Signing assemblies with PFX files in MSBuild, Team Build, and TFS - msbuild

I get this error when trying to build a project using Team Build (MSBuild) on TFS 2010:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Common.targets (1970):
Cannot import the following key file: CCC.pfx.
The key file may be password protected.
To correct this, try to import the certificate again or manually install the certificate to the Strong Name CSP with the following key container name: VS_KEY_C00C673BBB353901
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Common.targets (1970):
Importing key file "CCC.pfx" was canceled.
It all builds OK in Visual Studio 2010. The assembly is signed with a PFX file. Usually in Visual Studio we are prompted for the password the first time we build, but then never again...
I've tried running:
sn -i companyname.pfx VS_KEY_3E185446540E7F7A
as other replies as suggested in Stack Overflow question Cannot import the keyfile 'blah.pfx' - error 'The keyfile may be password protected'. I've tried importing into the personal certificate store as suggested in Stack Overflow question Using MSBuild to sign ClickOnce or assembly results in error MSB3321. But all to no avail, still the same error.
How do I do it? Do I have to somehow add the certificate to the Windows account the build service runs under or something like that?
Alternatively, how do I make the build done in Team Build not use signing? I just want to check it compiles and run the unit tests. I don't need signing for that.

You need to adapt this answer to your specific. Something like:
sn -i companyname.pfx VS_KEY_C00C673BBB353901

What I did is not that elegant, but works: log in as the user that runs msbuild on the build machine, manually invoke msbuild, and then type in the password when prompted. It'll now be saved in that user's certificate store, and now the builds can run unattended.

What finally fixed it for me was making the account under which TFS Build service runs an administrator on the local machine.
Don't know though if any of the other stuff I was trying before also needs to be done to get it working. But before it was admin it didn't work after it became admin it worked.

I was getting the same error, and after reading your "administrator" comment - I just ran VS Command Prompt as Admin and it now works fine.

I have faced similar issue
Scenario 1: While building project in local system
In my case i was getting the manifest signing error once i download the project from TFS and build it.
To avoid this issue I right clicked on the project ==> Properties ==> Signing
then unchecked "Sign the ClickOnce Manifests"
OR
You can click Select from store button and select your login id from the dialog box open.
OR
You can install the PFX file manually and later click on More Options button to install those certificate.
Scenario 2:- Manifest error during Build
Here to resolve this error i first clicked Select from store button and select my login id from the dialog box .Then I committed that project in TFS first and then run the build.

I had following settings:
<PropertyGroup>
<SignAssembly>false</SignAssembly>
<AssemblyOriginatorKeyFile>MyKey.pfx</AssemblyOriginatorKeyFile>
</PropertyGroup>
Assembly signing was turned off, but AssemblyOriginatorKeyFile caused error during manifest sign. Removed AssemblyOriginatorKeyFile to fix it.

Related

floobits Sublime Text 3 - SSL CERTIFICATE_VERIFY_FAILED unable to get local issuer certificate (_ssl.c:1124)

Edit 1: I am using the floobits plugin (latest release), uninstalled and installed again from the package manager. I am not getting a traceback but an error window with the following error message: Unable to join workspace. CERTIFICATE_VERIFY_FAILED unable to get local issuer certificate (_ssl.c:1124).
Edit 2: I had tried the Package Control Upgrade package and Staisfy Dependencies, but that did not help fix it.
I was able to fix it (answer below).
I have been stuck on this issue for days now. When I try to connect to a floobits workspace in sublime text, I get the error message that CERTIFICATE_VERIFY_FAILED unable to get local issuer certificate (_ssl.c:1124).
I searched about this a lot but I don't know what's wrong anymore.
I started by upgrading certifi and pip itself.
Then I read somewhere that I should check if OpenSSl(and the requests library of py) and cURL can open the URL (floobits.com) since the workspace is hosted there. curl returned no errors but OpenSSL (and requests) wasn't able to verify, gave the same error.
So I downloaded the certificates from the website on opening it in chrome. I downloaded all three certificates (for the root, intermediate and the website itself), and appended them to cacert.pem inside the certifi package folder. After that, when I ran it, OpenSSL was able to open it (and the requests library too, got a 200 response code).
But, floobits still wasn't able to connect and gave the same error. I know that there is nothing wrong with floobits.com and the sublime extension since a friend can still open the workspace without problems.
Please tell me what I can do to fix this.
So I managed to 'solve' the problem by bringing Sublime back to a fresh state and then copying my files again. Answering here if anyone gets this problem.
Method:
Go to the Sublime > Preferences > Browse Packages
In this folder, copy and backup the 'User' folder to someplace else.
Delete all the folders in this location (Sublime need not be closed during this but it's best if you do close it)
Copy the backed-up 'User' folder back here (remember the location where you deleted, %AppData%\Roaming\Sublime Text 3\Packages (for Windows))
All set, you now have a fresh installation of sublime.
Sublime will start installing all packages again, wait for it to finish and resume work.
This solved the problem I was having. Unfortunately, I couldn't track down the problem.

VSTS build fails with MSB3325, Cannot import PFX key file

I had created a build definition to build a desktop application online on visualstudio.com which fail at task Build Solution (Visual Studio build) with following error,
[error]C:\Program Files (x86)\Microsoft Visual
Studio\2017\Enterprise\MSBuild\15.0\Bin\Microsoft.Common.CurrentVersion.targets(3156,5):
Error MSB3325: Cannot import the following key file:
Sixmod5Certificate.pfx. The key file may be password protected. To
correct this, try to import the certificate again or manually install
the certificate to the Strong Name CSP with the following key
container name: VS_KEY_3B2BCC84AE4E26F1
I followed solution specified at, https://developercommunity.visualstudio.com/content/problem/156086/vsts-build-msb3325-cannot-import-the-following-key.html
then as specified at, https://stackoverflow.com/a/48698229/3531672
I had added a powershell script task before build task, as follows,
[CmdletBinding()]
param(
[Parameter(Mandatory)][string] $pfxpath,
[Parameter(Mandatory)][string] $password
)
Add-Type -AssemblyName System.Security
$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$cert.Import($pfxpath, $password, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]"PersistKeySet")
$store = new-object system.security.cryptography.X509Certificates.X509Store -argumentlist "MY", CurrentUser
$store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]"ReadWrite")
$store.Add($cert)
$store.Close()
but no luck yet,
There are different SO post similar to this specifying solution to build from Admin user, or installing pfx certificate manually, but as they are related to personal computer and I am trying to configure Continuous integration on visualstudio.com, they don't seem useful to me.
Please note I am able to successfully build on my local machine.
If you wish to regenerate this problem at your end, follow these steps,
STEP 1: Create a new VSTO Addin Project (Any Excel/Word/Powerpoint).
STEP 2: Attach this to VSTS.
STEP 3: In signing tab of Application properties, instead of using temperory certificate, create a new password protected certificate (PFX - Personal Information Exchange in my case) and use this to sign ClickOnce Manifest
STEP 4: Try to build on local machine, it will succeed.
STEP 5: Push it over and try to build on VSTS, you will get the same error as above.
I unchecked the "Sign the assembly" checkbox from the "project properties -> Signing" page and everything worked like a charm. The build was signed successfully through VSTS. Somehow I missed this solution provided in many SO threads related to the problem.

Unauthorized nuget package from Visual Studio Team Services using asp.net core rc2

I am unable to install/restore nuget packages from a Visual Studio Team Services feed in an asp.net core web application (RC2). I receive the following:
error: Response status code does not indicate success: 401
(Unauthorized).
I am running Visual Studio Community 2015 Update 2 and nuget version 3.4.4. I am able to install/restore packages from this feed in other project types.
Do I need to do something else to pass my credentials for an asp.net core web app?
Steps to reproduce:
From Team Services package tab I select "Connect to Feed" and copy the NuGet package source URL
In visual studio -> Tools -> NuGet Package Manager -> Package Manager settings -> Package sources and add the feed url from vso
Then from my ASP.NET Core Web Application (.NET Framework) project right click references -> Manage NuGet Packages
-> Select my feed from Package source (packages are listed) -> Click to install
In output:
Installing NuGet package xxxxx
Successfully installed xxxxx to WebApplication1
========== Finished ==========
Then it will try to restore the package at which point I get:
error: Response status code does not indicate success: 401 (Unauthorized).
error: Failed to retrieve information from remote source
And inside web project references - package has warning icon - NU1001 The dependency xxxxx could not be resolved
I know that it's not exactly the same issue, but people may come across this one alongside as I did.
I have installed VS Community 2019​ and yesterday I decided to remove the VS 2017, but after that, when I tried to restore the Nuget Packages made by the company, it started displaying an error of 401 Unauthorized.
After a few net searches I decided I didn't want to mess around with VS configurations and files, I then realized, since it's an 401 Unauthorized it's related with an account so what I did was:
Closed VS2019
Went to windows management credentials and removed all those that where related with my packages
Reopened VS 2019 and restored the Nuget Packages for my solution.
It them asked for my credentials, set it up and all went well from here.
Here are the two accounts I removed and got recreated:
In my case I was using an azure dev ops feed. After updating visual studio 2022 I started getting this message "Response status code does not indicate success: 401 (Unauthorized)."
I followed and tried most of the solutions here. but what worked for me was to
Go to: file -> accounts settings
Click "sign out"
Then go to the nuget manager and click the refresh button
This will then show you the azure dev ops login window where you login to your account
This worked for me, (your mileage may vary) just hope it helps someone else and saves some precious receding hairs.
I can reproduce your issue at my side and following is the workaround I use to restore the packages:
Remove the VSTS feed resource from "VS\Tools\NuGet Package Manager\Package sources".
Open "Packages" tab from your VSTS web portal.
Select the feed you want to connect and click "Connect to feed" option.
Select "Personal Access Tokens" method in the dialog.
Copy the generated command in the dialog.
Run CMD as Administrator on you machine.
Paste the copied command into CMD.
Add "-StorePasswordInClearText" argument after the command.
Run the command.
Restart the VS.
Install and restore the packages.
For me, the issue was due to incorrect credentials (not specifying the domain) when connecting to a private on-premise Azure Artifacts NuGet feed, which wasn't immediately apparent.
Using Visual Studio 2019, open NuGet Package Manager for a project. If the 'Browse' tab shows first and the package source is the private NuGet feed, there appears to be no issue as it initially lists all packages. However, switching to the 'Installed' tab results in a login dialogue popping up.
If I enter my username and password without the domain (so username intead of domain/username), it appears to accept this, but then no other versions are listed for my installed packages other than the version installed. If I go to the 'Browse' tab, I then see the following error:
When I click 'Show errors in output', I see the following:
Failed to retrieve metadata from source 'https://[domain]/[Collection]/_packaging/[GUID]/nuget/v3/query2/?q=&skip=0&take=26&prerelease=true&semVerLevel=2.0.0'.
Response status code does not indicate success: 401 (Unauthorized).
To resolve this, in Credential Manager, I close Visual Studio, then remove any credentials relating to the Azure DevOps server(e.g., [domain], VSCredentials_[domain]). I noticed that the username for these showed the wrong domain - it showed the Azure DevOps server domain instead of the Active Directory domain.
I then reopen Visual Studio, open NuGet Package Manager again and this time (on the 'Installed' tab) enter my credentials including the domain (domain/username). This resolves the issue and allows me to connect to the Azure Artifact NuGet feed.
This happens when you change your profile password. Just sign out and from top right (at your profile picture-> account settings); sign in again and your problem will be solved.
I had a similar problem (no authentication) in the NuGet Restore task of a VSTS build definition. The solution was to add a NuGet.config file in the root of the project with a reference to the official and my custom feed. Maybe it helps your core project also.
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<packageSources>
<clear />
<add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
<add key="RmlrTools" value="https://<MyProjectName>.pkgs.visualstudio.com/DefaultCollection/_packaging/<MyFeedName>/nuget/v3/index.json" />
</packageSources>
<!-- used to store credentials -->
<packageSourceCredentials />
<!-- Used to specify which one of the sources are active -->
<activePackageSource>
<!-- this tells only one given source is active -->
<add key="NuGet official package source" value="https://nuget.org/api/v2/" />
<!-- this tells that all of them are active -->
<add key="All" value="(Aggregate source)" />
</activePackageSource>
<!-- Used to disable package sources -->
<disabledPackageSources />
<!--
Used to specify default API key associated with sources.
See: NuGet.exe help setApiKey
See: NuGet.exe help push
See: NuGet.exe help mirror
-->
<!--<apikeys>
<add key="http://MyRepo/ES/api/v2/package" value="encrypted_api_key" />
</apikeys>-->
</configuration>
Try restarting the computer before you try any of the above.
In my case , I followed these steps
create the personal access token with relevant credentials
download nuget.exe (nuget cli)
using windows run command open the cmd,then
cd C:\Downloads(where the cli is downloaded) ,type
"nuget.exe" and enter
execute -->
nuget.exe sources Add -Name "MyFeedName" -Source "https://myfeedurl" -username username -password MyAccessToken
in visual studio tools->commandline->developer command prompt
dotnet restore
Go to "Manage Nuget Packages"
Click "Setting" from right top Corner
Untick "Packages"
In my case I was using Azure Devops private feed and the NuGet package restoring worked in Visual Studio and in Nuget CLI but it didn't work with Rider and dotnet restore command
The solution was to install The Azure Artifacts Credential Provider and it fixed the problem. I just had to run this command to install it:
iex "& { $(irm https://aka.ms/install-artifacts-credprovider.ps1) }"
This is a fix for a local developer machine. For fixing it on CI/CD check this question.
I'm using VS 2022. The way I was able to fix it is to relog into VS. The trick is the tooltip on the top right SAYS I'm logged in, but when you click your profile logo on the top right, then goto Account Settings, it told me I needed to "reenter my credentials". How does that work, I'm logged in, but I'm not logged in? Turns out it doesn't work, I needed to log in AGAIN for it to REALLY work.

Could not load file or assembly 'microsoft.visualstudio.shell.ui.internal' or one of its dependencies. SQL Server 2012

My SQL Server 2012 suddenly stopped working here is all I got in popup message:
could not load file or assembly 'microsoft.visualstudio.shell.ui.internal' or one of its dependencies. An attempt was made to load a program with incorrect format.
I have Repaired using installation CD but no luck.
I had the same problem and fixed by uninstalling the Visual Studio 2010 Shell and installing back. Simply reinstalling doesn't work.
1. Download the Visual Studio 2010 Shell: https://www.microsoft.com/en-us/download/details.aspx?id=1366
2. Run the exe file and click uninstall(or remove).
3. Run the exe file and click install with default settings.
After these steps the Management Studio will work just fine.
I got this error in VS2013 when reparing in the logfille,
[113C:2588][2018-01-20T16:41:54]i000: MUX: ExecuteError: Package (vs_minshellcore) failed: Error Message Id: 1305 ErrorMessage: Error reading from file C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualStudio.Shell.UI.Internal\v4.0_12.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Shell.UI.Internal.dll. Verify that the file exists and that you can access it.
and I check the file is exist, and I modify its access authority to complete control to every user account, but this error still occur,
Finally I delete this dll, and find same dll in another Normal Computer with VS , and copy the file paste to the problem computer, and run repair again then pass.
Share my works Microsoft.VisualStudio.Shell.UI.Internal.dll in Here.
But in my case after repair success, vs2013 still got error when opening, so I finally give up and turn to use vs2015, which luckly can work. It is a strange problem.
have this problem also with vs2019 community. I was trying to create the first 2019 project after it is installed. Then I got this. I ran the install exe file, vs_community.exe again in order to repaire it. But I found out that the install program request to restart the pc to finish the last step. Actually I restarted the pc afterwards manually. But I still did it by clicking on the button "restart pc". After the pc is restarted, the problem is gong. I can create project without any error.

Build Fail : aspnet_client\system_web\4_0_30319

I have a build step that is part of my deployment configuration. My coworker told me it had worked once in a blue moon
I kept on getting this error consistently when I ran this build step:
Deleting dirPath (qa.comedy.net\aspnet_client\system_web\4_0_30319). [15:22:22]:
[VSMSDeploy] C:\Program Files (x86)\MSBuild\Microsoft\VisualStudio\v10.\We
\Microsoft.Web.Publishing.targets(3588, 5): Web deployment task failed.((3/28/2012 3:22:22 PM) An error occurred when the request was processed on the remote computer.)
Attempt to perform an unauthorized operation on file '4_0_30319'.
It seems that it is trying to delete the folder
aspnet_client\system_web\4_0_30319 , but has no permission to.
we run this build on a virtual machine.
Any suggestions on how to resolve this?
All help is greatly appreciated.
Thanks
I had this issue deploying as site with msdeploy and teamcity. I resolved it by deleteing these folders from my website aspnet_client\system_web\4_0_30319
Yes you can delete this folder and the next deploy will work, but with the next windows update that runs the asp.net registration tool as part of it's install will add this folder back to all asp.net sites on IIS (with the incorrect permissions) - so your deployment will fail again. You can avoid this by
Giving the deploy user elevated privileges (not a great solution for
obvious reasons)
Add the folder structure to your SC so it gets
deployed instead of the deployment trying to delete it (not ideal, but easiest)
Stop automatic windows updates (not sensible)
You might be able to do
something like this
http://blog.richardszalay.com/2012/12/18/demystifying-msdeploy-skip-rules/
to ignore the folder in deployment (I've not tried this)
As MemeDeveloper mentions in their answer, one way to fix this is to simply ignore that directory. Indeed, this is the easiest fix and doesn't require adding anything to your source control repository or build output. Just add the following to your msdeploy.exe command:
-skip:Directory="aspnet_client"
I wasn’t using TeamCity but I think I also had this issue. I was trying to deploy to Discount ASP.NET using VS2010 WebDeploy. After reading what doglin and Dan posted, I found I could workaround this problem by checking the “Leave extra files on destination (do not delete)” box. That may not be an option for everyone but it worked for me.
I faced the same problem during WebDeploy in TeamCity. I end up elevating privileges for WebDeploy account under which I do WebDeploy task. So the account have enough power to delete those folder (local admin role).