NuGet Restore fails when using Nuget.config with an azure artifacts feed

Required Information

Entering this information will route you directly to the right team and expedite traction.

NuGet restore fails when nuget.config contains azure artifacts feed

The following issue that was closed, sums up the issue nicely: https://github.com/Microsoft/azure-pipelines-tasks/issues/7353

Environment

Azure Pipelines

Issue Description

As per https://github.com/Microsoft/azure-pipelines-tasks/issues/7353 Someone kindly left a workaround, which is to manually add authentication details in clear text for the azure artifacts nuget feed first, before doing a NuGet restore like so:

  - task: NuGetCommand@2
    displayName: 'Authenticate with NuGet feed'
    inputs:
      command: custom
      arguments: sources update -Name "Your_Azure_Artifacts_Feed_In_Config" -Username "this_value_could_anything" -Password "$(System.AccessToken)" -StorePasswordInClearText -ConfigFile NuGet.Config

- task: DotNetCoreCLI@2
    displayName: Restore
    inputs:
      command: restore
      projects: '$(solution)'
      selectOrConfig: config
      nugetConfigPath: $(Build.SourcesDirectory)/NuGet.config   

However even though this works, it’s not great in that the system access token is written to the nuget.config file in the clear.

I have also found that its not only NuGetRestore that is impacted by this feed authentication issue. If as part of your build, you install a tool using the dotnet sdk like so, you will also hit the same error:

  - script: dotnet tool install -g dotnet-format # with an azure artifacts feed in nuget.config this will fail with a 401

Surely there is a better way to authenticate with an azure artfiacts feed, once for the scope of the entire pipeline? and not have to add manual scripts to authenticate with the feed in each seperate job that may use a feed - storing the access token in the clear in the nuget.config?

Task logs

See linked issue. Log output ends up showing a 401 when anything tries to interact with an azure artifacts feed that is in the nuget.config.

C:\Program Files\dotnet\sdk\3.1.201\NuGet.targets(124,5): error : Unable to load the service index for source https://pkgs.dev.azure.com/foo/_packaging/bar/nuget/v3/index.json. [C:\Users\VssAdministrator\AppData\Local\Temp\3ro4ldor.3si\restore.csproj] C:\Program Files\dotnet\sdk\3.1.201\NuGet.targets(124,5): error : Response status code does not indicate success: 401 (Unauthorized). [C:\Users\VssAdministrator\AppData\Local\Temp\3ro4ldor.3si\restore.csproj] The tool package could not be restored. Tool ‘dotnet-format’ failed to install. This failure may have been caused by:

Troubleshooting

Checkout how to troubleshoot failures and collect debug logs: https://docs.microsoft.com/en-us/vsts/build-release/actions/troubleshooting

Error logs

[Insert error from the logs here for a quick overview]

[Skleni]

When you edit your pipeline, there’s a variables button in the upper right corner. I added the variables there:

[herenhuang]

Awesome, we’ll close this issue for now, though please do reopen if you have issues!