Help fixing build build "error NU3028: Package" "UntrustedRoot: self signed certificate in certificate chain"

Docker Hub
1

Hi all, I’ve had a project which was all working completely fine, but then I restructured the project to add in unit tests and moved all the main source and the docker file down a level in the repository.

DockerHub: https://hub.docker.com/r/djdd87/synoai
GitHub: https://github.com/djdd87/SynoAI

Once I’d resolved the new paths, I’m now getting errors which sound like certificate errors when nuget is trying to pull the dependecies:

Step 9/18 : RUN dotnet restore "SynoAI.csproj"

---> Running in c0d0e881f60b

Determining projects to restore...

/src/SynoAI.csproj : error NU3028: Package 'Microsoft.OpenApi 1.2.3' from source 'https://api.nuget.org/v3/index.json': The author primary signature's timestamp found a chain building issue: UntrustedRoot: self signed certificate in certificate chain

/src/SynoAI.csproj : error NU3037: Package 'Microsoft.OpenApi 1.2.3' from source 'https://api.nuget.org/v3/index.json': The author primary signature validity period has expired.

I can build and run the docker image locally, it just seems to break when building inside DockerHub.

My “latest” tag pulls from the “main” branch. Dockerfile location is set to Dockerfile and the path is set to /SynoAI/.

I’ve tried deleting the latest tag and recreating it, but it made no difference. I also tried disabling build caching and got the same issue.

1 Like
2

same issue :sweat_smile:

3

Same issue after you’ve restructured your project, or is this a DockerHub wide issue at the moment?

4

Same issue here, not being able to build the project on local or on Azure Devops Pipelines.

5

Problems from nuget.org : NuGet | Status

1 Like
6

I have the same issue.

7

Same here. Maybe related to this: https://devblogs.microsoft.com/nuget/microsoft-author-signing-certificate-update/#:~:text=Since%202018%2C%20Microsoft%20has%20used,the%20end%20of%20January%202021.?

8

Looks like there is a workaround for now: https://github.com/NuGet/Home/issues/10491#issuecomment-768377395

Using the mcr.microsoft.com/dotnet/sdk:5.0-focal base image seems to do the trick

9

Official issue thread here https://github.com/NuGet/Announcements/issues/49

10

After switching to focal, I now get:

Step 13/18 : FROM build AS publish

pull access denied for build, repository does not exist or may require ‘docker login’: denied: requested access to the resource is denied

EDIT: I’d missed one of the -focal suffixes on the first occurrence of mcr.microsoft.com/dotnet/aspnet:5.0. I’d also missed “AS build” after changing the URL. All working now with -focal.

11

Here is all possible solution added The author primary signature’s timestamp found a chain building issue: UntrustedRoot: self-signed certificate in certificate chain