Home: Installing a signed package with untrusted signing certificate should show error

[v-nancyj]

Details about Problem

NuGet version : Dev-4721

VS version : D15.6 27213.01

OS version : RS3_Release 16299.15.170928-1534

Detailed repro steps

1. Create a new test certificate: .\CreateTestCertificate.ps1 –AddAsTrustedRootAuthority.
2. Sign a package: NuGet.exe sign -CertificatePath .
3. Launch Microsoft Management Console (mmc.exe).
4. In Microsoft Management Console, navigate on the main menu to File | "Add/Remove Snap-in..."
5. In the subsequent "Add or Remove Snap-ins" dialog, select Certificates in the left-hand list.
6. Click the Add button.
7. In the subsequent "Certificates snap-in" dialog, select "My user account."
8. Click the Finish button.
9. Click the OK button.
10. In the left-hand tree pane, navigate to "Console Root" | "Certificates - Current User" | "Trusted Root Certification Authorities" | Certificates.
11. In the right-hand list pane, find the certificate that was created in step 1. The certificate "Issued To" will be "Test certificate for testing NuGet package signing".
12. Right-click on the certificate and select “Delete”.
13. In Package Manager UI, install the package into a project.
14. Verify the previous step failed with an error saying "Certificate chain validation failed with error: UntrustedRoot."
15. Verify the package was not installed in the project.

Expected:

There is an error saying "Certificate chain validation failed with error: UntrustedRoot" and the package was not installed in the project.

Actual:

There is no error show and the package is installed in the project successfully as below screenshot.

[emgarten]

@mishra14 will you dupe this out or take a look at fixing it?

[rrelyea]

@mishra14 - Sounds like the test needs to be fixed. Can you please follow up.

[dtivel]

@v-nancyj, the current product behavior is correct. The test case needs to be updated so that the expected result matches the actual result described above. The default VS policy allows installation of packages signed with an untrusted certificate. "NuGet.exe verify" should report this untrusted status with an error.

CC @rido-min

[rido-min]

VS should generate a warning when restoring packages signed with untrusted certs.

[mishra14]

This is being fixed for net core projects as part of https://github.com/NuGet/NuGet.Client/pull/2212

[PatoBeltran]

@mishra14 is this fixed?

[rrelyea]

This is fixed in dev now, and we may bring the fix to 15.8 as well.

[rrelyea]

@mishra14 - can you please retest this in dev with the original repro steps. Vendors say that this still repros. Thx.

[v-luzh]

It still repro on D16.0stg 27927.3000 + NuGet Client Dev\5.0.0.5364.

[rido-min]

I'm running 15.8.0.27929 and I can see the Warning in the Package Manager Output, but the warning is not found in the Error List.

[mishra14]

VS 15.8 P5 with NuGet 5.0.0.47 which should be in sync with 5.0.0.5364

.NET Core project -

classic csproj project -

@rido-min @v-luzh Can you please run nuget.exe locals -clear all before testing this?

[mishra14]

Discussed offline,. I need to investigate packages.config scenario with only warnings.

[v-luzh]

@mishra14, we can see the warning NU3018 show in Error List window even without running "nuget.exe locals -clear all" with .NET Core project on D16.0stg 28002.3001 + NuGet Client dev\5.0.0.5381. But it still repro on packages.config project.

[rrelyea]

closing, as this is fixed in 5.0 / VS 16.0 code base now.

[mishra14]

The Restore scenario for packages config, has been fixed in https://github.com/NuGet/NuGet.Client/pull/2388