VMR build fails with warning NU1905: `Audit source 'nuget.org' did not provide any vulnerability data`

[Winniexu01]

Failing build

'nuget-client' failed during build:

/vmr/artifacts/source-built-sdks/Microsoft.DotNet.Arcade.Sdk/tools/Tools.proj : warning NU1905: Audit source 'nuget.org' did not provide any vulnerability data.
/vmr/artifacts/source-built-sdks/Microsoft.DotNet.Arcade.Sdk/tools/Tools.proj : warning NU1900: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json.
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Common/NuGet.Common.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Commands/NuGet.Commands.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Credentials/NuGet.Credentials.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Commands/NuGet.Commands.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Common/NuGet.Common.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Credentials/NuGet.Credentials.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Versioning/NuGet.Versioning.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Versioning/NuGet.Versioning.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Resolver/NuGet.Resolver.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Resolver/NuGet.Resolver.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Protocol/NuGet.Protocol.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Protocol/NuGet.Protocol.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Packaging/NuGet.Packaging.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.ProjectModel/NuGet.ProjectModel.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Packaging/NuGet.Packaging.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.ProjectModel/NuGet.ProjectModel.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.PackageManagement/NuGet.PackageManagement.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.PackageManagement/NuGet.PackageManagement.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.CommandLine.XPlat/NuGet.CommandLine.XPlat.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.CommandLine.XPlat/NuGet.CommandLine.XPlat.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Frameworks/NuGet.Frameworks.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Frameworks/NuGet.Frameworks.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.LibraryModel/NuGet.LibraryModel.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.LibraryModel/NuGet.LibraryModel.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Configuration/NuGet.Configuration.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Configuration/NuGet.Configuration.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.DependencyResolver.Core/NuGet.DependencyResolver.Core.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.DependencyResolver.Core/NuGet.DependencyResolver.Core.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/Microsoft.Build.NuGetSdkResolver/Microsoft.Build.NuGetSdkResolver.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/Microsoft.Build.NuGetSdkResolver/Microsoft.Build.NuGetSdkResolver.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Build.Tasks/NuGet.Build.Tasks.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Build.Tasks/NuGet.Build.Tasks.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Build.Tasks.Console/NuGet.Build.Tasks.Console.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Build.Tasks.Console/NuGet.Build.Tasks.Console.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Build.Tasks.Pack/NuGet.Build.Tasks.Pack.csproj : error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]
/vmr/src/nuget-client/src/NuGet.Core/NuGet.Build.Tasks.Pack/NuGet.Build.Tasks.Pack.csproj : error NU1900: Warning As Error: Error occurred while getting package vulnerability data: Unable to load the service index for source https://api.nuget.org/v3/index.json. [/vmr/src/nuget-client/build/restorehelper.targets]
    2 Warning(s)
    36 Error(s)

Time Elapsed 00:00:17.06

[NikolaMilosavljevic]

Offline builds are failing, online builds are working fine. Offline builds do not even have nuget.org in the list of sources. Nuget.config seems correct. Trying to get a local repro to investigate further.

[NikolaMilosavljevic]

The issue was likely introduced with the latest nuget.client update that was merged yesterday: dotnet/sdk#42679

Source-build validation was successful, but we only do one online validation build.

[NikolaMilosavljevic]

This nuget.client change might be related: NuGet/NuGet.Client#5963

[NikolaMilosavljevic]

@jeffkl this is related to your change: NuGet/NuGet.Client#5963 - the only change coming from nuget.client with yesterday's dependency flow PR.

Fully offline build (no internet access), with local sources (no nuget.org) is pinging nuget.org and failing:

/vmr/src/nuget-client/src/NuGet.Core/NuGet.CommandLine.XPlat/NuGet.CommandLine.XPlat.csproj error NU1905: Warning As Error: Audit source 'nuget.org' did not provide any vulnerability data. [/vmr/src/nuget-client/build/restorehelper.targets]

Binlog from internal build

I tried to disable the new resolver by setting the env.var (as mentioned in NuGet/NuGet.Client#5963 (comment)) and still see the same issue.

In my local repro build, using only local sources (no nuget.org), but with internet access, I see the following (in RestoreTask):

  GET https://api.nuget.org/v3/vulnerabilities/index.json
  GET https://api.nuget.org/v3-vulnerabilities/2024.08.09.12.03.59/vulnerability.base.json
  GET https://api.nuget.org/v3-vulnerabilities/2024.08.09.12.03.59/2024.08.13.12.04.09/vulnerability.update.json

Here are the feeds that are set in this offline build (local sources only):

Feeds used:
    /src/git/dotnet/artifacts/packages/Release/NonShipping/xdt/
    /src/git/dotnet/artifacts/packages/Release/NonShipping/msbuild/
    /src/git/dotnet/artifacts/packages/Release/NonShipping/roslyn/
    /src/git/dotnet/artifacts/packages/Release/NonShipping/runtime/
    /src/git/dotnet/artifacts/packages/Release/NonShipping/emsdk/
    /src/git/dotnet/artifacts/packages/Release/NonShipping/cecil/
    /src/git/dotnet/artifacts/packages/Release/NonShipping/arcade/
    /src/git/dotnet/artifacts/packages/Release/Shipping/msbuild/
    /src/git/dotnet/artifacts/packages/Release/Shipping/roslyn/
    /src/git/dotnet/artifacts/packages/Release/Shipping/symreader/
    /src/git/dotnet/artifacts/packages/Release/Shipping/roslyn-analyzers/
    /src/git/dotnet/artifacts/packages/Release/Shipping/runtime/
    /src/git/dotnet/artifacts/packages/Release/Shipping/source-build-externals/
    /src/git/dotnet/artifacts/packages/Release/Shipping/emsdk/
    /src/git/dotnet/artifacts/packages/Release/Shipping/command-line-api/
    /src/git/dotnet/prereqs/packages/reference/
    /src/git/dotnet/prereqs/packages/previously-source-built/
    /src/git/dotnet/prereqs/packages/prebuilt/

[NikolaMilosavljevic]

OK - it's not the change I linked above. Other changes in nuget.client have caused this. Here's the full set of changes, and some of them are introducing source auditing: https://github.com/nuget/nuget.client/compare/5485ea6..e68fb0f

[NikolaMilosavljevic]

Fixed with dotnet/sdk#42706