[NETSDKE2E]With NET 8.0.200 preview SDK installed, Error "NU3004: The package is not signed." for Microsoft.NET.Sdk.Aspire.Manifest-8.0.100.8.0.0-preview.3.24054.2 happens when installing workloads.

[vdanche]

Description

Workload(maui or wasm-tools) in CLI can be installed successfully, but Error "NU3004: The package is not signed." for Microsoft.NET.Sdk.Aspire.Manifest-8.0.100.8.0.0-preview.3.24054.2 happens during installing workload.

Steps to Reproduce

1. install sdk: Pipelines - Run 20240103.1-8.0.200-preview.24053.15-206467 (azure.com) on win11

2. dotnet workload install maui or dotnet workload install wasm-tools

Expected Result: Workload can be installed successfully.

Actual Result: Workload can be installed successfully, but Error "NU3004: The package is not signed." for Microsoft.NET.Sdk.Aspire.Manifest-8.0.100.8.0.0-preview.3.24054.2 happens during installing workload.

details: Failed to update the advertising manifest microsoft.net.sdk.aspire: Failed to validate package signing.

Verifying Microsoft.NET.Sdk.Aspire.Manifest-8.0.100.8.0.0-preview.3.24054.2

error: NU3004: The package is not signed.

Package signature validation failed.

. Installing pack Microsoft.NET.Runtime.WebAssembly.Sdk version 8.0.0... Writing workload pack installation record for Microsoft.NET.Runtime.WebAssembly.Sdk version 8.0.0... Installing pack Microsoft.NETCore.App.Runtime.Mono.browser-wasm version 8.0.0... Writing workload pack installation record for Microsoft.NETCore.App.Runtime.Mono.browser-wasm version 8.0.0... Installing pack Microsoft.NETCore.App.Runtime.AOT.win-x64.Cross.browser-wasm version 8.0.0... Writing workload pack installation record for Microsoft.NETCore.App.Runtime.AOT.Cross.browser-wasm version 8.0.0... Installing pack Microsoft.NET.Runtime.MonoAOTCompiler.Task version 8.0.0... Writing workload pack installation record for Microsoft.NET.Runtime.MonoAOTCompiler.Task version 8.0.0... Installing pack Microsoft.NET.Runtime.MonoTargets.Sdk version 8.0.0... Writing workload pack installation record for Microsoft.NET.Runtime.MonoTargets.Sdk version 8.0.0... Installing pack Microsoft.NET.Runtime.Emscripten.3.1.34.Node.win-x64 version 8.0.0... Writing workload pack installation record for Microsoft.NET.Runtime.Emscripten.Node version 8.0.0... Installing pack Microsoft.NET.Runtime.Emscripten.3.1.34.Python.win-x64 version 8.0.0... Writing workload pack installation record for Microsoft.NET.Runtime.Emscripten.Python version 8.0.0... Installing pack Microsoft.NET.Runtime.Emscripten.3.1.34.Cache.win-x64 version 8.0.0... Writing workload pack installation record for Microsoft.NET.Runtime.Emscripten.Cache version 8.0.0... Installing pack Microsoft.NET.Runtime.Emscripten.3.1.34.Sdk.win-x64 version 8.0.0... Writing workload pack installation record for Microsoft.NET.Runtime.Emscripten.Sdk version 8.0.0... Garbage collecting for SDK feature band(s) 8.0.200-preview.24053...

Successfully installed workload(s) wasm-tools.

dotnet --info C:\Users\v-yuluhe>dotnet --info .NET SDK: Version: 8.0.200-preview.24053.15 Commit: e7e0a0b72b Workload version: 8.0.200-manifests.9f3f18d7

Runtime Environment: OS Name: Windows OS Version: 10.0.25398 OS Platform: Windows RID: win-x64 Base Path: C:\Users\v-yuluhe\Downloads\dotnet-sdk-8.0.200-preview.24053.15-win-x64\sdk\8.0.200-preview.24053.15\

.NET workloads installed: There are no installed workloads to display.

Host: Version: 8.0.0 Architecture: x64 Commit: 5535e31a71

.NET SDKs installed: 8.0.200-preview.24053.15 [C:\Users\v-yuluhe\Downloads\dotnet-sdk-8.0.200-preview.24053.15-win-x64\sdk]

.NET runtimes installed: Microsoft.AspNetCore.App 8.0.0 [C:\Users\v-yuluhe\Downloads\dotnet-sdk-8.0.200-preview.24053.15-win-x64\shared\Microsoft.AspNetCore.App] Microsoft.NETCore.App 8.0.0 [C:\Users\v-yuluhe\Downloads\dotnet-sdk-8.0.200-preview.24053.15-win-x64\shared\Microsoft.NETCore.App] Microsoft.WindowsDesktop.App 8.0.0 [C:\Users\v-yuluhe\Downloads\dotnet-sdk-8.0.200-preview.24053.15-win-x64\shared\Microsoft.WindowsDesktop.App]

Other architectures found: None

Environment variables: Not set

global.json file: Not found

Learn more: https://aka.ms/dotnet/info

Download .NET: https://aka.ms/dotnet/download

Link to public reproduction project repository

No response

Version with bug

8.0.3

Is this a regression from previous behavior?

Not sure, did not test other versions

Last version that worked well

Unknown/Other

Affected platforms

Windows

Affected platform versions

No response

Did you find any workaround?

No response

Relevant log output

No response

[joeloff]

Was this downloaded from NuGet or from an internal feed? We generally only sign the official builds going to NuGet. @danegsta as an FYI. I suspect this is just a non-final Aspire build that's not signed and pushed to the feeds you're using.

The general rule is that if the CLI you're using is signed, then the packages and installers for workloads must be signed. You can work around this using the --skip-sign-check option.

[danegsta]

Adding @joperezr for FYI as well; I don't believe there are any signed Preview 3 builds of Aspire currently as those would all be builds out of main. It looks like Aspire main is pushing to the dotnet8 feed, while signed bits are pushing to dotnet-tools.

[joperezr]

Right, as both of my colleagues pointed out above, if you are using Aspire workload that is not officially released yet (preview 3 isn't yet), or have the feeds configured where we push packages for unsigned workloads, then you will need to run your workload commands with the --skip-sign-check option.

[vdanche]

Thanks all. since this is expected, we can close it as Aspire workload that is not officially released yet and we can use --skip-sign-check option.