Intermittent NU3004 errors (fixed?)

Time to time I see errors like this one in the Arcade CI build:

error NU3004: Package 'vswhere 2.6.7' from source 'https://api.nuget.org/v3/index.json': This repository indicated that all its packages are repository signed; however, this package is unsigned.

Doesn’t make much sense to me as it happens only sometimes… The package is definitely signed.

Failure example: https://dev.azure.com/dnceng/public/_build/results?buildId=172551

[MattGal]

@riarenas yes I’ll get someone on this this morning.

[dtivel]

@tmat, there are 2 known scenarios where you might get this error erroneously:

1. You’re running a NuGet 5.0 client on the same machine as a NuGet 4.7-4.9 client. A bug in HTTP caching would enable a 4.7-4.9 client to incorrectly use a cached 5.0 resource. A fix should be available in NuGet 5.0.2 and 5.1. I worked with @MattGal on this, and I wonder if this is another report of the same issue. One workaround is to clear just the HTTP cache before calling NuGet (e.g.: `nuget.exe locals http-cache -clear).
2. You’re using NuGet.exe on Mono to restore signed packages. This was a bug; signed package verification should have been disabled when NuGet.exe runs on Mono. A fix should be available in NuGet 5.0.2 and 5.2.