[Project Support]: Rx.NET NuGet key expired

[idg10]

Project

Rx.NET

Project Url

https://github.com/dotnet/reactive/

Description

I tried to publish a new release of System.Linq.Async (which is part of the Rx.NET repo; it is being superseded in .NET 10, but for now it remains the only option for LINQ over IAsyncEnumerable<T>), and it failed:

https://dev.azure.com/dotnet/Rx.NET/_releaseProgress?_a=release-environment-logs&releaseId=795&environmentId=1590

The error is:

##[error]The nuget command failed with exit code(1) and error(Response status code does not indicate success: 403 (The specified API key is invalid, has expired, or does not have permission to access the specified package.).

I'm assuming this means our NuGet API key has expired.

Due By

As soon as is practical

[glennawatson]

Normally we don’t control the nuget accounts. Sure the dotnet foundation is often an owner but usually one of the project maintainers is also.

[glennawatson]

Looking it up the organisation ‘rxteam’ is the organisation who generates the nuget key.

[idg10]

I've realised that we do in fact have permissions to create new keys. I've done so but now have a new problem: the upload completes, but NuGet then reports validation failure because it says the signing certificate is "not associated with your account".

The package is being signed—I'm running this tool against the package build by Azure DevOps, which I'm attempting to publish:

❯ nuget.exe verify -Signatures C:\Users\ian\Downloads\System.Linq.Async.6.0.2.nupkg

Verifying System.Linq.Async.6.0.2
C:\Users\ian\Downloads\System.Linq.Async.6.0.2.nupkg

Signature Hash Algorithm: SHA256
Timestamp: 10/06/2025 10:07:41

Verifying author primary signature's timestamp with timestamping service certificate:
  Subject Name: CN=Microsoft Public RSA Time Stamping Authority, OU=Thales TSS ESN:BB73-96FD-77EF, OU=Microsoft America Operations, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  SHA1 hash: 15D36C45ABD0DEECF17D2558A484C99730C6E5F7
  SHA256 hash: B804553AC8C88A3F71E32FE6B84F1CCEF488CF45D2EBCA41150E7E21DFD26E71
  Issued by: CN=Microsoft Public RSA Timestamping CA 2020, O=Microsoft Corporation, C=US
  Valid from: 26/11/2024 18:48:47 to 19/11/2025 18:48:47

Signature type: Author
Verifying the author primary signature with certificate:
  Subject Name: CN=Reactive Extensions for .NET (.NET Foundation), O=Reactive Extensions for .NET (.NET Foundation), L=Redmond, S=Washington, C=US, SERIALNUMBER=603 389 068, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Washington, OID.1.3.6.1.4.1.311.60.2.1.3=US
  SHA1 hash: 3462B10D02EBC3DF150DED8CA5D37B4C4351EB8A
  SHA256 hash: 58F348C7BF84E90A6E455BA79AC41F1BE38873E0E6A78C3A8D9C47321CFB3DA0
  Issued by: CN=.NET Foundation Projects Code Signing CA2, O=.NET Foundation, C=US
  Valid from: 29/07/2024 01:00:00 to 29/07/2027 00:59:59


Successfully verified package 'System.Linq.Async.6.0.2'.

but NuGet is complaining with this:

Package publishing failed. This package could not be published due to the following reason(s):

• The package was signed, but the signing certificate (SHA-256 thumbprint 3462b10d02ebc3df150ded8ca5d37b4c4351eb8a) is not associated with your account. You must register this certificate to publish signed packages.

Notice that the "SHA-256" thumbprint NuGet reports there is the value that the nuget -verify command has reported as the SHA1 hash!

Meanwhile, I've uploaded the latest cert to NuGet under the rxteam, and it accepted it. When I look at https://www.nuget.org/organization/rxteam I see this:

Notice that the two old expired certs are still listed. And now the new one is there and has the value matching the SHA256 hash reported by the nuget -verify tool, but no information in the details column.

[glennawatson]

I've used this tool in the past to extract the public cert out the nuget package to upload:

https://www.nuget.org/packages/Knapcode.CertificateExtractor

nuget-cert-extractor --file ""{nupkgFile}"" --output . --code-signing --author --leaf

[glennawatson]

Once you have the public certificate associated with your rxteam account, you won't need to do that again until the next time the cert needs to be renewed.

[idg10]

I tried that tool, and it got my hopes up when it showed this:

[13:53:59 INF] Saving author code signing leaf certificate with fingerprint 3462B10D02EBC3DF150DED8CA5D37B4C4351EB8A.

that is the very same thumbprint that NuGet is saying was not associated with my account:

The package was signed, but the signing certificate (SHA-256 thumbprint 3462b10d02ebc3df150ded8ca5d37b4c4351eb8a) is not associated with your account. You must register this certificate to publish signed packages

So I uploaded it to https://www.nuget.org/organization/rxteam but it showed exactly the same thing:

Again, that's the other hash that nuget.exe verify -Signatures reported, so it's not necessarily wrong. But again, it hasn't shown any of the subject details. I left it half an hour in case it took a while for NuGet to ingest this, but still it's reporting that same error: it thinks that the cert is not associated with the account. The API key I'm using is associated with rxteam:

Now the package page shows IanGriffiths, but then so do all the successful package uploads for System.Reactive for the last 2 years. The previous uploads for System.Linq.Async (the package I'm trying to update today) happened before endjin took over this project, so they all have Claire's name attached:

but again, it seems normal for the upload to have the name of the person who generated the key, and not the name of the team the key represents.

The one remaining thing I'm considering trying is artificially bumping the version number to 6.0.3 to see if uploading a new package kicks it out of its stupor. But the error message definitely suggest that this is unnecessary. It says "Once you've fixed the issue with your package, you can reupload it with the same ID and version."

[glennawatson]

I think you been hit by NuGet/Home#13792 (comment)

So maybe we do need to issue you a key.

[ChrisSfanos]

coming late to the thread - do I need to export anything from the certificate or upload to NuGet.org?

[idg10]

OK.

FWIW, bumping the version to 6.0.3 did not help. (I had wondered if NuGet was perhaps hashing the .nupkg file, and deciding that since I was uploading one identical to the last one it inspected, that it didn't need to rerun validation. If that were the problem, building a newer version would fix it, but it didn't help.)

I've read that issue you've linked to. I'm not sure I understand it. Is the problem that the Rx NuGet packages all have two owners: rxteam and dotnetfoundation, and the problem here is that both of those need to be configured to recognize this certificate?

That would explain why removing dotnetfoundation from the owners would help, but it doesn't really seem to align with what's been written in those issues. It seems like this was the key motivation:

We feel its the right thing to allow users to bring their own valid certificates

But I'm not bringing my own cert. As the verification tool output shown earlier shows, the Author cert here is from the .NET Foundation:

Issued by: CN=.NET Foundation Projects Code Signing CA2, O=.NET Foundation, C=US

I'm using the sign tool. We updated to this back in September 2024: dotnet/reactive#2167 - @ChrisSfanos helped us with this transition. IIRC, there weren't any good .NET exemplars we could copy from.

I've realised that although we've done plenty of builds since then, the only releases we've done have been the private NuGet feeds, on Azure DevOps. I think this might actually be the first time since that transition that we have attempted to push to nuget.org. It's possible that the fact that our NuGet API key expired is a coincidence, and that in fact our NuGet publishing has been broken ever since we moved over to the new sign tool.

[glennawatson]

It's definitely that issue. Nuget a couple years ago added special logic to ignore the non dotnetfoundation user. This was done by Claire who was the executive director at the time.

[glennawatson]

@ChrisSfanos can you add the Rx signing public key to the dnf nuget account?

[ChrisSfanos]

This is done