search

dotnet / aspire

Tools, templates, and packages to accelerate building observable, production-ready apps
https://learn.microsoft.com/dotnet/aspire
MIT License
3.95k stars 485 forks source link

Microsoft.NET.Sdk.Aspire.Manifest-8.0.100.Msi.x64.8.0.0-preview.4.24114.2 not signed #2228

Open cisionmarkwalls opened 9 months ago

cisionmarkwalls commented 9 months ago

When running dotnet workload install aspire Microsoft.NET.Sdk.Aspire.Manifest-8.0.100.Msi.x64.8.0.0-preview.4.24114.2 is not signed.

image

danegsta commented 9 months ago

Looks like you've got the dotnet8 feed somewhere in your nuget configs; that's the feed that unsigned main branch builds are pushed to (main is currently preview.4, preview.3 is the most recent signed production release). Because of some weirdness with how the dotnet sdk handles workload updates, if you restore a project that has dotnet8 in its feeds, the sdk will potentially pickup the newer (versioned) Aspire build on the feed and update what's called the advertising manifest (basically metadata on what updates are available for workloads) to point to that newer build, despite the fact that it isn't a signed build.

If you do want to install and try out a daily preview.4 build, you can follow the instructions in these docs to disable the sign check when installing the workload.

If you'd like to make sure you're on the latest signed public preview (currently preview.3), there's a helper script in the repo that will ensure you have the latest public preview. Once you run that script, I'd recommend removing the .NET advertising manifest cache (~/.dotnet/sdk-advertising), as well as removing the dotnet8 feed from any projects that still have it in their nuget.config (that feed was primarily for pre-release packages ahead of the final dotnet8 release).