Open
Description
NuGet Product Used
dotnet.exe
Product Version
nuget.exe
Worked before?
non signed package with non signed symbol is pushed fine.
Impact
It bothers me. A fix would be nice
Repro Steps & Context
I upload nuget signed package with valid certificate in appveyor as:
- provider: NuGet
api_key:
secret: aaaabbbbbb
The nupkg package is pushed successfully but the symbol snupkg failed with a message:
Error publishing package. NuGet server returned 400: Invalid file found in the uploaded package.
Symbols packages should only contain '.pdb' files.
I tried to push the symbol by dotnet nuget command using the script as:
set key=aaaaabbbbb
set source=https://api.nuget.org/v3/index.json
dotnet nuget push mypackage.6.2.1.snupkg -k %key% -s %source%
and get the same error:
Pushing mypackage.6.2.1.snupkg to 'https://www.nuget.org/api/v2/symbolpackage'...
PUT https://www.nuget.org/api/v2/symbolpackage/
BadRequest https://www.nuget.org/api/v2/symbolpackage/ 1514ms
error: Response status code does not indicate success: 400 (Invalid file found in the uploaded package.
Symbols packages should only contain '.pdb' files.).
In MyGet server I can push the signed package and the signed symbol without error.
What i missed to push the signed symbol package.
Verbose Logs
No response
Activity
jebriede commentedon Nov 9, 2023
@moh-hassan thanks for reporting the issue. Certificates should not play a role in publishing. NuGet Client does not validate certificates when pushing.
It looks like you're getting different validation behavior when pushing your snupkg to appveyor, nuget.org, and MyGet, but this behavior is implemented by the respective servers, and is not controlled or enforced on the Client side.
Given the nuget.org reported behavior, it is possible that your snupk includes files other than pdb files. Please ensure that your snupkg follows the structure outlined in the official documentation: https://learn.microsoft.com/en-us/nuget/create-packages/symbol-packages-snupkg#symbol-package-structure.
How are you creating the snupkg? Could you please inspect the contents of the snupkg and verify if all the files contained within are pdb files? Please let us know.
moh-hassan commentedon Nov 10, 2023
Thanks @jebriede for reply.
The package is signed by SignPath.
It include extra file named:
AppVeyorSettings.json. It is a json file that represent appveyor Ci Environment at the moment of building and it is (from SignPath docs):AppVeyorSettings.json is included in all signed packages and they are pushed without problem(except snupkg symbol package).
It means that the snupkg include pdb files and match docs plus one extra file 'AppVeyorSettings.json'
I can push the unsigned snupkg without problem by command (I did ).
It is nice if pushing
snupkgallow inclusion such files AppVeyorSettings.json in the signed snupkg.If you agree, you can change label to Feature Request
Let me know if there is a technical constraint for inclusion AppVeyorSettings.json so i can avoid signing snupkg and use it as is with the signed nupkg.
nkolev92 commentedon Nov 20, 2023
cc @JonDouglas @albarry4
cc @mariaghiondea @aortiz-msft
Any chances here would require coordination across both products.
4 remaining items