NuGet / NuGetGallery

NuGet Gallery is a package repository that powers https://www.nuget.org. Use this repo for reporting NuGet.org issues.
https://www.nuget.org/
Apache License 2.0
1.54k stars 644 forks source link

error NU3028: Package 'Microsoft.Identity.Client 4.21.1' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain #8401

Closed amagrath closed 3 years ago

amagrath commented 3 years ago

For issues regarding the NuGet client tools (the Visual Studio extension, NuGet.exe command line tool, etc.), file a bug on NuGet Home.

Describe the bug

The error described above and other identical errors for different packages has suddenly started appearing today during our build process using Docker on Linux. Other people seem to have encountered the same problem in the last few hours. Dotnet restore works fine on Windows.

To Reproduce

Expected behavior

No error during:

dotnet restore

Screenshots

An extract from the build output:

1>/usr/prstoDependencies/allPackageReferences.csproj : error NU3037: Package 'System.Buffers 4.5.1' from source 'https://api.nuget.org/v3/index.json': The author primary signature validity period has expired.

36 | Package 'System.Buffers 4.5.1' from source 'https://api.nuget.org/v3/index.json': Timestamp: 03/24/2020 17:10:13 37 |   38 | Package 'System.Buffers 4.5.1' from source 'https://api.nuget.org/v3/index.json': Verifying repository countersignature's timestamp with timestamping service certificate: 39 | Subject Name: CN=Symantec SHA256 TimeStamping Signer - G3, OU=Symantec Trust Network, O=Symantec Corporation, C=US 40 | SHA1 hash: A9A4121063D71D48E8529A4681DE803E3E7954B0 41 | SHA256 hash: C474CE76007D02394E0DA5E4DE7C14C680F9E282013CFEF653EF5DB71FDF61F8 42 | Issued by: CN=Symantec SHA256 TimeStamping CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US 43 | Valid from: 12/23/2017 00:00:00 to 03/22/2029 23:59:59 44 |   45 | 1>/usr/prstoDependencies/allPackageReferences.csproj : error NU3028: Package 'System.Buffers 4.5.1' from source 'https://api.nuget.org/v3/index.json': The repository countersignature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain 46 | Package 'System.Buffers 4.5.1' from source 'https://api.nuget.org/v3/index.json': Signature type: Repository 47 | Package 'System.Buffers 4.5.1' from source 'https://api.nuget.org/v3/index.json': nuget-v3-service-index-url: https://api.nuget.org/v3/index.json 48 | Package 'System.Buffers 4.5.1' from source 'https://api.nuget.org/v3/index.json': nuget-package-owners: dotnetframework, Microsoft 49 | Package 'System.Buffers 4.5.1' from source 'https://api.nuget.org/v3/index.json': Verifying the repository countersignature with certificate: 50 | Subject Name: CN=NuGet.org Repository by Microsoft, O=NuGet.org Repository by Microsoft, L=Redmond, S=Washington, C=US 51 | SHA1 hash: 8FB6D7FCF7AD49EB774446EFE778B33365BB7BFB 52 | SHA256 hash: 0E5F38F57DC1BCC806D8494F4F90FBCEDD988B46760709CBEEC6F4219AA6157D 53 | Issued by: CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US 54 | Valid from: 04/10/2018 00:00:00 to 04/14/2021 12:00:00 55 |   56 | Package 'Microsoft.NETCore.Platforms 5.0.0' from source 'https://api.nuget.org/v3/index.json': Signature Hash Algorithm: SHA256 57 | Package 'Microsoft.NETCore.Platforms 5.0.0' from source 'https://api.nuget.org/v3/index.json': Timestamp: 10/20/2020 13:02:06 58 |   59 | Package 'Microsoft.NETCore.Platforms 5.0.0' from source 'https://api.nuget.org/v3/index.json': Verifying author primary signature's timestamp with timestamping service certificate: 60 | Subject Name: CN=Symantec SHA256 TimeStamping Signer - G3, OU=Symantec Trust Network, O=Symantec Corporation, C=US 61 | SHA1 hash: A9A4121063D71D48E8529A4681DE803E3E7954B0 62 | SHA256 hash: C474CE76007D02394E0DA5E4DE7C14C680F9E282013CFEF653EF5DB71FDF61F8 63 | Issued by: CN=Symantec SHA256 TimeStamping CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US 64 | Valid from: 12/23/2017 00:00:00 to 03/22/2029 23:59:59 65 |   66 | 1>/usr/prstoDependencies/allPackageReferences.csproj : error NU3028: Package 'Microsoft.NETCore.Platforms 5.0.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain 67 | Package 'Microsoft.NETCore.Platforms 5.0.0' from source 'https://api.nuget.org/v3/index.json': Signature type: Author 68 | Package 'Microsoft.NETCore.Platforms 5.0.0' from source 'https://api.nuget.org/v3/index.json': Verifying the author primary signature with certificate: 69 | Subject Name: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US 70 | SHA1 hash: F404000FB11E61F446529981C7059A76C061631E 71 | SHA256 hash: 3F9001EA83C560D712C24CF213C3D312CB3BFF51EE89435D3430BD06B5D0EECE 72 | Issued by: CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US 73 | Valid from: 02/26/2018 00:00:00 to 01/27/2021 12:00:00 74 |   75 | 1>/usr/prstoDependencies/allPackageReferences.csproj : error NU3037: Package 'Microsoft.NETCore.Platforms 5.0.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature validity period has expired. 76 | Package 'Microsoft.NETCore.Platforms 5.0.0' from source 'https://api.nuget.org/v3/index.json': Timestamp: 11/09/2020 23:47:34 77 |   78 | Package 'Microsoft.NETCore.Platforms 5.0.0' from source 'https://api.nuget.org/v3/index.json': Verifying repository countersignature's timestamp with timestamping service certificate: 79 | Subject Name: CN=Symantec SHA256 TimeStamping Signer - G3, OU=Symantec Trust Network, O=Symantec Corporation, C=US 80 | SHA1 hash: A9A4121063D71D48E8529A4681DE803E3E7954B0 81 | SHA256 hash: C474CE76007D02394E0DA5E4DE7C14C680F9E282013CFEF653EF5DB71FDF61F8 82 | Issued by: CN=Symantec SHA256 TimeStamping CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US 83 | Valid from: 12/23/2017 00:00:00 to 03/22/2029 23:59:59 84 |   85 | 1>/usr/prstoDependencies/allPackageReferences.csproj : error NU3028: Package 'Microsoft.NETCore.Platforms 5.0.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain 86 | Package 'Microsoft.NETCore.Platforms 5.0.0' from source 'https://api.nuget.org/v3/index.json': Signature type: Repository 87 | Package 'Microsoft.NETCore.Platforms 5.0.0' from source 'https://api.nuget.org/v3/index.json': nuget-v3-service-index-url: https://api.nuget.org/v3/index.json 88 | Package 'Microsoft.NETCore.Platforms 5.0.0' from source 'https://api.nuget.org/v3/index.json': nuget-package-owners: dotnetframework, Microsoft 89 | Package 'Microsoft.NETCore.Platforms 5.0.0' from source 'https://api.nuget.org/v3/index.json': Verifying the repository countersignature with certificate: 90 | Subject Name: CN=NuGet.org Repository by Microsoft, O=NuGet.org Repository by Microsoft, L=Redmond, S=Washington, C=US 91 | SHA1 hash: 8FB6D7FCF7AD49EB774446EFE778B33365BB7BFB 92 | SHA256 hash: 0E5F38F57DC1BCC806D8494F4F90FBCEDD988B46760709CBEEC6F4219AA6157D 93 | Issued by: CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US 94 | Valid from: 04/10/2018 00:00:00 to 04/14/2021 12:00:00 95 |   96 | Package 'Microsoft.Extensions.Logging.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': Signature Hash Algorithm: SHA256 97 | Package 'Microsoft.Extensions.Logging.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': Timestamp: 10/20/2020 13:29:50 98 |   99 | Package 'Microsoft.Extensions.Logging.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': Verifying author primary signature's timestamp with timestamping service certificate: 100 | Subject Name: CN=Symantec SHA256 TimeStamping Signer - G3, OU=Symantec Trust Network, O=Symantec Corporation, C=US 101 | SHA1 hash: A9A4121063D71D48E8529A4681DE803E3E7954B0 102 | SHA256 hash: C474CE76007D02394E0DA5E4DE7C14C680F9E282013CFEF653EF5DB71FDF61F8 103 | Issued by: CN=Symantec SHA256 TimeStamping CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US 104 | Valid from: 12/23/2017 00:00:00 to 03/22/2029 23:59:59 105 |   106 | 1>/usr/prstoDependencies/allPackageReferences.csproj : error NU3028: Package 'Microsoft.Extensions.Logging.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain 107 | Package 'Microsoft.Extensions.Logging.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': Signature type: Author 108 | Package 'Microsoft.Extensions.Logging.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': Verifying the author primary signature with certificate: 109 | Subject Name: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US 110 | SHA1 hash: F404000FB11E61F446529981C7059A76C061631E 111 | SHA256 hash: 3F9001EA83C560D712C24CF213C3D312CB3BFF51EE89435D3430BD06B5D0EECE 112 | Issued by: CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US 113 | Valid from: 02/26/2018 00:00:00 to 01/27/2021 12:00:00 114 |   115 | 1>/usr/prstoDependencies/allPackageReferences.csproj : error NU3037: Package 'Microsoft.Extensions.Logging.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature validity period has expired. 116 | Package 'Microsoft.Extensions.Logging.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': Timestamp: 11/09/2020 23:46:46 117 |   118 | Package 'Microsoft.Extensions.Logging.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': Verifying repository countersignature's timestamp with timestamping service certificate: 119 | Subject Name: CN=Symantec SHA256 TimeStamping Signer - G3, OU=Symantec Trust Network, O=Symantec Corporation, C=US 120 | SHA1 hash: A9A4121063D71D48E8529A4681DE803E3E7954B0 121 | SHA256 hash: C474CE76007D02394E0DA5E4DE7C14C680F9E282013CFEF653EF5DB71FDF61F8 122 | Issued by: CN=Symantec SHA256 TimeStamping CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US 123 | Valid from: 12/23/2017 00:00:00 to 03/22/2029 23:59:59 124 |   125 | 1>/usr/prstoDependencies/allPackageReferences.csproj : error NU3028: Package 'Microsoft.Extensions.Logging.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain 126 | Package 'Microsoft.Extensions.Logging.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': Signature type: Repository 127 | Package 'Microsoft.Extensions.Logging.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': nuget-v3-service-index-url: https://api.nuget.org/v3/index.json 128 | Package 'Microsoft.Extensions.Logging.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': nuget-package-owners: aspnet, dotnetframework, Microsoft 129 | Package 'Microsoft.Extensions.Logging.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': Verifying the repository countersignature with certificate: 130 | Subject Name: CN=NuGet.org Repository by Microsoft, O=NuGet.org Repository by Microsoft, L=Redmond, S=Washington, C=US 131 | SHA1 hash: 8FB6D7FCF7AD49EB774446EFE778B33365BB7BFB 132 | SHA256 hash: 0E5F38F57DC1BCC806D8494F4F90FBCEDD988B46760709CBEEC6F4219AA6157D 133 | Issued by: CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US 134 | Valid from: 04/10/2018 00:00:00 to 04/14/2021 12:00:00 135 |   136 | Installing Microsoft.NETCore.Platforms 1.0.1. 137 | Installing System.Xml.XmlDocument 4.3.0. 138 | Installing Microsoft.Extensions.DependencyInjection 5.0.1. 139 | Installing Microsoft.EntityFrameworkCore.Abstractions 5.0.2. 140 | Installing System.Diagnostics.DiagnosticSource 5.0.1. 141 | Installing Microsoft.EntityFrameworkCore.Analyzers 5.0.2. 142 | Installing System.Collections.Immutable 5.0.0. 143 | Installing System.ComponentModel.Annotations 5.0.0. 144 | Installing Microsoft.Extensions.Caching.Memory 5.0.0. 145 | Package 'Microsoft.Extensions.Logging 5.0.0' from source 'https://api.nuget.org/v3/index.json': Signature Hash Algorithm: SHA256 146 | Package 'Microsoft.Extensions.Logging 5.0.0' from source 'https://api.nuget.org/v3/index.json': Timestamp: 10/20/2020 13:29:53 147 |   148 | Package 'Microsoft.Extensions.Logging 5.0.0' from source 'https://api.nuget.org/v3/index.json': Verifying author primary signature's timestamp with timestamping service certificate: 149 | Subject Name: CN=Symantec SHA256 TimeStamping Signer - G3, OU=Symantec Trust Network, O=Symantec Corporation, C=US 150 | SHA1 hash: A9A4121063D71D48E8529A4681DE803E3E7954B0 151 | SHA256 hash: C474CE76007D02394E0DA5E4DE7C14C680F9E282013CFEF653EF5DB71FDF61F8 152 | Issued by: CN=Symantec SHA256 TimeStamping CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US 153 | Valid from: 12/23/2017 00:00:00 to 03/22/2029 23:59:59

Additional context

Add any other context about the problem here.

augustoproiete commented 3 years ago

Duplicate of NuGet/Home#10491

loic-sharma commented 3 years ago

Hi, please see the workarounds listed in https://github.com/NuGet/Announcements/issues/49.

I'll close this off for now, but feel free to comment if you have any additional questions!