Error getting vulnerability data for msbuild repo

[mthalman]

The dotnet-source-build-lite pipeline is failing with the following error:

   /vmr/src/msbuild/src/Build/Microsoft.Build.csproj : warning NU1900: Error occurred while getting package vulnerability data: Unable to load the service index for source https://pkgs.dev.azure.com/ms/BuildXL/_packaging/BuildXL/nuget/v3/index.json. [/vmr/src/msbuild/MSBuild.SourceBuild.slnf]
    /vmr/src/msbuild/src/Framework/Microsoft.Build.Framework.csproj : warning NU1900: Error occurred while getting package vulnerability data: Unable to load the service index for source https://pkgs.dev.azure.com/ms/BuildXL/_packaging/BuildXL/nuget/v3/index.json. [/vmr/src/msbuild/MSBuild.SourceBuild.slnf]
    /vmr/src/msbuild/src/Utilities/Microsoft.Build.Utilities.csproj : warning NU1900: Error occurred while getting package vulnerability data: Unable to load the service index for source https://pkgs.dev.azure.com/ms/BuildXL/_packaging/BuildXL/nuget/v3/index.json. [/vmr/src/msbuild/MSBuild.SourceBuild.slnf]
    /vmr/src/msbuild/src/Tasks/Microsoft.Build.Tasks.csproj : warning NU1900: Error occurred while getting package vulnerability data: Unable to load the service index for source https://pkgs.dev.azure.com/ms/BuildXL/_packaging/BuildXL/nuget/v3/index.json. [/vmr/src/msbuild/MSBuild.SourceBuild.slnf]
    /vmr/src/msbuild/src/Package/Localization/Localization.csproj : warning NU1900: Error occurred while getting package vulnerability data: Unable to load the service index for source https://pkgs.dev.azure.com/ms/BuildXL/_packaging/BuildXL/nuget/v3/index.json. [/vmr/src/msbuild/MSBuild.SourceBuild.slnf]
    /vmr/src/msbuild/src/MSBuild/MSBuild.csproj : warning NU1900: Error occurred while getting package vulnerability data: Unable to load the service index for source https://pkgs.dev.azure.com/ms/BuildXL/_packaging/BuildXL/nuget/v3/index.json. [/vmr/src/msbuild/MSBuild.SourceBuild.slnf]
    /vmr/src/msbuild/src/StringTools/StringTools.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://pkgs.dev.azure.com/ms/BuildXL/_packaging/BuildXL/nuget/v3/index.json. [/vmr/src/msbuild/MSBuild.SourceBuild.slnf]
        7 Warning(s)
        1 Error(s)

Example build (internal link)

[dotnet-issue-labeler]

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[dotnet-issue-labeler]

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[mthalman]

This is also failing in Unified Build: example (internal link). It doesn't seem to be associated with a code change but rather a feed or network change?

pinging @jeffkl, @nkolev92 for any insight

[jeffkl]

/cc @zivkan as well

[nkolev92]

Hard to tell on a first look.

Seems like the source wasn't accessible.

Did the SDK version change recently?

[zivkan]

Just as a test, can you run dotnet add package DoesNotExist to some project? It will show inner exceptions, and therefore explain why the service index can't be loaded.

However, I don't see the Azure Pipelines NuGetAuthenticate task being run, so I suspect that it isn't sending credentials to the private feed. If this worked before, I don't know how or why. My understanding is that it's always been necessary to set up the credentials in Azure Pipelines before trying to access the private feed.

[mthalman]

It looks like this was a transient error. Builds are passing now.

[Winniexu01]

Reopening as the latest builds failed again due to the same issue. Now, it is affecting the 9.0 and 8.0 repos.

[mthalman]

Yes, it also showed up in dotnet/sdk#44174.

[mthalman]

/cc @rainersigwald

[mthalman]

In the 8.0 builds, it gets the following error which provides the extra context of 401 (Unauthorized):

    /vmr/.dotnet/sdk/8.0.110/NuGet.targets(156,5): error : Unable to load the service index for source https://pkgs.dev.azure.com/ms/BuildXL/_packaging/BuildXL/nuget/v3/index.json. [/vmr/artifacts/source-built-sdks/Microsoft.DotNet.Arcade.Sdk/tools/Tools.proj]
    /vmr/.dotnet/sdk/8.0.110/NuGet.targets(156,5): error :   Response status code does not indicate success: 401 (Unauthorized). [/vmr/artifacts/source-built-sdks/Microsoft.DotNet.Arcade.Sdk/tools/Tools.proj]
##[error]/vmr/.dotnet/sdk/8.0.110/NuGet.targets(156,5): error : (NETCORE_ENGINEERING_TELEMETRY=Restore) Unable to load the service index for source https://pkgs.dev.azure.com/ms/BuildXL/_packaging/BuildXL/nuget/v3/index.json.
  Response status code does not indicate success: 401 (Unauthorized).

This feed is referenced here: https://github.com/dotnet/dotnet/blob/77ace8473cd818b681c48046464d1cca112b945c/src/msbuild/NuGet.config#L21

@rainersigwald - Do you have context on this feed and know what's going on here?

[mthalman]

This also affects main. It showed up in the unified build run of this PR: dotnet/sdk#44192

[jeffkl]

Did an auth token expire or something? The feed https://pkgs.dev.azure.com/ms/BuildXL/_packaging/BuildXL/nuget/v3/index.json requires authentication, what is configuring authentication for feeds?

[rainersigwald]

That feed no longer exists and shouldn't be referenced in current branches. But the flow of that removal into SDK has been held up on unrelated problems (dotnet/sdk#44011).

[mthalman]

@rainersigwald - That flow is for main branch but this also applies to both 8.0 and 9.0. Has a similar feed removal been made for those branches? Because no such removal has reached the VMR yet.

[rainersigwald]

It may not have but I was just talking to @MichalPavlik about how we needed it.

[mthalman]

VMR patches created to workaround this:

• main: Create 0001-remove-buildxl-feed.patch sdk#44194
• 9.0: msbuild patch to remove BuildXL feed sdk#44199
• 8.0: msbuild patch to remove BuildXL feed installer#20202

[mthalman]

All the PRs mentioned in #4634 (comment) have been merged so this should be resolved now.