Nuget: This package is signed but not by a trusted signer

user_11836147 0
Viewed 2659

I need your help please.

My config:

  • Visual Studio Community 2019
  • Windows 10 x64 1909

I want to download packages using nuget but I always get this f**ked error (see title).

Structure of my solution folder:

  • D:\MySln\
    • nuget.config
    • nuget_packages
    • HelloWorld\
    • HelloSun\

My nuget.config file: https://docs.microsoft.com/en-us/nuget/reference/nuget-config-file

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <config>
    <!--
        Used to specify the default location to expand packages.
        See: nuget.exe help install
        See: nuget.exe help update

        In this example, %PACKAGEHOME% is an environment variable.
        This syntax works on Windows/Mac/Linux
    -->
       <add key="repositoryPath" value=".\nuget_packages" />

    <!--
        Used to specify default source for the push command.
        See: nuget.exe help push
    -->
        <!--
        <add key="defaultPushSource" value="https://MyRepo/ES/api/v2/package" />
    -->

    <!-- Proxy settings -->
        <add key="http_proxy" value="host" />
        <add key="http_proxy.user" value="username" />
        <add key="http_proxy.password" value="encrypted_password" />
    </config>

    <packageRestore>
    <!-- Allow NuGet to download missing packages -->
        <add key="enabled" value="True" />

    <!-- Automatically check for missing packages during build in Visual Studio -->
        <add key="automatic" value="True" />
    </packageRestore>

<!--
    Used to specify the default Sources for list, install and update.
    See: nuget.exe help list
    See: nuget.exe help install
    See: nuget.exe help update
-->
    <packageSources>
        <add key="NuGet official package source" value="https://api.nuget.org/v3/index.json" />
        <!--
        <add key="MyRepo - ES" value="https://MyRepo/ES/nuget" />
        -->
    </packageSources>

<!-- Used to store credentials -->
    <packageSourceCredentials />

<!-- Used to disable package sources  -->
    <disabledPackageSources />

<!--
    Used to specify default API key associated with sources.
    See: nuget.exe help setApiKey
    See: nuget.exe help push
    See: nuget.exe help mirror
-->
    <apikeys>
        <add key="https://MyRepo/ES/api/v2/package" value="encrypted_api_key" />
   </apikeys>

<!--
    Used to specify trusted signers to allow during signature verification.
    See: nuget.exe help trusted-signers
-->
    <trustedSigners>
        <author name="microsoft">
            <certificate fingerprint="3F9001EA83C560D712C24CF213C3D312CB3BFF51EE89435D3430BD06B5D0EECE" hashAlgorithm="SHA256" allowUntrustedRoot="false" />
        </author>
        <repository name="nuget.org" serviceIndex="https://api.nuget.org/v3/index.json">
            <certificate fingerprint="0E5F38F57DC1BCC806D8494F4F90FBCEDD988B46760709CBEEC6F4219AA6157D" hashAlgorithm="SHA256" allowUntrustedRoot="false" />
            <owners>microsoft;aspnet;nuget</owners>
        </repository>
    </trustedSigners>
</configuration>

I always have that error whether it's with nuget cli or with Visual Studio Nuget Package Manager.

Thank you for helping !

visual-studio-2019 nuget
1 Answers

The end of your nuget.config has the trustedSigners section which says to trust only:

  • Packages signed by Microsoft's signing certificate. No other package authors are trusted.
  • Only trust packages from nuget.org, no other source
    • from nuget.org, only trust packages owned by the microsoft, aspnet and nuget accounts

Any other packages (for example newtonsoft.json, xunit, nunit, whatever) will not be trusted because it does not meet this criteria.

If you're not working in an environment where a "secure supply chain" must be managed very strictly, you can delete the entire trustedSigners section from the nuget.config.

Depending on what you want to achieve (why you enabled trusted signers in the first place), lock files might be a less strict way to reduce the risk of CI machines using a different package to what you used on your own devbox.

More docs on trusted signers: https://docs.microsoft.com/en-us/nuget/consume-packages/installing-signed-packages

user_28430650
Related