Description
Preview builds of Microsoft.FluentUI.AspNetCore.Components are signed with a certificate/signature that produces NuGet signature validation warnings during restore. This makes preview packages difficult to consume in repositories that treat warnings as errors.
This was observed with Microsoft.FluentUI.AspNetCore.Components version 5.0.0-preview.26251.2 from the dotnet9 feed using .NET SDK 10.0.400. Other preview Microsoft.FluentUI.* packages produced by the same build/signing process are likely affected as well, so it would be useful to verify and correct the full preview package set rather than only this specific package.
On Windows, restore reports:
NU3018: The author primary signature's signing certificate is not trusted by the trust provider.
NU3027: The signature should be timestamped to enable long-term signature validity after the certificate has expired.
Linux restore can additionally report:
NU3042: The package signature certificate chain uses an untrusted root certificate.
For projects that treat NuGet warnings as errors, restore fails. Suppressing the warnings only for an affected package requires a direct PackageReference with NoWarn="NU3018;NU3027;NU3042" at each restore entry point because package-specific metadata does not flow through project references. This adds otherwise unnecessary package references and temporary suppression configuration throughout a repository.
Expected behavior
All preview Microsoft.FluentUI.* packages should restore without package-signature warnings. It would be helpful if preview packages used the same signing key and timestamping/signing process as RC and release packages.
Description
Preview builds of
Microsoft.FluentUI.AspNetCore.Componentsare signed with a certificate/signature that produces NuGet signature validation warnings during restore. This makes preview packages difficult to consume in repositories that treat warnings as errors.This was observed with
Microsoft.FluentUI.AspNetCore.Componentsversion5.0.0-preview.26251.2from thedotnet9feed using .NET SDK 10.0.400. Other previewMicrosoft.FluentUI.*packages produced by the same build/signing process are likely affected as well, so it would be useful to verify and correct the full preview package set rather than only this specific package.On Windows, restore reports:
Linux restore can additionally report:
For projects that treat NuGet warnings as errors, restore fails. Suppressing the warnings only for an affected package requires a direct
PackageReferencewithNoWarn="NU3018;NU3027;NU3042"at each restore entry point because package-specific metadata does not flow through project references. This adds otherwise unnecessary package references and temporary suppression configuration throughout a repository.Expected behavior
All preview
Microsoft.FluentUI.*packages should restore without package-signature warnings. It would be helpful if preview packages used the same signing key and timestamping/signing process as RC and release packages.