Azure Artifacts 凭据提供程序在 Docker 构建期间未使用 PAT 进行身份验证

Question

我有一个简单的 .NET 6 C# Web API，我想将其托管在 Linux 容器中。它有一些托管在私有(private) Azure Artifact Feed 中的包依赖项。我想使用Azure Artifacts Credential Provider ，因为这最终将在 Azure 构建管道中构建(并且我想通过变量注入(inject)提要的凭据)。

问题

当我运行构建时，它失败并出现以下错误:

#17 ERROR: process "/bin/sh -c dotnet restore \"./My.Project/My.Project.csproj\" --configfile ./nuget.config" did not complete successfully: exit code: 1
------
 > [build 5/9] RUN dotnet restore "./My.Project/My.Project.csproj" --configfile ./nuget.config:
#17 1.686   Determining projects to restore...
#17 8.947 /src/My.Project/My.Project.csproj : error NU1301: Unable to load the service index for source https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json.
#17 14.94 /src/My.Project/My.Project.csproj : error NU1301: Unable to load the service index for source https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json.
#17 21.45 /src/My.Project/My.Project.csproj : error NU1301: Unable to load the service index for source https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json.
... 4 more retries
#17 53.23   Failed to restore /src/My.Project/My.Project.csproj (in 51.11 sec).
------
Dockerfile:27
--------------------
  25 |     COPY ["nuget.config", "./"]
  26 |
  27 | >>> RUN dotnet restore "./My.Project/My.Project.csproj" --configfile ./nuget.config
  28 |     RUN rm ./nuget.config
  29 |
--------------------
ERROR: failed to solve: process "/bin/sh -c dotnet restore \"./My.Project/My.Project.csproj\" --configfile ./nuget.config" did not complete successfully: exit code: 1

上下文

我的项目有一个 nuget.config 文件来配置私有(private)源:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <packageSources>
        <clear />
        <add key="some-feed" value="https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json" />
    </packageSources>
</configuration>

(此时没有包凭据，这是设计使然)

我的 Dockerfile 如下(删除了不必要的部分):

FROM mcr.microsoft.com/dotnet/aspnet:6.0 AS base

# Install curl
RUN apt-get update && apt-get install -y curl

# Install Azure Artifact Credential Provider
RUN sh -c "$(curl -fsSL https://aka.ms/install-artifacts-credprovider.sh)"

# Specify an argument for the feed's access token (PAT)
ARG FEED_ACCESSTOKEN

# Configure VSS_NUGET_EXTERNAL_FEED_ENDPOINTS environment variable with passed in arg
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS="{\"endpointCredentials\": [{\"endpoint\":\"https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json\", \"username\":\"docker\", \"password\":\"${FEED_ACCESSTOKEN}\"}]}"

# Sanity check to see if arg gets injected
RUN echo $VSS_NUGET_EXTERNAL_FEED_ENDPOINTS >&2

# Sanity check to see if AACP was installed
RUN ls /root/.nuget/plugins/netcore/CredentialProvider.Microsoft

WORKDIR /app

FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
WORKDIR /src
COPY ["My.Project.csproj", "My.Project/"]
COPY ["nuget.config", "./"]

RUN dotnet restore "./My.Project/My.Project.csproj" --configfile ./nuget.config
RUN rm ./nuget.config

WORKDIR "/src/My.Project"
COPY . .
RUN dotnet build "My.Project" -c Release -o /app/build

... do some publish things

构建的运行方式如下:

docker build --build-arg FEED_ACCESSTOKEN=%SOME-ENV-VARIABLE% --progress=plain  -t myproject .

(fwiw PAT 已授予打包(读取)权限)

在健全性检查 1 中，输出如下所示:

#10 [base 4/6] RUN echo {"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json", "username":"docker", "password":"my_pat"}]}
#0 0.715 {"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json", "username":"docker", "password":"my_pat"}]}

在健全性检查 2 中显示此输出，确认 AACP 已安装:

#11 [base 5/6] RUN ls /root/.nuget/plugins/netcore/CredentialProvider.Microsoft
#11 0.805 CredentialProvider.Microsoft.deps.json
#11 0.805 CredentialProvider.Microsoft.dll
#11 0.805 CredentialProvider.Microsoft.exe
#11 0.805 CredentialProvider.Microsoft.pdb
... some more files
#11 0.805 runtimes
#11 DONE 0.9s

在我的 nuget.config 文件中手动指定 PAT 有效:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <packageSources>
        <clear />
        <add key="some-feed" value="https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json" />
    </packageSources>
    <packageSourceCredentials>
        <some-feed>
            <add key="Username" value="docker" />
            <add key="ClearTextPassword" value="my_pat" />
        </some-feed>
    </packageSourceCredentials>
</configuration>

结果是:

#17 7.497   Restored /src/My.Project/My.Project.csproj (in 6 sec). # Yay

<edit start>根据乔纳森的评论，我还执行了 dotnet restore与 --verbosity detailed ，它没有暴露任何其他可能表明失败原因的错误。日志中也没有引用“auth”、“credential”、“provider”、“VSS_NUGET_EXTERNAL_FEED_ENDPOINTS”或“CredentialProvider.Microsoft”。

我从中得到的一些信息如下:

#17 1.066        Task "GetRestoreDotnetCliToolsTask"
#17 1.067          (in) ProjectPath '/src/My.Project/My.Project.csproj'
#17 1.067          (in) DotnetCliToolReferences ''
#17 1.067          (in) RestoreSources 'https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json'
#17 1.067          (in) RestorePackagesPath '/root/.nuget/packages/'
#17 1.067          (in) RestoreConfigFilePaths '/src/nuget.config'
#17 1.067        Done executing task "GetRestoreDotnetCliToolsTask".

从上面我收集到我的 nuget.config 文件正在被正确解释。

看起来实际恢复正在发生的“目标”输出如下:

#17 1.087      1>Target "Restore" in file "/usr/share/dotnet/sdk/6.0.408/NuGet.targets" from project "/src/My.Project/My.Project.csproj" (entry point):
#17 1.087        Task "RemoveDuplicates"
#17 1.087        Done executing task "RemoveDuplicates".
#17 1.087        Using "RestoreTask" task from assembly "/usr/share/dotnet/sdk/6.0.408/NuGet.Build.Tasks.dll".
#17 1.087        Task "RestoreTask"
#17 1.089          (in) RestoreGraphItems Count '13'
#17 1.089          (in) RestoreDisableParallel 'False'
#17 1.089          (in) RestoreNoCache 'False'
#17 1.089          (in) RestoreIgnoreFailedSources 'False'
#17 1.089          (in) RestoreRecursive 'True'
#17 1.089          (in) RestoreForce 'False'
#17 1.089          (in) HideWarningsAndErrors 'False'
#17 1.089          (in) RestoreForceEvaluate 'False'
#17 1.089          (in) RestorePackagesConfig 'False'
#17 1.187          X.509 certificate chain validation will use the fallback certificate bundle at '/usr/share/dotnet/sdk/6.0.408/trustedroots/codesignctl.pem'.
#17 1.294          Running restore with 12 concurrent jobs.
#17 1.295          Reading project file /src/My.Project/My.Project.csproj.
#17 1.353          Restoring packages for /src/My.Project/My.Project.csproj...
#17 1.357          Restoring packages for .NETCoreApp,Version=v6.0...
#17 8.330      1>/src/My.Project/My.Project.csproj : error NU1301: Unable to load the service index for source https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json.
#17 14.53      1>/src/My.Project/My.Project.csproj : error NU1301: Unable to load the service index for source https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json.
#17 20.86      1>/src/My.Project/My.Project.csproj : error NU1301: Unable to load the service index for source https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json.
#17 27.09      1>/src/My.Project/My.Project.csproj : error NU1301: Unable to load the service index for source https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json.
#17 33.16      1>/src/My.Project/My.Project.csproj : error NU1301: Unable to load the service index for source https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json.
#17 39.49      1>/src/My.Project/My.Project.csproj : error NU1301: Unable to load the service index for source https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json.
#17 45.77      1>/src/My.Project/My.Project.csproj : error NU1301: Unable to load the service index for source https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json.
#17 51.90      1>/src/My.Project/My.Project.csproj : error NU1301: Unable to load the service index for source https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json.
#17 51.92          Checking compatibility of packages on net6.0.
#17 51.92          All packages and projects are compatible with net6.0.
#17 51.93          Committing restore...
#17 51.93          Generating MSBuild file /src/My.Project/obj/My.Project.csproj.nuget.g.props.
#17 51.93          Generating MSBuild file /src/My.Project/obj/My.Project.csproj.nuget.g.targets.
#17 51.93          Writing assets file to disk. Path: /src/My.Project/obj/project.assets.json
#17 51.94          Writing cache file to disk. Path: /src/My.Project/obj/project.nuget.cache
#17 51.95          Persisting dg to /src/My.Project/obj/My.Project.csproj.nuget.dgspec.json
#17 51.95          Failed to restore /src/My.Project/My.Project.csproj (in 50.63 sec).
#17 51.96
#17 51.96          NuGet Config files used:
#17 51.96              /src/nuget.config
#17 51.96
#17 51.96          Feeds used:
#17 51.96              https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json
#17 51.96        Done executing task "RestoreTask" -- FAILED.
#17 51.96      1>Done building target "Restore" in project "My.Project.csproj" -- FAILED.
#17 51.96      1>Done Building Project "/src/My.Project/My.Project.csproj" (Restore target(s)) -- FAILED.
#17 51.96
#17 51.96 Build FAILED.

<edit end>

所以:

1. 凭据/PAT 良好
2. 已安装 Azure Artifact 凭据提供程序
3. VSS_NUGET_EXTERNAL_FEED_ENDPOINTS 环境变量设置为正确的值

我做错了什么？

Answer 1

花了不必要的时间才发现我的 Dockerfile 是错误的。正在基础镜像中安装 AACP，并尝试在构建镜像中进行构建。

所以，而不是这个:

FROM mcr.microsoft.com/dotnet/aspnet:6.0 AS base
WORKDIR /app

EXPOSE 80
EXPOSE 443
RUN apt-get update && apt-get install -y curl
RUN sh -c "$(curl -fsSL https://aka.ms/install-artifacts-credprovider.sh)"
ARG FEED_ACCESSTOKEN
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS="{\"endpointCredentials\": [{\"endpoint\":\"https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json\", \"username\":\"docker\", \"password\":\"${FEED_ACCESSTOKEN}\"}]}"
RUN echo $VSS_NUGET_EXTERNAL_FEED_ENDPOINTS >&2
RUN ls /root/.nuget/plugins/netcore/CredentialProvider.Microsoft

WORKDIR /app

FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
WORKDIR /src
COPY ["My.Project.csproj", "My.Project/"]
COPY ["nuget.config", "./"]

RUN dotnet restore "./My.Project/My.Project.csproj" --configfile ./nuget.config
RUN rm ./nuget.config

WORKDIR "/src/My.Project"
COPY . .
RUN dotnet build "My.Project" -c Release -o /app/build

... do some publish things

应该是这样的:

FROM mcr.microsoft.com/dotnet/aspnet:6.0 AS base
WORKDIR /app

EXPOSE 80
EXPOSE 443
    
FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
ARG FEED_ACCESSTOKEN
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS="{\"endpointCredentials\": [{\"endpoint\":\"https://pkgs.dev.azure.com/myproject/someguid/_packaging/some-feed/nuget/v3/index.json\", \"username\":\"docker\", \"password\":\"${FEED_ACCESSTOKEN}\"}]}"    
RUN sh -c "$(curl -fsSL https://aka.ms/install-artifacts-credprovider.sh)"

WORKDIR /src
COPY ["My.Project.csproj", "My.Project/"]
COPY ["nuget.config", "./"]

RUN dotnet restore "./My.Project/My.Project.csproj" --configfile ./nuget.config
RUN rm ./nuget.config

WORKDIR "/src/My.Project"
COPY . .
RUN dotnet build "My.Project" -c Release -o /app/build

... do some publish things

--verbosityDetailed 然后输出:

#13 1.271          Restoring packages for .NETCoreApp,Version=v6.0...
#13 2.722          Using /root/.nuget/plugins/netcore/CredentialProvider.Microsoft/CredentialProvider.Microsoft.dll as a credential provider plugin.
#13 3.075              [CredentialProvider.230950]Running in plug-in mode
#13 3.076              [CredentialProvider.230950]Command-line v1.0.5+501a6eafccfe6b97a80a7b7f89b1022d3618a4b1: /root/.nuget/plugins/netcore/CredentialProvider.Microsoft/CredentialProvider.Microsoft.dll -Plugin