Skip to content

Publishing Nuget package fails

Summary

We’re suddenly getting:

There was an error publishing a NuGet.Temporary.Package package
There was a timeout and the package was not published. Delete this package and try again.

Screenshot:

image.png

After a LOT of trial and error it turns out that the problem lies in the projectUrl element of the .nupkg. Take the following example .nuspec contained in the .nupkg file:

<?xml version="1.0" encoding="utf-8"?>
<package xmlns="http://schemas.microsoft.com/packaging/2013/05/nuspec.xsd">
  <metadata>
    <id>Foo</id>
    <version>1.2.3</version>
    <authors>John Doe</authors>
    <icon>logo.png</icon>
    <readme>README.md</readme>
    <license type="expression">MIT</license>
    <licenseUrl>https://git.leetdevelopers.com/LICENSE</licenseUrl>
    <projectUrl>https://git.leetdevelopers.com/company/projectgroup/project</projectUrl>
    <repository type="git" url="https://git.leetdevelopers.com/company/projectgroup/project" commit="e5ec6475a44281d5ff07c60a79e4af04e7b0e431" />
    <description>Package Description</description>
    <copyright>(C) 2023 - 2024 Leet Developers</copyright>
    <dependencies>
      <group targetFramework=".NETStandard2.0">
        <dependency id="Microsoft.Extensions.Options" version="7.0.1" exclude="Build,Analyzers" />
      </group>
    </dependencies>
  </metadata>
</package>

When we upload the .nupkg file with this .nuspec in it, the above error occurs. Now focus on the following:

<package xmlns="http://schemas.microsoft.com/packaging/2013/05/nuspec.xsd">
  <metadata>
...
    <licenseUrl>https://git.leetdevelopers.com/LICENSE</licenseUrl>
    <projectUrl>https://git.leetdevelopers.com/company/projectgroup/project</projectUrl>
    <repository type="git" url="https://git.leetdevelopers.com/company/projectgroup/project" commit="e5ec6475a44281d5ff07c60a79e4af04e7b0e431" />
...
  </metadata>
</package>

The gitlab instance is hosted on git.leetdevelopers.com (example ofcourse). If I change the host in the url to anything else (e.g. google.com, non-exitsing-domain.foo) the upload succeeds. However, as soon as the projectUrl or licenseUrl contains the actual host, the upload fails with the above error.

I have tried adding git.leetdevelopers.com to the /etc/hosts file of the gitlab host (with 127.0.0.1) to no avail. Also of note is that the repository url seems to be not affected; either the 'correct' url or a 'random' url works fine.

Steps to reproduce

  1. Create a Nuget package (I have provided a 'dummy' one here: LeetLibrary.1.0.0.nupkg)
  2. Upload the package to a repository: dotnet nuget push "LeetLibrary.1.0.0.nupkg" --source "https://git.leetdevelopers.com/api/v4/projects/1/packages/nuget/index.json" --api-key glpat-XXX Make sure to:
    • Replace the hostname to your Gitlab instance hostname
    • Replace the accesstoken with yours
    • Replace the 1 in the url to the repository id
  3. The upload (or "push") should succeed
  4. Now open the .nupkg file (it's a zipfile) and change the projectUrl in the LeetLibrary.nuspec to the actual hostname (so change changeme.com to git.leetdevelopers.com)
  5. Upload again (see step 2, make sure you update the actual `.nupkg', so you may need to zip/rename it again)
  6. Observe the error in the repository's package reference (see above screenshot)

What is the current bug behavior?

The Nuget package upload fails

What is the expected correct behavior?

The Nuget package upload succeeds

Results of GitLab environment info

Expand for output related to GitLab environment info
Component Version
GitLab Shell 14.33.0
GitLab Workhorse v16.9.1
GitLab API v4
GitLab KAS v16.9.2
Ruby 3.1.4p223
Rails 7.0.8
PostgreSQL (main) 13.13
PostgreSQL (ci) 13.13
Redis 7.0.15

Possible fixes

I have tried changing our CNAME to an A record to no avail, added the hostname to /etc/hosts, also to no avail. I have tried adding 8.8.8.8 as DNS resolver (which won't resolve our git.leetdevelopers.com domain, since it's an local company domain) and then it works fine.

Somehow it seems like Gitlab figures out "hey, that's me" and then something goes south...

Oh, I should mention that I confirmed the SSL certificate validity and that all checked out fine. Also, this must quite certainly be something that has changed in 16.9.0 or later; we have plenty packages before that time that were pushed successfully with the exact same URL.

I have been able to reproduce the issue on another (again, self-hosted) Gitlab instance. Same version (16.9.0 and later updated to 16.9.1 with the same, failed, result).

I'm tagging @mkhalifa3 since it seems like he is involved in the nuget side of things(?). Excuse me if my assumptions are incorrect.

typebug severity2 @trizzi

Edited by Rob Janssen