dotnet tool install have trouble installing when an private feed is in nuget.config

@DerAlbertCom commented on Fri Jun 29 2018

Issue Title

dotnet tool install -g foobar does not install any tool if private nuget feed is in the nuget.config which requires authentication.

General

I tried ‘dotnet tool install -g sourcelink’, and have in the the global nuget.config the company nuget feed from vsts.

C:\Program Files\dotnet\sdk\2.1.301\NuGet.targets(114,5): error : Fehler beim Abrufen von Informationen zu "sourcelink" aus der Remotequelle "https://XYZ.pkgs.visualstudio.com/_packaging/172bc92f-50b3-48bc-b4cf-9555b7f0fd10/nuget/v3/flat2/fo/index.json". [C:\Users\DerAl\AppData\Local\Temp\ctdjxp0q.bbs\restore.csproj]
C:\Program Files\dotnet\sdk\2.1.301\NuGet.targets(114,5): error :   Response status code does not indicate success: 401 (Unauthorized). [C:\Users\DerAl\AppData\Local\Temp\ctdjxp0q.bbs\restore.csproj]

If i comment out the private feed out in then nuget.config, then the tool get’s installed.

nuget restore has not problem with the nuget feed. dotnet restore (which should not be used with VSTS because you have to store a Cleartext PAT in the nuget.config) clearly has the same problem like dotnet tool

Possible Workaround

See https://github.com/dotnet/sdk/issues/9555#issuecomment-802015061 in this issue discussing --ignore-failed-sources.

[DerAlbertCom]

Really? A Workaround? Why not just fix this. dotnet cli with authenticated feeds is a mess.

• not all commands accessing nuget feeds support --interactive
• –interactive does not work in newer sdks, because the logging of the needed oauth2 device flow information is swallowed.
• not all dotnet task in AzureDevOps supports selecting a Azure Artifact source

I’m really tired of this problems around the authenticated nuget feeds. For this reason we can not use Hosted Build Agents in Azure DevOps. We have to use a own Build Agent with CLEARTEXT Credentials in the config file.

We cannot use dotnet cli correctly from the command line on the dev machine without put the cleartext credentials in the dev machines.

Yes, for all this problems are issues filed, mostly with no information when it will be fixed, or zero reaction.

[BenjaminAbt]

My workaround because I also run in this issue on Azure DevOps (current VS2017 and VS2019 and Ubuntu with NuGet 4.9.4 and 5.0.0):

Create a single NuGet.config with only the nuget.org feed (you can also name it like NuGet-OfficialOnly.config

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
  </packageSources>
</configuration>

Now I am able to install via dotnet tool

Run

dotnet tool install --global GitVersion.Tool --version 5.0.0-beta2-65 --configfile NuGet-OfficialOnly.config