Workloads: Feed authentication during install doesn't seem to work at all on macOS

dotnet SDK 6.0.300 Azure Artifacts Credential Provider 1.0.0 (.NET 6 build)

1. Configure https://github.com/Microsoft/artifacts-credprovider with a valid Azure DevOps package read/write token (confirmed by doing a restore from private feed).
2. Run sudo dotnet workload install macos --source https://pkgs.dev.azure.com/MY_PROJECT/nuget/v3/index.json

Expected results

SDK coordinates with https://github.com/Microsoft/artifacts-credprovider to authenticate to https://pkgs.dev.azure.com/MY_PROJECT/nuget/v3/index.json and requests workload packages from the feed (which may in turn pull them from any configured upstreams).

Actual results

Failed to update the advertising manifest microsoft.net.sdk.tvos: Unable to load the service index for source https://pkgs.dev.azure.com/MY_PROJECT/nuget/v3/index.json..
Failed to update the advertising manifest microsoft.net.sdk.android: Unable to load the service index for source https://pkgs.dev.azure.com/MY_PROJECT/nuget/v3/index.json..
Failed to update the advertising manifest microsoft.net.sdk.maui: Unable to load the service index for source https://pkgs.dev.azure.com/MY_PROJECT/nuget/v3/index.json..
Failed to update the advertising manifest microsoft.net.sdk.macos: Unable to load the service index for source https://pkgs.dev.azure.com/MY_PROJECT/nuget/v3/index.json..
Failed to update the advertising manifest microsoft.net.workload.emscripten: Unable to load the service index for source https://pkgs.dev.azure.com/MY_PROJECT/nuget/v3/index.json..
Failed to update the advertising manifest microsoft.net.sdk.maccatalyst: Unable to load the service index for source https://pkgs.dev.azure.com/MY_PROJECT/nuget/v3/index.json..
Failed to update the advertising manifest microsoft.net.sdk.ios: Unable to load the service index for source https://pkgs.dev.azure.com/MY_PROJECT/nuget/v3/index.json..
Failed to update the advertising manifest microsoft.net.workload.mono.toolchain: Unable to load the service index for source https://pkgs.dev.azure.com/MY_PROJECT/nuget/v3/index.json..
Installing workload manifest microsoft.net.sdk.tvos version 15.4.303…
Workload installation failed. Rolling back installed packs...
Workload installation failed: Failed to install manifest microsoft.net.sdk.tvos version 15.4.303: Unable to load the service index for source https://pkgs.dev.azure.com/MY_PROJECT/nuget/v3/index.json..

Unless there is some way to work around this, this should be considered a critical security issue. Projects should not have to use nuget.org (or other public feeds) directly to install workloads.

[nagilson]

Also though, perhaps this is a sign we need to improve the error handling for --source as it is currently rather confusing… I will create an issue for that.

[nagilson]

That happened for me while trying to reproduce the issue but didn’t occur when --source was removed. It seems like --source was looking for an updated semantic version of the workload that didn’t exist. We will probably talk about this as a team tomorrow with people who have more workloads expertise and historical knowledge and try to get back to you.