'dotnet restore' is failing when mixing a private NuGet feed and NEST

Question

dotnet restore fails unexpectedly on certain packages for me and I can't figure out why.

I have a private NuGet repository hosted through the VSTS Packages extension, and my NuGet.Config looks like (as described here https://www.visualstudio.com/en-us/docs/package/nuget/auth#dotnet-core)

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
    <add key="MyPackages" value="https://{myaccount}.pkgs.visualstudio.com/_packaging/{myfeed}/nuget/v3/index.json"` />
  </packageSources>
  <packageCredentials>
    <MyPackages>
        <add key="Username" value="vsts" />
        <add key="ClearTextPassword" value="{my PAT}" />
    </MyPackages>
  </packageCredentials>
</configuration>

If I create a new project using dotnet new console and add a reference to a package hosted on my feed, restoring works fine.

<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>netcoreapp1.1</TargetFramework>
  </PropertyGroup>
  <ItemGroup>
    <PackageReference Include="My.Lib" Version="1.0.0"></PackageReference>
  </ItemGroup>
</Project>

However, if I also include a package reference to NEST version 2.5.0 (or any version really), dotnet restore fails with

C:\Program Files\dotnet\sdk\1.0.0\NuGet.targets(97,5): error : Unable to load the service index for source https://{myaccount}.pkgs.visualstudio.com/_packaging/{myfeed}/nuget/v3/index.json.\r `[C:\Users\test\dotnet\dotnet.csproj]
C:\Program Files\dotnet\sdk\1.0.0\NuGet.targets(97,5): error : Response status code does not indicate success: 401 (Unauthorized). [C:\Users\test\dotnet\dotnet.csproj]

What's very odd though is that replacing NEST with anything else, restoring will work. For example, adding ElasticSearch.Net 2.5.0 will work fine.

If I remove my package credentials and private NuGet feed from my nuget.config and only reference NEST, then it works - but then I can't access my private feed.

And finally what's most strange is that restoring worked fine yesterday, but now for me and my coworkers we can't restore.

Is this a VSTS Packages issue? What could be different about NEST?

Steps to reproduce

Expected behavior

dotnet restore should not fail restoring

Actual behavior

dotnet restore fails - citing a 401 unauthorized response from the private nuget feed
C:\Program Files\dotnet\sdk\1.0.0\NuGet.targets(97,5): error : Unable to load the service index for source https://{account}.pkgs.visualstudio.com/_packaging/{feed}/nuget/v3/index.json.\r [C:\Users\davidf\temp\dotnet\dotnet.csproj]
C:\Program Files\dotnet\sdk\1.0.0\NuGet.targets(97,5): error : Response status code does not indicate success: 401 (Unauthorized). [C:\Users\davidf\temp\dotnet\dotnet.csproj]

Environment data

dotnet --info output:

dotnet --info
.NET Command Line Tools (1.0.0)

Product Information:
    Version:            1.0.0
    Commit SHA-1 hash:  e53429feb4

Runtime Environment:
    OS Name:     Windows
    OS Version:  10.0.14393
    OS Platform: Windows
    RID:         win10-x64
    Base Path:   C:\Program Files\dotnet\sdk\1.0.0

Full console output

C:\Users\davidf\temp\dotnet>dotnet restore -v diag
C:\Program Files\dotnet\sdk\1.0.0\MSBuild.dll /NoLogo /ConsoleLoggerParameters:Verbosity=Minimal /Logger:Microsoft.DotNet.Tools.MSBuild.MSBuildLogger,C:\Program Files\dotnet\sdk\1.0.0\dotnet.dll /m /t:Restore /v:m /verbosity:diag .\dotnet.csproj
  Restoring packages for C:\Users\davidf\temp\dotnet\dotnet.csproj...
C:\Program Files\dotnet\sdk\1.0.0\NuGet.targets(97,5): error : Unable to load the service index for source https://{account}.pkgs.visualstudio.com/_packaging/{feed}/nuget/v3/index.json.\r [C:\Users\davidf\temp\dotnet\dotnet.csproj]
C:\Program Files\dotnet\sdk\1.0.0\NuGet.targets(97,5): error :   Response status code does not indicate success: 401 (Unauthorized). [C:\Users\davidf\temp\dotnet\dotnet.csproj]

Some more information -

It seems that when I only use the official nuget.org source, NEST will work as will any other NuGet package as expected. And if there is a typo in the package name, you get an error like error : Unable to resolve NestOops

But when I have my NuGet source as an additional package source, any typo to a package name results in a 401 from my feed. I still don't know why NEST has the same error though.

Answer 1

It looks like a false alarm!

The NuGet configuration was not quite correct - the <packageCredentials> should have been a <packageSourceCredentials>.

My guess is that some of the packages from the VSTS feed were cached (a separate project had its own configuration with the correct element, to put them in the cache to begin with) which is why they appeared to resolve correctly even though they weren't authenticating correctly. Then whenever a package was being looked up, that wasn't in the cache, it would hit our feed with wrong credentials and fail.