An accurate depiction of a NuGet package factory

How to fix NU3028 and NU3037 errors in Azure DevOps builds?

This post was most recently updated on September 29th, 2022.

7 min read.

This article explains a solution to a rather annoying issue, where certificate validation for builds trying to fetch NuGet packages published by Microsoft fails when using .NET 5. This happens at least with Docker build when you’re relying on some Microsoft-provided images… But probably also in a lot of other cases.

Problem

When running an Azure DevOps pipeline with any task that does any Docker stuff, your build fails. Or if you’ve configured your build differently, perhaps the task just fails. Or if your configuration is even weirder, your task is fine but building the image fails. Plenty of different ways to configure your pipeline, it seems, but the main point is that your log is pretty much full of this fluff:

The author primary signature’s timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain

The author primary signature validity period has expired.

The repository countersignature’s timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain

The repository countersignature validity period has expired.

nuget.exe

And restoring dependencies in your build – most likely in a Docker container build task – fails.

Below, there’s a bit of logging for you, if you’re interested.

Click to view
nuget restore throws SOOOO many kinda unnecessary errors - see for yourself...
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Collections.Concurrent 4.0.12' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Collections.Concurrent 4.0.12' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Text.Encoding.Extensions 4.0.11' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Text.Encoding.Extensions 4.0.11' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Xml.XmlDocument 4.0.1' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Xml.XmlDocument 4.0.1' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Threading.Tasks.Extensions 4.0.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Threading.Tasks.Extensions 4.0.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Xml.XmlSerializer 4.0.11' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Xml.XmlSerializer 4.0.11' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Text.RegularExpressions 4.1.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Text.RegularExpressions 4.1.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'runtime.native.System 4.0.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'runtime.native.System 4.0.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.Win32.SystemEvents 4.7.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.Win32.SystemEvents 4.7.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.Win32.SystemEvents 4.7.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.Win32.SystemEvents 4.7.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Xml.ReaderWriter 4.0.11' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Xml.ReaderWriter 4.0.11' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Security.Cryptography.Encoding 4.0.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Security.Cryptography.Encoding 4.0.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Swashbuckle.AspNetCore 5.6.3' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Swashbuckle.AspNetCore 5.6.3' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.Extensions.DependencyInjection.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.Extensions.DependencyInjection.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.Extensions.DependencyInjection.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.Extensions.DependencyInjection.Abstractions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.AspNetCore.Mvc.NewtonsoftJson 5.0.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.AspNetCore.Mvc.NewtonsoftJson 5.0.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.AspNetCore.Mvc.NewtonsoftJson 5.0.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.AspNetCore.Mvc.NewtonsoftJson 5.0.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Security.Cryptography.Algorithms 4.2.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Security.Cryptography.Algorithms 4.2.0' from source 'https://api.nuget.org/v3/index.json': The repository primary signature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.AspNetCore.SpaServices.Extensions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.AspNetCore.SpaServices.Extensions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.AspNetCore.SpaServices.Extensions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.AspNetCore.SpaServices.Extensions 5.0.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Text.Json 4.7.2' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Text.Json 4.7.2' from source 'https://api.nuget.org/v3/index.json': The author primary signature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'System.Text.Json 4.7.2' from source 'https://api.nuget.org/v3/index.json': The repository countersignature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'System.Text.Json 4.7.2' from source 'https://api.nuget.org/v3/index.json': The repository countersignature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.AspNetCore.Authentication.Cookies 2.2.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.AspNetCore.Authentication.Cookies 2.2.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.AspNetCore.Authentication.Cookies 2.2.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3037: Package 'Microsoft.AspNetCore.Authentication.Cookies 2.2.0' from source 'https://api.nuget.org/v3/index.json': The repository countersignature validity period has expired.
/home/vsts/work/1/s/ProjectName/ProjectName.csproj : error NU3028: Package 'Microsoft.ApplicationInsights.AspNetCore 2.15.0' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain

But what’s causing this?

Reason

This is kind of a long-standing, classic issue. In my case, it popped up as a combination of having to use .NET 5 instead of .NET 6 or .NET 7, and some Docker images I had no control over.

The issue was originally caused by the certificate that’s used to sign NuGet packages hosted by Microsoft expiring. Minor stuff, but since older versions of .NET 5 have dependencies that apparently now are expired and not trusted unless you can ignore the publisher verification (which you generally shouldn’t do, but perhaps this case is an exception!) your builds might not pass.

Locally, that’s probably something that you can work around. But in Azure DevOps’ build agents? Yeah, that’s a different story!

Solution

This solution should fix the issue in case it’s your Azure DevOps pipelines fail. (If you’re encountering this in a local build, the solution as is won’t work).

Anyway, if you’re using Docker, your default option should be to upgrade your base images for your Docker container. If that’s not possible, check out the steps below:

Time needed: 20 minutes.

How to fix NU3028 and NU3037 errors in Azure DevOps builds?

  1. Add a variable for the SDK version to your pipeline

    There are a few ways you can do this:
    1) Add a variable to your Pipeline
    2) Bind a Variable Group to your Pipeline and add the variable there
    3) Add a variable to your YAML file

    In any case, we’ll call the variable “SdkVersion“, and it’ll have a value of “5.0.214” (for the latest .NET 5 SDK version).

  2. Add DotNet task

    To your YAML file, add a task somewhat like this:
      - task: [email protected]
        displayName: Use .NET SDK required for project
        inputs:
          version: $(SdkVersion)

    Or, you know, modify your existing task. The main point is to use the variable from earlier.

  3. Rerun your Pipeline

    Trigger the pipeline again to see if anything changed.

And with any luck, you should be good!


References

mm
0 0 votes
Article Rating
Subscribe
Notify of
guest

0 Comments
Inline Feedbacks
View all comments