[BUG]: dotnet restore ignores proxy settings after upgrade to 8.0

dpiatkowski-selsey commented 8 months ago

Task name

DotNetCoreCLI

Task version

2

Environment type (Please select at least one enviroment where you face this issue)

[X] Self-Hosted
[ ] Microsoft Hosted
[ ] VMSS Pool
[ ] Container

Azure DevOps Server type

dev.azure.com (formerly visualstudio.com)

Azure DevOps Server Version (if applicable)

No response

Operation system

Ubuntu 20.04

Task log

/data/azure_devops/agent/_work/_tool/dotnet/dotnet test /data/azure_devops/agent/_work/663/s/./Frontend.Tests/Frontend.Tests.csproj --logger trx --results-directory /data/azure_devops/agent/_work/_temp --configuration Release
  Determining projects to restore...
/data/azure_devops/agent/_work/_tool/dotnet/sdk/8.0.100-rc.2.23502.2/NuGet.targets(156,5): error : Unable to load the service index for source <redacted-url-of-feed>. [/data/azure_devops/agent/_work/663/s/Frontend.Tests/Frontend.Tests.csproj]
/data/azure_devops/agent/_work/_tool/dotnet/sdk/8.0.100-rc.2.23502.2/NuGet.targets(156,5): error :   The proxy tunnel request to proxy '<redacted-url-of-proxy>' failed with status code '403'." [/data/azure_devops/agent/_work/663/s/Frontend.Tests/Frontend.Tests.csproj]

Relevant log output

(Restore target) -> 
         /data/azure_devops/agent/_work/_tool/dotnet/sdk/8.0.100-rc.2.23502.2/NuGet.targets(156,5): error : Unable to load the service index for source <redacted-url-of-feed>. [/data/azure_devops/agent/_work/663/s/Frontend.Tests/Frontend.Tests.csproj]
       /data/azure_devops/agent/_work/_tool/dotnet/sdk/8.0.100-rc.2.23502.2/NuGet.targets(156,5): error :   The proxy tunnel request to proxy '<redacted-url-of-proxy>' failed with status code '403'." [/data/azure_devops/agent/_work/663/s/Frontend.Tests/Frontend.Tests.csproj]

Aditional info

Similiar issue to https://github.com/NuGet/Home/issues/10932.

After upgrading .NET SDK to 8.0.100-rc.2.23502.2 on self-hosted agent

task: UseDotNet@2
inputs:
  packageType: sdk
  version: 8.x
  includePreviewVersions: true

Simple dotnet test command fails during restore:

task: DotNetCoreCLI@2
inputs:
  command: 'test'
  projects: './Frontend.Tests/Frontend.Tests.csproj'
  arguments: '--configuration Release'

redacted-url-of-feed is a private NuGet feed based on Nexus and it is accesssible from agent host. Our nuget.config has rule for this feed.

<config>
    <add key="no_proxy" value="<domain-of-feed>" />
</config>

JasionowiczAdam commented 7 months ago

https://learn.microsoft.com/en-us/nuget/concepts/auditing-packages

This information should help.

michalwawa commented 6 months ago

Is anything happening to this issue ? We cant restore/publish our apps on .NET 8 because of the same issue

doeringp commented 1 day ago

I have the same problem on-premises with Azure DevOps Server after updating to Update 2 RTW that was release on July 9, 2024.

My agent configuration:

.proxy

http://proxy.contoso.local:9400

.proxybypass

tfs\.contoso\.local

I figured out that every time the UseDotNet@2-task runs in a pipeline it updates my user's NuGet.config and adds a <config> section:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
  </packageSources>
  <config>
    <add key="http_proxy" value="http://proxy.contoso.local:9400" />
    <add key="http_proxy.user" value="undefined" />
    <add key="http_proxy.password" value="***redacted***" />
    <add key="no_proxy" value="tfs\.contoso\.local" />
  </config>
</configuration>

In my Azure Pipeline I get an error when using the .NET CLI to access NuGet-Packages in my private NuGet feed that is hosted in tfs.contoso.local.

error: Unable to load the service index for source https://tfs.contoso.local/tfs/MyCollection/_packaging/f3c24039-7352-4a99-97a0-d4e2950bb962/nuget/v3/index.json.
error: The proxy tunnel request to proxy 'http://proxy.contoso.local:9400/' failed with status code '502'."

I think the cause of the problem is the element <add key="no_proxy" value="tfs\.contoso\.local" /> that is added to the <config> section. It seems that the value for no_proxy is directly copied from the Agent's .proxybpass file.

As the documentation says the content of the .proxybypass file should be a list of regular expressions.

The no_proxy variable for NuGet should be a a comma-separated list of domains the bypass the proxy server.

When I manually remove the \ from the value in no_proxy in the NuGet.config, it is working again.

I think the bug came in with the last change to the UseDotNetV2 task: #19252

microsoft / azure-pipelines-tasks