Home: NuGet again throwing exceptions "authors is required" "description is required", ignoring csproj/nuspec replacement tokens

[bladewolf55]

For previous history on this problem, see issue #4234.

Using the exact same project and build:

NuGet Version 5.6.0.6591 does not display the Authors/Description error. However, version 5.7.0.6726 does.

I'm surprised this important issue doesn't seem to be regression tested. It's fixed, it comes back, it's fixed. . . .

5.6 output

nuget pack -verbosity detailed
NuGet Version: 5.6.0.6591
Attempting to build package from 'ClassLibrary1.csproj'.
MSBuild auto-detection: using msbuild version '16.7.0.37604' from 'C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin'. Use option -MSBuildVersion to force nuget to use a specific version of MSBuild.
Packing files from 'C:\Users\charl\Google Drive\Development\NuGet Testing\NuGet Dependency Resolution\Framework Major-Numbered\ClassLibrary1\ClassLibrary1\bin\Debug'.
Using 'ClassLibrary1.nuspec' for metadata.
Add file 'C:\Users\charl\Google Drive\Development\NuGet Testing\NuGet Dependency Resolution\Framework Major-Numbered\ClassLibrary1\ClassLibrary1\bin\Debug\ClassLibrary1.dll' to package as 'lib\net472\ClassLibrary1.dll'

Id: ClassLibrary1
Version: 1.0.0
Authors: C
Description: D
Dependencies:

Added file '[Content_Types].xml'.
Added file '_rels/.rels'.
Added file 'ClassLibrary1.nuspec'.
Added file 'lib/net472/ClassLibrary1.dll'.
Added file 'package/services/metadata/core-properties/0a9c65c5d99145c6af36a7c3d0d48724.psmdcp'.

Successfully created package 'C:\Users\charl\Google Drive\Development\NuGet Testing\NuGet Dependency Resolution\Framework Major-Numbered\ClassLibrary1\ClassLibrary1\ClassLibrary1.1.0.0.nupkg'.

5.7 output

nuget pack -verbosity detailed
NuGet Version: 5.7.0.6726
Attempting to build package from 'ClassLibrary1.csproj'.
MSBuild auto-detection: using msbuild version '16.7.0.37604' from 'C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin'. Use option -MSBuildVersion to force nuget to use a specific version of MSBuild.
Packing files from 'C:\Users\charl\Google Drive\Development\NuGet Testing\NuGet Dependency Resolution\Framework Major-Numbered\ClassLibrary1\ClassLibrary1\bin\Debug'.
Could not load file or assembly 'file:///C:\Program Files (x86)\NuGet CLI\nuget.exe' or one of its dependencies. Operation is not supported. (Exception from HRESULT: 0x80131515)
Using 'ClassLibrary1.nuspec' for metadata.
Authors is required.
Description is required.
System.Exception: Authors is required.
Description is required.
   at NuGet.Packaging.Manifest.Validate(Manifest manifest)
   at NuGet.Packaging.Manifest.ReadFrom(Stream stream, Func`2 propertyProvider, Boolean validateSchema)
   at NuGet.CommandLine.ProjectFactory.ProcessNuspec(PackageBuilder builder, String basePath)
   at NuGet.CommandLine.ProjectFactory.CreateBuilder(String basePath, NuGetVersion version, String suffix, Boolean buildIfNeeded, PackageBuilder builder)
   at NuGet.Commands.PackCommandRunner.BuildFromProjectFile(String path)
   at NuGet.Commands.PackCommandRunner.RunPackageBuild()
   at NuGet.CommandLine.PackCommand.ExecuteCommand()
   at NuGet.CommandLine.Command.ExecuteCommandAsync()
   at NuGet.CommandLine.Command.Execute()
   at NuGet.CommandLine.Program.MainCore(String workingDirectory, String[] args)

[nkolev92]

@bladewolf55 Can you please provide a repro?

The change for the issue you are mentioning was in 5.7, not 5.6

[kartheekp-ms]

Thanks @nkolev92. I agree.
@bladewolf55 - I am unable to reproduce the issue. I created a Classlibrary (.NET Framework) project in VS 2019 16.7.2 and executed nuget pack command which produced following output with couple of NU5115 warnings for missing values Description and Author in .csproj file.

C:\{removed}>nuget-5.7.0.exe pack C:\{removed}\9954\ClassLibrary1 -verbosity detailed
NuGet Version: 5.7.0.6726
Attempting to build package from 'ClassLibrary1.csproj'.
MSBuild auto-detection: using msbuild version '16.7.0.37604' from 'C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Current\Bin'. Use option -MSBuildVersion to force nuget to use a specific version of MSBuild.
Packing files from 'C:\{removed}\9954\ClassLibrary1\bin\Debug'.
Add file 'C:\{removed}\9954\ClassLibrary1\bin\Debug\ClassLibrary1.dll' to package as 'lib\net472\ClassLibrary1.dll'
WARNING: NU5115: Description was not specified. Using 'Description'.
WARNING: NU5115: Author was not specified. Using '{my user name}'.

Id: ClassLibrary1
Version: 1.0.0
Authors: {my user name}
Description: Description
Dependencies:

Added file '[Content_Types].xml'.
Added file '_rels/.rels'.
Added file 'ClassLibrary1.nuspec'.
Added file 'lib/net472/ClassLibrary1.dll'.
Added file 'package/services/metadata/core-properties/b09a89a5c5644d5894b9a221d63dfc4e.psmdcp'.

WARNING: NU5128: Some target frameworks declared in the dependencies group of the nuspec and the lib/ref folder do not have exact matches in the other location. Consult the list of actions below:
- Add a dependency group for .NETFramework4.7.2 to the nuspec
Successfully created package 'C:\{removed}\ClassLibrary1.1.0.0.nupkg'.

Can you please provide a repro?

[bladewolf55]

Of course. I should have provided that the first time.

Environment

• Visual Studio 2019 16.7.2
• Windows 10 Pro (latest stable release)
• NuGet CLI 5.7.0.6726

Steps to Reproduce

1. Create a .NET Framework Class Library (Framework 4.7.2)
2. In the ClassLibrary1.csproj project folder, run nuget spec
3. Reduce the resulting ClassLibrary1.nuspec file to the required properties
   xml <?xml version="1.0" encoding="utf-8"?> <package > <metadata> <id>$id$</id> <version>$version$</version> <authors>$author$</authors> <description>$description$</description> </metadata> </package>
4. In Properties\AssemblyInfo.cs (or, in VS, ClassLibrary1 > Properties > Application > Assembly Information...) , add the values that are substituted for $description and $author:
   csharp [assembly: AssemblyDescription("Desc")] [assembly: AssemblyConfiguration("")] [assembly: AssemblyCompany("Name")]
5. Build the project or solution.
6. In project folder, run nuget pack

Expected: Successful build of new package

Actual: Error that Author and Description are missing:

Attempting to build package from 'ClassLibrary1.csproj'.
MSBuild auto-detection: using msbuild version '16.7.0.37604' from 'C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin'.
Packing files from 'C:\Users\charl\Google Drive\Development\NuGet Testing\ClassLibrary1\ClassLibrary1\bin\Debug'.
Using 'ClassLibrary1.nuspec' for metadata.
Authors is required.
Description is required.

This error does not happen using nuget.exe 5.6x, as specified in the OP.

[zkat]

ping @rrelyea because hotseat. Can you confirm that this is an actual bug, or that a bugfix we did caused this to start (correctly) failing?

[rrelyea]

n.h.9954.zip

Attached my repro attempt based on your instructions.
extract zip file.
have nuget.5.6.exe and nuget.5.7.exe in your path (or adapt repro.cmd)
cd n.h.9954
run repro.cmd (i used this: "repro.cmd 1> out.txt 2>&1")

my output:

C:\temp\n.h.9954\n.h.9954>msbuild /p:Configuration=release /v:minimal 
Microsoft (R) Build Engine version 16.8.0-preview-20427-01+67225fa91 for .NET Framework
Copyright (C) Microsoft Corporation. All rights reserved.

  n.h.9954 -> C:\temp\n.h.9954\n.h.9954\bin\Release\n.h.9954.dll

C:\temp\n.h.9954\n.h.9954>nuget.5.6 pack -verbosity detailed -prop configuration=release 
NuGet Version: 5.6.0.6591
Attempting to build package from 'n.h.9954.csproj'.
MSBuild auto-detection: using msbuild version '16.8.0.42701' from 'C:\Program Files (x86)\Microsoft Visual Studio\2019\IntPreview\MSBuild\Current\Bin'. Use option -MSBuildVersion to force nuget to use a specific version of MSBuild.
Packing files from 'C:\temp\n.h.9954\n.h.9954\bin\Release'.
Could not load file or assembly 'NuGet, Version=5.6.0.5, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The located assembly's manifest definition does not match the assembly reference. (Exception from HRESULT: 0x80131040)
Using 'n.h.9954.nuspec' for metadata.
Authors is required.
Description is required.
System.Exception: Authors is required.
Description is required.
   at NuGet.Packaging.Manifest.Validate(Manifest manifest)
   at NuGet.Packaging.Manifest.ReadFrom(Stream stream, Func`2 propertyProvider, Boolean validateSchema)
   at NuGet.CommandLine.ProjectFactory.ProcessNuspec(PackageBuilder builder, String basePath)
   at NuGet.CommandLine.ProjectFactory.CreateBuilder(String basePath, NuGetVersion version, String suffix, Boolean buildIfNeeded, PackageBuilder builder)
   at NuGet.Commands.PackCommandRunner.BuildFromProjectFile(String path)
   at NuGet.Commands.PackCommandRunner.BuildPackage()
   at NuGet.CommandLine.PackCommand.ExecuteCommand()
   at NuGet.CommandLine.Command.ExecuteCommandAsync()
   at NuGet.CommandLine.Command.Execute()
   at NuGet.CommandLine.Program.MainCore(String workingDirectory, String[] args)

C:\temp\n.h.9954\n.h.9954>nuget.5.7 pack -verbosity detailed -prop configuration=release 
NuGet Version: 5.7.0.6726
Attempting to build package from 'n.h.9954.csproj'.
MSBuild auto-detection: using msbuild version '16.8.0.42701' from 'C:\Program Files (x86)\Microsoft Visual Studio\2019\IntPreview\MSBuild\Current\Bin'. Use option -MSBuildVersion to force nuget to use a specific version of MSBuild.
Packing files from 'C:\temp\n.h.9954\n.h.9954\bin\Release'.
Using 'n.h.9954.nuspec' for metadata.
Add file 'C:\temp\n.h.9954\n.h.9954\bin\Release\n.h.9954.dll' to package as 'lib\net472\n.h.9954.dll'

Id: n.h.9954
Version: 1.0.0
Authors: Company Name
Description: My Description
Dependencies: 

Added file '[Content_Types].xml'.
Added file '_rels/.rels'.
Added file 'lib/net472/n.h.9954.dll'.
Added file 'n.h.9954.nuspec'.
Added file 'package/services/metadata/core-properties/abe8b54b7f0e448392dd98a32db193c5.psmdcp'.

WARNING: NU5128: Some target frameworks declared in the dependencies group of the nuspec and the lib/ref folder do not have exact matches in the other location. Consult the list of actions below:
- Add a dependency group for .NETFramework4.7.2 to the nuspec
Successfully created package 'C:\temp\n.h.9954\n.h.9954\n.h.9954.1.0.0.nupkg'.

so it appears that it was broken in 5.6 and is now fixed in 5.7.
What did we do differently?

[bladewolf55]

Here's my output using your zip file and running the command "repro.cmd 1> out.txt 2>&1. You'll see it's different than your results. The only difference I see is the MSBuild version. But be sure to read after that, because I'm getting different behaviors depending on how I build and pack.

C:\Users\charl\Downloads\n.h.9954>msbuild /p:Configuration=release /v:minimal 
Microsoft (R) Build Engine version 16.7.0+b89cb5fde for .NET Framework
Copyright (C) Microsoft Corporation. All rights reserved.

  n.h.9954 -> C:\Users\charl\Downloads\n.h.9954\bin\Release\n.h.9954.dll

C:\Users\charl\Downloads\n.h.9954>nuget.5.6 pack -verbosity detailed -prop configuration=release 
NuGet Version: 5.6.0.6591
Attempting to build package from 'n.h.9954.csproj'.
MSBuild auto-detection: using msbuild version '16.7.0.37604' from 'C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin'. Use option -MSBuildVersion to force nuget to use a specific version of MSBuild.
Packing files from 'C:\Users\charl\Downloads\n.h.9954\bin\Release'.
Could not load file or assembly 'NuGet, Version=5.6.0.5, Culture=neutral, PublicKeyToken=31bf3856ad364e35' or one of its dependencies. The system cannot find the file specified.
Using 'n.h.9954.nuspec' for metadata.
Authors is required.
Description is required.
System.Exception: Authors is required.
Description is required.
   at NuGet.Packaging.Manifest.Validate(Manifest manifest)
   at NuGet.Packaging.Manifest.ReadFrom(Stream stream, Func`2 propertyProvider, Boolean validateSchema)
   at NuGet.CommandLine.ProjectFactory.ProcessNuspec(PackageBuilder builder, String basePath)
   at NuGet.CommandLine.ProjectFactory.CreateBuilder(String basePath, NuGetVersion version, String suffix, Boolean buildIfNeeded, PackageBuilder builder)
   at NuGet.Commands.PackCommandRunner.BuildFromProjectFile(String path)
   at NuGet.Commands.PackCommandRunner.BuildPackage()
   at NuGet.CommandLine.PackCommand.ExecuteCommand()
   at NuGet.CommandLine.Command.ExecuteCommandAsync()
   at NuGet.CommandLine.Command.Execute()
   at NuGet.CommandLine.Program.MainCore(String workingDirectory, String[] args)

C:\Users\charl\Downloads\n.h.9954>nuget.5.7 pack -verbosity detailed -prop configuration=release 
NuGet Version: 5.7.0.6726
Attempting to build package from 'n.h.9954.csproj'.
MSBuild auto-detection: using msbuild version '16.7.0.37604' from 'C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin'. Use option -MSBuildVersion to force nuget to use a specific version of MSBuild.
Packing files from 'C:\Users\charl\Downloads\n.h.9954\bin\Release'.
Could not load file or assembly 'file:///C:\Users\charl\Downloads\n.h.9954\nuget.5.7.exe' or one of its dependencies. Operation is not supported. (Exception from HRESULT: 0x80131515)
Using 'n.h.9954.nuspec' for metadata.
Authors is required.
Description is required.
System.Exception: Authors is required.
Description is required.
   at NuGet.Packaging.Manifest.Validate(Manifest manifest)
   at NuGet.Packaging.Manifest.ReadFrom(Stream stream, Func`2 propertyProvider, Boolean validateSchema)
   at NuGet.CommandLine.ProjectFactory.ProcessNuspec(PackageBuilder builder, String basePath)
   at NuGet.CommandLine.ProjectFactory.CreateBuilder(String basePath, NuGetVersion version, String suffix, Boolean buildIfNeeded, PackageBuilder builder)
   at NuGet.Commands.PackCommandRunner.BuildFromProjectFile(String path)
   at NuGet.Commands.PackCommandRunner.RunPackageBuild()
   at NuGet.CommandLine.PackCommand.ExecuteCommand()
   at NuGet.CommandLine.Command.ExecuteCommandAsync()
   at NuGet.CommandLine.Command.Execute()
   at NuGet.CommandLine.Program.MainCore(String workingDirectory, String[] args)

---

So, here are a few other ways to build and release. In each case, I delete the bin/obj folders and .nupkg file to start. I put the nuget executables in the project folder.

Important: Ensure no other nuget.exe are on the Path

1. Run msbuild /p:Configuration=release /v:minimal
2. Run nuget.5.6 pack -verbosity detailed -prop configuration=release
   Get authors/description errors
3. Delete bin/obj
4. Run msbuild /p:Configuration=release /v:minimal
5. Rename nuget.5.6.exe to nuget.exe
6. Run nuget pack -verbosity detailed -prop configuration=release
   Pack succeeds

---

Same as above, but with nuget.5.6.exe

• Using nuget.5.6 pack shows errors
• Using nuget pack shows errors

---

1. Copy nuget.exe v5.7 into same folder as nuget.5.7.exe (in other words, nuget.exe and nuget.5.7.exe are on the path.
2. Run msbuild as above

3. Run nuget pack nuget.5.7.exe as above.
   Pack succeeds

4. Run nuget pack nuget.5.7.exe as above.
   Pack succeeds

---

However, using putting nuget.exe version 5.7 in the same folder doesn't succeed.

---

Conclusions

There are past reports of nuget behaving differently if it's renamed. I don't know if there are also reports of the renamed executed file picking up behavior from another nuget.exe in the path.

My reproduction is, I think, a common use case: the latest nuget.exe in the path.

As I see it right now, there are three bugs:

1. The behavior of 5.6 changes depending on its name
2. The behavior of 5.6 changes if the same version file named nuget.exe is in the path
3. 5.7 fails in all cases as originally reported

I'm puzzled why I could never get 5.7 to succeed as you did. But then, you didn't truly reproduce my conditions; you mutated them. And we all know from X-Men what happens when there's mutation.

[bladewolf55]

Thank you for shepherding this along. It's likely, in continuous integration environments, NuGet is automatically updated to its latest version. Unexpected behavior can cause significant problems and confusion. I don't want to see that happen and will help how I can.

[sintecnos-lucabiffi]

I'm using NuGet 5.7.0.6726 and this still has to be fixed. Reading this thread I'll give a try to the 5.6.something version.

EDIT: I did try with version 5.6.0.6591 and it works as OP has correctly reported

[ZachSand]

I am also getting this issue. I upgraded my build server and installed the newest version of development tools, including NuGet Version: 5.7.0.6726 and now all of my previously passing builds fail due to the error.

Old build server has NuGet Version: 5.6.0.6591 and works fine. I'll be reverting back to this version until a fix is made.

[markoueis]

Upgraded from 5.5 to 5.8 and now have this issue when doing nuget pack

[macfarmw]

I also get this error with version 5.7 and 5.8. Using version 5.6 works fine.

[nkolev92]

Hey all,

We've had trouble reproing what some of you articulating.

It'd be helpful if you can zip up a project and upload it here. @macfarmw @markoueis

[cesharpcom]

I can confirm I have the same issue on my environment!

NuGet Version: 5.6.0.6591 => no issue
NuGet Version: 5.8.0.6930 => WARNING: NU5115: Description was not specified. Using 'Description'.

This is on a .NET Framework 4.8 ( VS 2019) class library where we use this command:
Command line: pack "MyProj.csproj" -OutputDirectory "outpurdir" -Version "7.0.0.0" -Symbols -IncludeReferencedProject -Properties Configuration=release -Verbosity detailed -NonInteractive

[nkolev92]

@cesharpcom Can you get a repro for us?

[bladewolf55]

I'll revisit this in the next few days and not only rewrite my repo steps (found earlier in the thread) but also provide a project. Is it clear that if NuGet 5.7+ is used, with the environment and steps previously given, the error always occurs?

[bladewolf55]

Here's a blog post I wrote on the subject, with the same information as below.

https://www.softwaremeadows.com/posts/nuget_5_7+_ignores_nuspec_replacement_tokens_-_and_other_weird_behavio/

Source code: ClassLibrary1.zip

Environment

Windows 10 Pro
Visual Studio 2019
.NET Framework 4.8

More Info

There are multiple failures being reported below. The fundamental one is that NuGet 5.7 and above ignore token replacements in .nuspec files from .NET Framework project .csproj files.

Steps to Reproduce

Pre-setup

Check the Windows PATH environment variables (System Properties > Advanced > Environment Variables) at the user and system levels and be sure that no version of nuget.exe is on the path. One way to verify is to open a new command window and type nuget. If there's output, nuget is on the path.

A reboot may be required for the computer to recognize the path change. Normally, it only takes closing completely out of the System Properties editor.

Remember to open a new command window after PATH changes so the environment variable is reloaded.

Steps

1. In Visual Studio, create a new .NET Framework Console Application.

2. Open Properties\AssemblyInfo.cs add the values that are substituted for $description and $author:

   [assembly: AssemblyDescription("Desc")]
   [assembly: AssemblyConfiguration("")]
   [assembly: AssemblyCompany("Name")]
   

3. Download NuGet 5.7 https://www.nuget.org/downloads
4. Copy to the project folder
5. Rename to nuget.exe.

It's important that the file be named nuget.exe.

1. In the ClassLibrary1.csproj project folder, run

   nuget spec
   

2. Reduce the resulting ClassLibrary1.nuspec file to the minimum required properties

   <?xml version="1.0" encoding="utf-8"?>
   <package >
     <metadata>
       <id>$id$</id>
       <version>$version$</version>
       <authors>$author$</authors>
       <description>$description$</description>
     </metadata>
   </package>
   

3. Build the project or solution.
4. In project folder, run nuget pack

Expected: Successful build of new package

Actual: Error that Author and Description are missing:

Attempting to build package from 'ClassLibrary1.csproj'.
MSBuild auto-detection: using msbuild version '16.8.2.56705' from 'C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin'.
Packing files from 'C:\Users\charl\source\repos\ClassLibrary1\ClassLibrary1\bin\Debug'.
Using 'ClassLibrary1.nuspec' for metadata.
Authors is required.
Description is required.

NuGet 5.6 Behavior

1. In the above environment, replace the nuget.exe version 5.7 with version 5.6.

   It's important that the file be named nuget.exe.

2. Run nuget pack

The pack succeeds.

Attempting to build package from 'ClassLibrary1.csproj'.
MSBuild auto-detection: using msbuild version '16.8.2.56705' from 'C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin'.
Packing files from 'C:\Users\charl\source\repos\ClassLibrary1\ClassLibrary1\bin\Debug'.
Using 'ClassLibrary1.nuspec' for metadata.
Successfully created package 'C:\Users\charl\source\repos\ClassLibrary1\ClassLibrary1\ClassLibrary1.1.0.0.nupkg'.
WARNING: NU5128: Some target frameworks declared in the dependencies group of the nuspec and the lib/ref folder do not have exact matches in the other location. Consult the list of actions below:
- Add a dependency group for .NETFramework4.8 to the nuspec

NuGet 5.8 and 5.9 preview Behaviors

Both versions exhibit the same bug as 5.7.

Behavior When Renaming nuget.exe

1. Copy version 5.6 into the project folder
2. Rename it nugetx.exe (It doesn't matter what it's renamed to, as long as it isn't nuget.exe)
3. Run nugetx.exe pack

Unlike when named nuget.exe, version 5.6 pack fails with the unexpected error!

Attempting to build package from 'ClassLibrary1.csproj'.
MSBuild auto-detection: using msbuild version '16.8.2.56705' from 'C:\Program Files (x86)\Microsoft Visual Studio\2019\Community\MSBuild\Current\Bin'.
Packing files from 'C:\Users\charl\source\repos\ClassLibrary1\ClassLibrary1\bin\Debug'.
Using 'ClassLibrary1.nuspec' for metadata.
Authors is required.
Description is required.

Behavior When Two NuGet files in Path

1. Copy version 5.6 into the project folder and rename to nuget.exe
2. Copy version 5.6 again into the project folder and rename to nugetx.exe
3. Run nuget pack
4. Run nugetx pack

In both cases, the pack succeeds.

Real World Concerns

Many organizations will, in a continuous deployment environment, use a known path to the latest NuGet package and expect it to be named nuget.exe. As seen above, those organizations will suddenly find themselves with failing package steps.

In order to continue, they must either stay on version 5.6 and accept the potential security issues there, or rework their pipeline.

[lezmaka]

I was having this same issue and found a resolution that worked for me. First off, I apologize if this post isn't as well formatted/structured as typical, I think this is the first time I've tried adding something to a discussion on GitHub.

Getting right to it, could it have something to do with the newer versions being marked as unsafe when downloaded - meaning if you go into properties for nuget.exe, you have the Unblock checkbox.

For my situation, when using nuget.exe v5.8, I had to unblock the file in Properties in order for the nuget pack to work as I expected. When using nuget.exe 5.3.1, it works whether or not the Properties screen shows the Unblock checkbox.

Here was my setup/situation.

I have nuget.exe in C:\Program Files (x86)\NuGet\ and that folder is also in the PATH environment variable in Windows. The version of nuget.exe was 5.3.1.6268. Visual Studio version is 16.8.3 running on Windows 10 Pro. The project was a .NET framework 4.6.2 class library project, with the nuspec filename being the same as the project name, and it had all the required fields populated with the correct replacement tokens like in bladewolf55's post above (https://github.com/NuGet/Home/issues/9954#issuecomment-683226235). I had no problems getting nuget pack to work.

However when another developer tried, it initially failed because it couldn't find nuget.exe. So I had him go to https://docs.microsoft.com/en-us/nuget/install-nuget-client-tools, download nuget.exe, put it in C:\Program Files (x86)\NuGet\ and add it to the PATH. When he tried again, it found nuget.exe, but he got the authors/description required failures as others reported here. He had downloaded version 5.8.0.6930.

I thought it could have been something between our two different version of nuget, so I had him go to https://www.nuget.org/downloads and download nuget.exe v5.3.1 to C:\Program Files (x86)\NuGet. He tried again and it worked fine.

When I would run "nuget pack -verbosity detailed" using v5.8, one of the lines in the output was
Could not load file or assembly 'file:///C:\Program Files (x86)\NuGet\nuget.exe' or one of its dependencies. Operation is not supported. (Exception from HRESULT: 0x80131515) even though the nuget.exe was definitely there.

I look at the properties of the nuget.exe file and it had the Unblock checkbox. I checked the box and clicked OK. I tried running the same "nuget pack -verbosity detailed" and it worked fine just like when using v5.3.

So for me, downloading nuget.exe v5.8 using Microsoft Edge Version 89.0.731.0 (Official build) dev (64-bit) and copying it to my path, I get the same required errors as others. If I unblock the file, then it works fine. I can download the older v5.3 from the link mentioned earlier, copy it in the my path and it works fine without unblocking it.

Hopefully that works for others and hopefully provides something useful to help reproduce and/or fix the issue.

[bladewolf55]

Bravo, @lezmaka! Confirmed, If I redo my previous steps using executables set to Unblocked, all work as expected (no error messages).

Note that if the blocked files are placed in C:\Program Files\blocked, and that folder is added to the PATH, the error messages still occur. So, blocking isn't depending on (or respecting being in a system folder.

I hope this helps the NuGet development team investigate and determine what caused the behavior change. Expecting users to check for the blocked file attribute after a normal download isn't reasonable, and this bug can cause serious work blockages.

What causes downloaded files to fail due to security blocking isn't my area. Some brief research shows it can be a problem with assembly signing, or a change in a manifest setting.

Thanks, everyone, for moving this issue forward.

[nkolev92]

Thanks for the update @lezmaka & @bladewolf55.

That's probably one of the reasons we haven't been able to repro it locally.

[cesharpcom]

@nkolev92

I also confirm that the issue is solved by unblocking the nuget.exe for versions higher then 5.6.

The funny thing is that the issue is not there for version 5.6 even when the exe is still blocked.
In any case unblocking it for 5.7 and higher solves the issue.

Also for troubleshooting hard to reproduce issues it's always the best approach do try to reproduce it on a freshly installed operating system and only install the things needed to reproduce the issue. By this it's not affected by any kind of company restrictions or previously installed software or settings from the past.

Let me say I learned the above the hard way :) but it's often the golden step in able to reproduce stuff that customers/users report.

[nkolev92]

The funny thing is that the issue is not there for version 5.6 even when the exe is still blocked.

The only functional change is going from:

            return (T)domain.CreateInstanceAndUnwrap(typeof(T).Assembly.FullName, typeof(T).FullName);

to

            return (T)domain.CreateInstanceFromAndUnwrap(Assembly.GetExecutingAssembly().Location, typeof(T).FullName);

At this point I'm not sure how exactly this changes it, but all your info has helped get an actionable repro.

[bladewolf55]

Community effort for the win!

typeof(T).Assembly.FullName and
Assembly.GetExecutingAssembly().Location obviously do very different
things. The first returns the assembly name/version/etc, the second
simply the path to the executable.

I suspect using a physical path is leading to the security problem,
but I couldn't say why.

On Wed, Jan 6, 2021 at 12:09 PM Nikolche Kolev [e-mail]
wrote:

The funny thing is that the issue is not there for version 5.6 even when
the exe is still blocked.

The only functional change is going from:

        return (T)domain.CreateInstanceAndUnwrap(typeof(T).Assembly.FullName, typeof(T).FullName);

to

        return (T)domain.CreateInstanceFromAndUnwrap(Assembly.GetExecutingAssembly().Location, typeof(T).FullName);

At this point I'm not sure how exactly this changes it, but all your info
has helped get an actionable repro.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/NuGet/Home/issues/9954#issuecomment-755534535, or
unsubscribe
https://github.com/notifications/unsubscribe-auth/AAWE24YLSVNSOMYTYVI7PPTSYSYNXANCNFSM4QOQF6VA
.

[sam-wheat]

I was able to solve this quickly - thanks to all who participated especially @lezmaka.
BTW in addition to version info, I suggest that you print the full directory path where the running .exe resides when nuget.exe alone is typed in the command line.