由于证书问题，解决DevOps生成代理中的Nuget包时出现问题 [英] Problem resolving Nuget Packages in Devops Build Agent due to Certificate issues

查看：37
本文介绍了由于证书问题，解决DevOps生成代理中的Nuget包时出现问题的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！

问题描述

我们使用一个生成代理在本地托管DevOps服务器。如果我开始对.NET 5.0项目运行NuGet Restore，生成代理的行为会很奇怪。特别是针对VS2019的测试项目模板(MS-测试项目)。我一运行Nuget恢复，它就失败了，出现了大量的"NU3028"、"NU3034"、"NU3037"问题。我已经更新了nuget.config，但看起来什么都不起作用。

操作系统：Windows Server2019 V.1809内部版本17763.2300

DevOps：Azure DevOps Server 2020更新1.1 V.18.181.31626.1

Nuget：6.0.0(X64)

DevOps管道： Devops Pipe

输出：Pipe Output

Nuget.config：

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
    <add key="VollmerPackages" value="https://devops/Vollmer/_packaging/VollmerPackages/nuget/v3/index.json" />
  </packageSources>
<trustedSigners>
  <author name="Microsoft">
    <certificate fingerprint="3F9001EA83C560D712C24CF213C3D312CB3BFF51EE89435D3430BD06B5D0EECE" hashAlgorithm="SHA256" allowUntrustedRoot="false" />
    <certificate fingerprint="AA12DA22A49BCE7D5C1AE64CC1F3D892F150DA76140F210ABD2CBFFCA2C18A27" hashAlgorithm="SHA256" allowUntrustedRoot="false" />
  </author>
  <repository name="nuget.org" serviceIndex="https://api.nuget.org/v3/index.json">
    <certificate fingerprint="0E5F38F57DC1BCC806D8494F4F90FBCEDD988B46760709CBEEC6F4219AA6157D" hashAlgorithm="SHA256" allowUntrustedRoot="false" />
    <certificate fingerprint="5A2901D6ADA3D18260B9C6DFE2133C95D74B9EEF6AE0E5DC334C8454D1477DF4" hashAlgorithm="SHA256" allowUntrustedRoot="false" />
  </repository>
</trustedSigners>
</configuration>
如果我在VS PC上运行Nuget restore local，则还原运行时没有任何错误。如果我在生成代理服务器上运行它，会有大量的证书问题。

CMD输出Nuget还原(生成代理服务器)：

    Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': Signature Hash Algorithm: SHA256
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': Signature Hash Algorithm: SHA256
NU3034: Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': This package is signed but not by a trusted signer.
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json':
Signature type: Repository
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': Service index: https://api.nuget.org/v3/index.json
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': Owners: dotnetframework, Microsoft
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': Verifying the repository primary signature with certificate:

Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json':   Subject Name: CN=NuGet.org Repository by Microsoft, O=NuGet.org Repository by Microsoft, L=Redmond, S=Washington, C=US
NU3034: Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': This package is signed but not by a trusted signer.
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json':
Signature type: Repository
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': Service index: https://api.nuget.org/v3/index.json
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json':   SHA1 hash: 8FB6D7FCF7AD49EB774446EFE778B33365BB7BFB
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json':   SHA256 hash: 0E5F38F57DC1BCC806D8494F4F90FBCEDD988B46760709CBEEC6F4219AA6157D
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json':   Issued by: CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json':   Valid from: 10.04.2018 02:00:00 to 14.04.2021 14:00:00
NU3037: Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired.
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': Owners: dotnetframework, Microsoft
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': Verifying the repository primary signature with certificate:

Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json':   Subject Name: CN=NuGet.org Repository by Microsoft, O=NuGet.org Repository by Microsoft, L=Redmond, S=Washington, C=US
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json':   SHA1 hash: 8FB6D7FCF7AD49EB774446EFE778B33365BB7BFB
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json':   SHA256 hash: 0E5F38F57DC1BCC806D8494F4F90FBCEDD988B46760709CBEEC6F4219AA6157D
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json':   Issued by: CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json':   Valid from: 10.04.2018 02:00:00 to 14.04.2021 14:00:00
NU3037: Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired.
Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': Timestamp: 05.10.2018 16:36:21

Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': Verifying repository primary signature's timestamp with timestamping service certificate:
  Subject Name: CN=Symantec SHA256 TimeStamping Signer - G2, OU=Symantec Trust Network, O=Symantec Corporation, C=US
  SHA1 hash: 625AEC3AE4EDA1D169C4EE909E85B3BBC61076D3
  SHA256 hash: CF7AC17AD047ECD5FDC36822031B12D4EF078B6F2B4C5E6BA41F8FF2CF4BAD67
  Issued by: CN=Symantec SHA256 TimeStamping CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US
  Valid from: 02.01.2017 01:00:00 to 02.04.2028 01:59:59

NU3028: Package 'runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamping certificate is not trusted by the trust provider.
Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': Timestamp: 13.12.2018 23:56:51

Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': Verifying repository primary signature's timestamp with timestamping service certificate:
  Subject Name: CN=Symantec SHA256 TimeStamping Signer - G2, OU=Symantec Trust Network, O=Symantec Corporation, C=US
  SHA1 hash: 625AEC3AE4EDA1D169C4EE909E85B3BBC61076D3
  SHA256 hash: CF7AC17AD047ECD5FDC36822031B12D4EF078B6F2B4C5E6BA41F8FF2CF4BAD67
  Issued by: CN=Symantec SHA256 TimeStamping CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US
  Valid from: 02.01.2017 01:00:00 to 02.04.2028 01:59:59

NU3028: Package 'System.Runtime.Handles 4.0.1' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamping certificate is not trusted by the trust provider.
Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json': Signature Hash Algorithm: SHA256
NU3034: Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json': This package is signed but not by a trusted signer.
Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json':
Signature type: Repository
Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json': Service index: https://api.nuget.org/v3/index.json
Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json': Owners: dotnetframework, Microsoft
Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json': Verifying the repository primary signature with certificate:

Package 'runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': Signature Hash Algorithm: SHA256
Package 'System.Threading.Tasks.Extensions 4.0.0' from source 'https://api.nuget.org/v3/index.json': Signature Hash Algorithm: SHA256
NU3034: Package 'System.Threading.Tasks.Extensions 4.0.0' from source 'https://api.nuget.org/v3/index.json': This package is signed but not by a trusted signer.
Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json': Signature Hash Algorithm: SHA256
Package 'System.IO.FileSystem 4.0.1' from source 'https://api.nuget.org/v3/index.json': Signature Hash Algorithm: SHA256
NU3034: Package 'System.IO.FileSystem 4.0.1' from source 'https://api.nuget.org/v3/index.json': This package is signed but not by a trusted signer.
Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json':   Subject Name: CN=NuGet.org Repository by Microsoft, O=NuGet.org Repository by Microsoft, L=Redmond, S=Washington, C=US
NU3034: Package 'runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl 4.3.0' from source 'https://api.nuget.org/v3/index.json': This package is signed but not by a trusted signer.
Package 'System.Threading.Tasks.Extensions 4.0.0' from source 'https://api.nuget.org/v3/index.json':
Signature type: Repository
NU3034: Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json': This package is signed but not by a trusted signer.
Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json':
Signature type: Repository
Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json': Service index: https://api.nuget.org/v3/index.json
Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json': Owners: dotnetframework, Microsoft
Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json': Verifying the repository primary signature with certificate:

Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json':   Subject Name: CN=NuGet.org Repository by Microsoft, O=NuGet.org Repository by Microsoft, L=Redmond, S=Washington, C=US
Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json':   SHA1 hash: 8FB6D7FCF7AD49EB774446EFE778B33365BB7BFB
Package 'System.IO.FileSystem.Primitives 4.0.1' from source 'https://api.nuget.org/v3/index.json':   SHA256 hash: 0E5F38F57DC1BCC806D8494F4F90FBCEDD988B46760709CBEEC6F4219AA6157D
Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json':   SHA1 hash: 8FB6D7FCF7AD49EB774446EFE778B33365BB7BFB
Package 'System.Diagnostics.Tools 4.0.1' from source 'https://api.nuget.org/v3/index.json':   SHA256 hash: 0E5F38F57DC1BCC806D8494F4F90FBCEDD988B46760709CBEEC6F4219AA6157D
Package 'System.IO.FileSystem 4.0.1' from source 'https://api.nuget.org/v3/index.json':
Signature type: Repository
Package 'System.IO.FileSystem 4.0.1' from source 'https://api.nuget.org/v3/index.json': Service index: https://api.nuget.org/v3/index.json
Package 'System.IO.FileSystem 4.0.1' from source 'https://api.nuget.org/v3/index.json': Owners: dotnetframework, Microsoft
Package 'System.IO.FileSystem 4.0.1' from source 'https://api.nuget.org/v3/index.json': Verifying the repository primary signature with certificate:
....

如有任何建议，我们将不胜感激

顺便说一下，如果我使用Nuget restore的DotNet restore insted，它甚至不会改变。两者在服务器上的行为相同。生成服务器上安装了最新的SDK 6.0.100.

更新： 通过将所有SHA256指纹添加到‘trustedSigners’挡路，并将‘allowUntrustdRott’设置为true，我发现了一种忽略所有与证书相关的升级问题的方法，我忽略了错误和正在安装的软件包。这仍然是处理不受信任证书的一种难看的解决办法，但这是我到目前为止发现的唯一可能性。

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <packageSources>
      <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
      
    </packageSources>
    <config>
      <add key="signatureValidationMode" value="accept" />
    </config>
    <packageRestore>
        <add key="enabled" value="True" />
        <add key="automatic" value="True" />
    </packageRestore>
    <trustedSigners>
      <author name="Microsoft">
        <certificate fingerprint="3F9001EA83C560D712C24CF213C3D312CB3BFF51EE89435D3430BD06B5D0EECE" hashAlgorithm="SHA256" allowUntrustedRoot="true" />
        <certificate fingerprint="AA12DA22A49BCE7D5C1AE64CC1F3D892F150DA76140F210ABD2CBFFCA2C18A27" hashAlgorithm="SHA256" allowUntrustedRoot="true" />
      </author>
      <repository name="nuget.org" serviceIndex="https://api.nuget.org/v3/index.json">
        <certificate fingerprint="0E5F38F57DC1BCC806D8494F4F90FBCEDD988B46760709CBEEC6F4219AA6157D" hashAlgorithm="SHA256" allowUntrustedRoot="true" />
        <certificate fingerprint="5A2901D6ADA3D18260B9C6DFE2133C95D74B9EEF6AE0E5DC334C8454D1477DF4" hashAlgorithm="SHA256" allowUntrustedRoot="true" />
        <certificate fingerprint=" CF7AC17AD047ECD5FDC36822031B12D4EF078B6F2B4C5E6BA41F8FF2CF4BAD67" hashAlgorithm="SHA256" allowUntrustedRoot="true" />
        <certificate fingerprint="C474CE76007D02394E0DA5E4DE7C14C680F9E282013CFEF653EF5DB71FDF61F8" hashAlgorithm="SHA256" allowUntrustedRoot="true" />
      </repository>
    </trustedSigners>
</configuration>

推荐答案

Symantec SHA256 TimeStamping Signer - G2,的颁发者是Her：https://crt.sh/?q=Symantec+SHA256+TimeStamping+CA，本身由https://crt.sh/?caid=1110

颁发

将第一个放入LocalMachine的ROOT存储中，第二个放入IntermediateCA中。

CTL更新似乎已禁用：https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn265983(v=ws.11)

这篇关于由于证书问题，解决DevOps生成代理中的Nuget包时出现问题的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！

查看全文
相关文章
其他开发最新文章
热门教程
热门工具
登录 关闭
扫码关注1秒登录
发送“验证码”获取 | 15天全站免登陆