[10.0 RC 2] `dnx`/`dotnet tool exec` not Authenticating on Private NuGet feed

[dgrantpete]

Describe the bug

On .NET 10, ad-hoc tool execution (dotnet tool exec and dnx) fails with 401 Unauthorized against a private NuGet feed (GitHub Packages), even though:

• dotnet tool install of the same tool from the same feed succeeds on the same machine/config, and
• credentials are available via both NuGet.config and the NuGetPackageSourceCredentials_{name} environment variable.

Logs show a successful GET (while getting the feed index) followed by an Unauthorized GET (while downloading the tool itself).

I'm assuming that the authentication behavior between dotnet tool install and dnx/dotnet tool exec should be functionally equivalent.

To Reproduce

I can't provide exact URLs and names for my org, but have provided an anonymized version of it that is otherwise identical.

Prerequisites

• Any private NuGet v3 feed (e.g., GitHub Packages) with a published .NET tool, e.g. <package-id> at <version>.
• A valid credential configured for that feed (e.g., GitHub PAT with read:packages).
• Feed name = MyFeed (matches credentials), feed URL = https://nuget.pkg.github.com/<org>/index.json.

Minimal NuGet.config

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="MyFeed" value="https://nuget.pkg.github.com/<org>/index.json" />
  </packageSources>
  <packageSourceCredentials>
    <MyFeed>
      <add key="Username" value="<username>" />
      <add key="ClearTextPassword" value="<pat-with-read:packages>" />
    </MyFeed>
  </packageSourceCredentials>
</configuration>

Clear Cached Tool Downloads

dotnet nuget locals all --clear

Attempt using tool via dnx

PS C:\Users\myuser> dnx <package-id> -v=Diagnostic -y --no-http-cache
[NuGet Manager] [Info]   GET https://nuget.pkg.github.com/<org>/index.json
[NuGet Manager] [Info]   OK https://nuget.pkg.github.com/<org>/index.json 254ms
[NuGet Manager] [Info]   GET https://nuget.pkg.github.com/<org>/index.json
[NuGet Manager] [Warning] Your request could not be authenticated by the GitHub Packages service. Please ensure your access token is valid and has the appropriate scopes configured.
[NuGet Manager] [Info]   Unauthorized https://nuget.pkg.github.com/<org>/index.json 395ms
Unhandled exception: Response status code does not indicate success: 401 (Unauthorized).

Notice that the initial GET request is successful, meaning the authentication worked for at least the first request.

Attempt installing tool globally via dotnet tool install

PS C:\Users\myuser> dotnet tool install <package-id> -g -v=Diagnostic --no-http-cache
[NuGet Manager] [Info]   GET https://nuget.pkg.github.com/<org>/index.json
[NuGet Manager] [Info]   OK https://nuget.pkg.github.com/<org>/index.json 604ms
[NuGet Manager] [Info]   GET https://nuget.pkg.github.com/<org>/index.json
[NuGet Manager] [Info]   OK https://nuget.pkg.github.com/<org>/index.json 389ms
[NuGet Manager] [Info]   GET https://nuget.pkg.github.com/<org>/download/<package-id>/index.json
[NuGet Manager] [Info]   OK https://nuget.pkg.github.com/<org>/download/<package-id>/index.json 268ms
[NuGet Manager] [Info]   GET https://nuget.pkg.github.com/<org>/download/<package-id>/<version>/<package-id>.<version>.nupkg
[NuGet Manager] [Info]   OK https://nuget.pkg.github.com/<org>/download/<package-id>/<version>/<package-id>.<version>.nupkg 863ms
Skipping signature verification for NuGet package "<package-id>.<version>" because it comes from a source that does not require signature validation.
Extracting package <package-id>@<version> to C:\Users\myuser\.dotnet\tools\.store\.stage\lb0reknn.nuw\<package-id>\<version>\<package-id>.<version>.nupkg
Locating package <package-id>@<version> in package store C:\Users\myuser\.dotnet\tools\.store\.stage\lb0reknn.nuw
The package has DotnetTool,0.0 package types
No RID-specific package declared for <package-id> <version>.
You can invoke the tool using the following command: <tool-command>
Tool '<package-id>' (version '<version>') was successfully installed.

The tool is able to be successfully downloaded with the exact same configuration and properly forwards the authentication.

Further technical details

dotnet --info
.NET SDK:
 Version:           10.0.100-rc.2.25502.107
 Commit:            89c8f6a112
 Workload version:  10.0.100-manifests.8798a653
 MSBuild version:   18.0.0-preview-25502-107+89c8f6a11

Runtime Environment:
 OS Name:     Windows
 OS Version:  10.0.26200
 OS Platform: Windows
 RID:         win-x64

If there is any other info I can provide to help make this easier, please let me know!

[baronfel]

Thanks for reporting! Can you try calling the dnx command with the --interactive flag added? I have a suspicion about the interaction between the dnx invocation script and our interactive NuGet authentication detection.

[dgrantpete]

@baronfel Absolutely! Here's the result:

PS C:\Users\myuser> dnx <package-id> -v=Diagnostic --interactive
[NuGet Manager] [Info]   GET https://nuget.pkg.github.com/<org>/<package-id>/index.json
[NuGet Manager] [Info]   OK https://nuget.pkg.github.com/<org>/<package-id>/index.json 605ms
Tool package <package-id>@<version> will be downloaded from source https://nuget.pkg.github.com/<org>/index.json.
Proceed? [y/n] (y): y
[NuGet Manager] [Info]   GET https://nuget.pkg.github.com/<org>/<package-id>/index.json
[NuGet Manager] [Warning] Your request could not be authenticated by the GitHub Packages service. Please ensure your access token is valid and has the appropriate scopes configured.
[NuGet Manager] [Info]   Unauthorized https://nuget.pkg.github.com/<org>/<package-id>/index.json 349ms
Unhandled exception: Response status code does not indicate success: 401 (Unauthorized).