search

microsoft / security-devops-azdevops

Microsoft Security DevOps extension for Azure DevOps.
MIT License
59 stars 14 forks source link

MicrosoftSecurityDevOps@1 failing to download packages from pkgs.dev.azure.com with 403 error #95

Closed kalebpederson closed 6 months ago

kalebpederson commented 6 months ago

I'm running MicrosoftSecurityDevOps@1 with the default parameters:

- task: MicrosoftSecurityDevOps@1
  displayName: "Run MSDO"

The above task is now failing with a 403 downloading content from https://pkgs.dev.azure.com/secdevtools/...:

2024-01-02T20:57:34.2269312Z Retrieving package 'Microsoft.Security.CodeAnalysis.Policy.Names 1.0.3' from 'MSCA.Policy'. 2024-01-02T20:57:34.2410308Z GET https://pkgs.dev.azure.com/secdevtools/fbe8430b-c7d4-4187-8c71-a0083ead3d4b/_packaging/a2fd5474-7706-4971-8654-fd0403cf8e6a/nuget/v3/flat2/microsoft.security.codeanalysis.policy.names/1.0.3/microsoft.security.codeanalysis.policy.names.1.0.3.nupkg 2024-01-02T20:57:34.6018358Z Forbidden https://pkgs.dev.azure.com/secdevtools/fbe8430b-c7d4-4187-8c71-a0083ead3d4b/_packaging/a2fd5474-7706-4971-8654-fd0403cf8e6a/nuget/v3/flat2/microsoft.security.codeanalysis.policy.names/1.0.3/microsoft.security.codeanalysis.policy.names.1.0.3.nupkg 360ms 2024-01-02T20:57:34.6076207Z Error downloading 'Microsoft.Security.CodeAnalysis.Policy.Names.1.0.3' from 'https://pkgs.dev.azure.com/secdevtools/fbe8430b-c7d4-4187-8c71-a0083ead3d4b/_packaging/a2fd5474-7706-4971-8654-fd0403cf8e6a/nuget/v3/flat2/microsoft.security.codeanalysis.policy.names/1.0.3/microsoft.security.codeanalysis.policy.names.1.0.3.nupkg'. 2024-01-02T20:57:34.6077023Z Response status code does not indicate success: 403 (Forbidden).

Although I wouldn't expect it to matter, I saw another issue where somebody mentioned inconsistencies based on the dotnet version, so I'll mention that I'm using dotnet 6:

- task: UseDotNet@2
  displayName: "Use DotNET 6.0.x"
  inputs:
    version: 6.0.x
kalebpederson commented 6 months ago

I have attached the full log file for the task: msdo.log

kalebpederson commented 6 months ago

Without us having made any changes, the task started working this morning. I will assume it was either a transient issue or it was discovered and addressed prior to this issue having been seen and responded to.