package restore failed: ERROR: Package 'Microsoft.Extensions.Primitives 5.0.1' from source
'https://api.nuget.org/v3/index.json': The author primary signature validity period has expired.
ERROR: Package 'Microsoft.Extensions.Primitives 5.0.1' from source 'https://api.nuget.org/v3/index.json': The author primary signature's
timestamping certificate is not trusted by the trust provider.
ERROR: Package 'Microsoft.Extensions.Primitives 5.0.1' from source 'https://api.nuget.org/v3/index.json': The repository countersignature
validity period has expired.
ERROR: Package 'Microsoft.Extensions.Primitives 5.0.1' from source 'https://api.nuget.org/v3/index.json': The repository countersignature's
timestamping certificate is not trusted by the trust provider.
Error: Restore failed: Package 'Microsoft.Extensions.Primitives 5.0.1' from source 'https://api.nuget.org/v3/index.json': The author primary
signature validity period has expired.
Package 'Microsoft.Extensions.Primitives 5.0.1' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamping
certificate is not trusted by the trust provider.
Package 'Microsoft.Extensions.Primitives 5.0.1' from source 'https://api.nuget.org/v3/index.json': The repository countersignature validity
period has expired.
Package 'Microsoft.Extensions.Primitives 5.0.1' from source 'https://api.nuget.org/v3/index.json': The repository countersignature's
timestamping certificate is not trusted by the trust provider.
❌ Failed to prepare AppHost server.
This occurs when a Linux machine has DOTNET_NUGET_SIGNATURE_VERIFICATION=true because nuget tries to validate the signatures and we are bringing in 'Microsoft.Extensions.Primitives 5.0.1' in the graph by default. The reason is because we reference SemVer 3.0.0, which brings in this old package: https://www.nuget.org/packages/Semver/3.0.0#dependencies-body-tab
This old package had its certificate expire, which causes the problem.
For sure, we need to update SemVer for this - it shouldn't be relying on deprecated packages.
But aspire restore won't work on machines (like CI machines) that set this environment variable.
We need a way to cut this bad dependency out of the restore graph. A way to do this would be to "vendor" / copy the SemVer code into our repo until a patch can be made on the upstream package.
cc @danegsta @joperezr
Our TypeScript Express deployment test is failing: https://github.com/dotnet/aspire/actions/runs/23054244349
The error is
This occurs when a Linux machine has
DOTNET_NUGET_SIGNATURE_VERIFICATION=truebecause nuget tries to validate the signatures and we are bringing in 'Microsoft.Extensions.Primitives 5.0.1' in the graph by default. The reason is because we reference SemVer 3.0.0, which brings in this old package: https://www.nuget.org/packages/Semver/3.0.0#dependencies-body-tabThis old package had its certificate expire, which causes the problem.
For sure, we need to update SemVer for this - it shouldn't be relying on deprecated packages.
But
aspire restorewon't work on machines (like CI machines) that set this environment variable.We need a way to cut this bad dependency out of the restore graph. A way to do this would be to "vendor" / copy the SemVer code into our repo until a patch can be made on the upstream package.
cc @danegsta @joperezr