Dotnet restore fails on Windows 10 with PartialChain certificate error when using a private github nuget repository #2890
Replies: 16 comments
-
|
I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label. |
Beta Was this translation helpful? Give feedback.
-
|
@nkolev92 - Can you help us troubleshoot this? |
Beta Was this translation helpful? Give feedback.
-
|
NuGet communicates via http in a very standard way. https://developercommunity2.visualstudio.com/t/VS-2019-Publish-issue---Unable-to-load-t/1257366#T-N1257595 is the best I could find, but maybe he has some better instructions? |
Beta Was this translation helpful? Give feedback.
-
|
@nkolev92 - Thanks for the input. Reading the link followed a couple of the referenced links further and found this comment
The output from the For the Docker build to work on WIndows, I assume I would have to disable TLS1.3 support in the WIndows host. Is that a correct assumption or would that need to be done in the docker image? |
Beta Was this translation helpful? Give feedback.
-
|
My understanding is that newer versions of Windows 10 have a new TLS 1.3 implementation so should work now. But as Nikolche wrote, we use |
Beta Was this translation helpful? Give feedback.
-
|
@zikvan, that's what's confused me somewhat. A Further, from the detailed output, I can see that the first stage of the restore process succeeds as the package from the private repository is located from the call to It seems that the call to the download link However, if I copy this link from the Docker output and post it to my browser, the download will succeed without error although it does seem to take several seconds to start. I did note, that the link redirects to |
Beta Was this translation helpful? Give feedback.
-
|
You should be able to write a simple .NET console app that uses |
Beta Was this translation helpful? Give feedback.
-
|
@mthalman I put togtether a really simple console app to grab the URL. When I run it from a Windows 10 CLI, I get the expected output as follows However, when containerize it (using a similar Dockerfile) it will builds without issue. However, when I run the Docker container, I get the same error as my original problem with an SSL PartialChain error. For reference, this is the Dockerfile I used -- it may be overkill, but I kept it similar to the original issue. The |
Beta Was this translation helpful? Give feedback.
-
|
Ok, so this doesn't seem specific to NuGet. @bartonjs - Are you familiar with SSL PartialChain errors and why that might be happening here? |
Beta Was this translation helpful? Give feedback.
-
|
The Generally, for a TLS connection the server sends their certificate and all intermediates between their end-entity certificate and the root, but not the root itself -- the idea being that the client machine either doesn't trust the root or already has a copy of that certificate it can use, so it's a waste of bandwidth. Doing a test against nuget.pkg.github.com right now, I see that it presents two certificates: On my test machine the DigiCert High Assurance EV Root CA root is known and trusted, so everything's copacetic for me. Since I'd expect that root to also be known to, and trusted by, Windows Docker containers, it seems like the most likely explanation is that the container was running in something like a captive network environment and it got some alternate certificate that it couldn't work out. What's interesting, though, is that |
Beta Was this translation helpful? Give feedback.
-
|
So this is the output I see from the Windows container when checking the roots: ❯ docker run --rm mcr.microsoft.com/dotnet/sdk:5.0 pwsh -c "dir Cert:\CurrentUser\Root | select Subject"
Subject
-------
CN=Microsoft Root Certificate Authority, DC=microsoft, DC=com
CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, S…
CN=Microsoft Root Authority, OU=Microsoft Corporation, OU=Copyright (c) 1997 M…
CN=Symantec Enterprise Mobile Root for Microsoft, O=Symantec Corporation, C=US
CN=Microsoft Root Certificate Authority 2011, O=Microsoft Corporation, L=Redmo…
CN=Microsoft Authenticode(tm) Root Authority, O=MSFT, C=US
CN=Microsoft Root Certificate Authority 2010, O=Microsoft Corporation, L=Redmo…
CN=Microsoft ECC TS Root Certificate Authority 2018, O=Microsoft Corporation, …
OU=Copyright (c) 1997 Microsoft Corp., OU=Microsoft Time Stamping Service Root…
OU="NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.", OU=VeriSign Time Stamping Se…
CN=Microsoft ECC Product Root Certificate Authority 2018, O=Microsoft Corporat…
OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US
OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=USI don't see |
Beta Was this translation helpful? Give feedback.
-
|
That seems like a good piece of evidence, yeah. |
Beta Was this translation helpful? Give feedback.
-
|
I attempted to repro this myself and was unsuccessful. I published a package to my own GitHub package repo and attempted to download it directly with the above code from @otisaardvark inside of a Windows container ( @otisaardvark - Are you pulling down the latest version of |
Beta Was this translation helpful? Give feedback.
-
|
@mthalman - I am using the most recent Windows container I am using Windows 10 Pro build 19042.929 |
Beta Was this translation helpful? Give feedback.
-
|
@mthalman - Something by way of an update on some further testing.... I installed Docker Desktop on a different Windows 10 machine and cloned my test repo that fails on my primary development machine. Both the native and the containerized builds ran without any issue. So I am left with the thought that it must be something machine dependent that is causing the certificate issue. What, in the host machines configuration, could cause an issue in the Docker build process? Compiling and running the app without Docker is error-free. As soon as Docker is introduced it fails? |
Beta Was this translation helpful? Give feedback.
-
|
I'm going to convert this from an issue to a discussion since you've been able to get this working on a different machine. I agree that it seems to be a machine configuration issue but I don't know what that might be. In any case, it doesn't seem to be an issue with the configuration of the Docker image itself. If there is an issue with .NET here, it would be in the https://github.com/dotnet/runtime repo but there needs to be a reliable repro. |
Beta Was this translation helpful? Give feedback.
-
Describe the Bug
On WIndows 10, the
RUN dotnet restorestep fails during a docker build when the project references one or more Nuget packages hosted in a private Github repository and throw a SSL PartialChain error. The error is being thrown at the point an attempt is made to download the package but after the package has been located in the package repository.The process when run on a Linux laptop (Ubuntu 20.04) using the same Docker build files and project source code completes without any error.
The equivalent
dotnet restoreanddotnet buildrun from the Windows CLI for the same project complete without error.Steps to Reproduce
docker-compose.yml
Dockerfile
Other Information
The following error is returned by the process
The
Nuget.configfile that is copied in the build process contains sources for the public nuget package repository and the private github package repository complete with username and personal access token (for the purpose of testing only). Removing the PAT from the nuget file results in a 401 (Unauthorised) error, so it does not appear to be an issue with config.Adding the
--verbosity detailedoption to thedotnet restoreindicates that the package is correctly located in the repository, but the download action fails with the error above.I've checked the certificate chain in the docker image for the Github package repository on both Windows and Linux using the following command: -
The same output returned on both platforms that suggest the certificate chain is complete and not a partial chain as the error indicates.
Output of
docker versionOutput of
docker infoBeta Was this translation helpful? Give feedback.
All reactions