Repository navigation
PowerShellGet 2.1.4: Credential Providers | Authentication is STILL BROKEN #619
Description
Activity
Getting out a PackageMangement release today that will fix this!
Reacted by James Ruskin and Joel BennettI just got version 2.1.5 of PowershellGet but I'm still not truly able to use it with AzureDevops feeds at all as described in here. Here's what I did in my repro:
1). Install Windows 10 1903 from scratch
2). Run elevated powershell session
3). Set-ExecutionPolicy -ExecutionPolicy RemoteSigned
4). Set-PSRepository -Name PSGallery -InstallationPolicy Truste
5). Install-Module -Name Package PowershellGet -Force (to install 2.1.5)
6). close powershell session and start a new one
7). Register-PSRepository -Name PrivatePSGallery -SourceLocation 'https://pkgs.dev.azure.com/myaccount/_packaging/myfeed/nuget/v2' -InstallationPolicy trusted -PackageManagementProvider nuget -Credential $vscred
($vscred is a System.Management.Automation.PSCredential object created using my Azure Devops PAT, myaccount and myfeed are our private Azure Devops account and feed names)
With this version, I get past Register-PSRepository. Previously I'd get an error about SourceLocation being an invalid web uri.
8). Install-Module -Name 'MyModule' -Repository PrivatePSGallery -Credential $vscred
but I receive an error instead.
What am I doing wrong here? I am passing a Credential parameter. Isn't this a supported use case for version 2.1.4 or newer?
I obtained a new token and used that instead to create $vscred. My issue appears to have been caused by a token which expired on June 14th. Sorry for the confusion.
Reacted by Eric BourlandThanks for all the feedback, and patience--we've released updates to both PackageManagement and PowerShellGet yesterday to fix this and I wanted to see if that had resolved the issues you are facing?
CC: alerickson
still having a lot of trouble using Publish-Script and Publish module from an azure devops pipeline...
here's the relevant snippets from my azure-pipelines.yml
jobs: - job: PublishScripts pool: vmImage: 'vs2017-win2016' steps: - pwsh: | Install-Module -Name PackageManagement -Force -AllowClobber Install-Module -Name PowerShellGet -Force -AllowClobber displayName: Update PackageManagement - pwsh: | Import-Module -Name 'PackageManagement' -RequiredVersion '1.4.2' Import-Module -Name 'PowerShellGet' -RequiredVersion '2.1.5' $galleryName = '****' $galleryUrl = 'https://pkgs.dev.azure.com/****/_packaging/****/nuget/v2' #get azuredevops credentials $password = ConvertTo-SecureString $env:SYSTEM_ACCESSTOKEN -AsPlainText -Force $creds = New-Object System.Management.Automation.PSCredential $env:BUILD_REQUESTEDFOREMAIL, $password $regparams = @{ Name = $galleryName InstallationPolicy = 'Trusted' SourceLocation = $galleryUrl PublishLocation = $galleryUrl ScriptPublishLocation = $galleryUrl Credential = $creds } Register-PSRepository @regparams -Verbose -Debug displayName: Register-PSGallery env: SYSTEM_ACCESSTOKEN: $(System.AccessToken)
even though I have specified the Credential, I am getting the device flow prompt
Starting: Register-PSGallery | -- | -- | ============================================================================== | | Task : PowerShell | | Description : Run a PowerShell script on Linux, macOS, or Windows | | Version : 2.151.1 | | Author : Microsoft Corporation | | Help : https://docs.microsoft.com/azure/devops/pipelines/tasks/utility/powershell | | ============================================================================== | | Generating script. | | ========================== Starting Command Output =========================== | | "C:\Program Files\PowerShell\6\pwsh.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -Command ". 'D:\a\_temp\ead52bd0-2e54-436b-ab73-50ea0d28499e.ps1'" | | [Minimal] [CredentialProvider]DeviceFlow: https://pkgs.dev.azure.com/***/_packaging/***/nuget/v2 | | [Minimal] [CredentialProvider]To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code EZVXTDLDQ to authenticate. | | ##[error]The operation was canceled. | | Finishing: Register-PSGallery'Reacted by itsme112358When specifying the credentials using the environment variable, I also get an error.
jobs: - job: PublishScripts pool: vmImage: 'vs2017-win2016' steps: - pwsh: | Install-Module -Name PackageManagement -Force -AllowClobber Install-Module -Name PowerShellGet -Force -AllowClobber displayName: Update PackageManagement - pwsh: | Import-Module -Name 'PackageManagement' -RequiredVersion '1.4.2' Import-Module -Name 'PowerShellGet' -RequiredVersion '2.1.5' $Env:VSS_NUGET_EXTERNAL_FEED_ENDPOINTS = @" {"endpointCredentials":[{"endpoint":"https://pkgs.dev.azure.com/***/_packaging/***/nuget/v2","username":"ignored","password":"$($Env:SYSTEM_ACCESSTOKEN)"}]} "@ $galleryName = '***' $galleryUrl = 'https://pkgs.dev.azure.com/***/_packaging/***/nuget/v2' $regparams = @{ Name = $galleryName InstallationPolicy = 'Trusted' SourceLocation = $galleryUrl PublishLocation = $galleryUrl ScriptPublishLocation = $galleryUrl } Register-PSRepository @regparams -Verbose -Debug displayName: Register-PSGallery env: SYSTEM_ACCESSTOKEN: $(System.AccessToken)
2019-06-24T19:52:15.8143537Z ##[section]Starting: Register-PSGallery 2019-06-24T19:52:15.8248034Z ============================================================================== 2019-06-24T19:52:15.8248088Z Task : PowerShell 2019-06-24T19:52:15.8248123Z Description : Run a PowerShell script on Linux, macOS, or Windows 2019-06-24T19:52:15.8248159Z Version : 2.151.1 2019-06-24T19:52:15.8248354Z Author : Microsoft Corporation 2019-06-24T19:52:15.8248390Z Help : https://docs.microsoft.com/azure/devops/pipelines/tasks/utility/powershell 2019-06-24T19:52:15.8248426Z ============================================================================== 2019-06-24T19:52:16.6774021Z Generating script. 2019-06-24T19:52:16.7214837Z ========================== Starting Command Output =========================== 2019-06-24T19:52:16.7469045Z ##[command]"C:\Program Files\PowerShell\6\pwsh.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Unrestricted -Command ". 'D:\a\_temp\4741cb7d-7a6f-4067-a038-58b6c3b68f4f.ps1'" 2019-06-24T19:52:27.8573592Z DEBUG: Ping-Endpoint: location=https://pkgs.dev.azure.com/***/_packaging/***/nuget/v2, statuscode=401, resolvedLocation=https://pkgs.dev.azure.com/BrandMuscle/_packaging/BMIPowershellGallery/nuget/v2 2019-06-24T19:52:28.4476205Z DEBUG: 00:00:00.0000001 Calling New() : MethodName = 'GetDynamicOptions' 2019-06-24T19:52:28.4479098Z DEBUG: 00:00:00.0000678 Name: *** 2019-06-24T19:52:28.4484211Z DEBUG: 00:00:00.0000856 Location: https://pkgs.dev.azure.com/***/_packaging/***/nuget/v2 2019-06-24T19:52:28.4489770Z DEBUG: 00:00:00.0001024 Verbose: True 2019-06-24T19:52:28.4490534Z DEBUG: 00:00:00.0001150 Trusted: True 2019-06-24T19:52:28.4490718Z DEBUG: 00:00:00.0001262 Debug: True 2019-06-24T19:52:28.4495673Z DEBUG: 00:00:00.0011488 INVOKING PowerShell Fn Get-DynamicOptions with args Provider that has length 1 2019-06-24T19:52:28.4496932Z DEBUG: 00:00:00.0108756 In PowerShellGet Provider - 'Get-DynamicOptions'. 2019-06-24T19:52:28.4500613Z DEBUG: 00:00:00.0298542 Done calling powershell «Get-DynamicOptions» «PSModule» 2019-06-24T19:52:28.4503769Z DEBUG: 00:00:00.0329736 Calling New() : MethodName = 'GetDynamicOptions' 2019-06-24T19:52:28.4507427Z DEBUG: 00:00:00.0329975 Name: *** 2019-06-24T19:52:28.4508555Z DEBUG: 00:00:00.0330100 Location: https://pkgs.dev.azure.com/***/_packaging/***/nuget/v2 2019-06-24T19:52:28.4561839Z DEBUG: 00:00:00.0330219 Verbose: True 2019-06-24T19:52:28.4561946Z DEBUG: 00:00:00.0330341 Trusted: True 2019-06-24T19:52:28.4562000Z DEBUG: 00:00:00.0330444 Debug: True 2019-06-24T19:52:28.4562079Z DEBUG: 00:00:00.0455502 INVOKING PowerShell Fn Get-DynamicOptions with args Source that has length 1 2019-06-24T19:52:28.4562135Z DEBUG: 00:00:00.0461873 In PowerShellGet Provider - 'Get-DynamicOptions'. 2019-06-24T19:52:28.4562374Z DEBUG: 00:00:00.0612812 Done calling powershell «Get-DynamicOptions» «PSModule» 2019-06-24T19:52:28.4739235Z DEBUG: 00:00:00.0904803 Calling New() : MethodName = 'ResolvePackageSources' 2019-06-24T19:52:28.4747556Z DEBUG: 00:00:00.0911310 Name: *** 2019-06-24T19:52:28.4763422Z DEBUG: 00:00:00.0919322 PackageManagementProvider: NuGet 2019-06-24T19:52:28.4763516Z DEBUG: 00:00:00.0927072 Debug: True 2019-06-24T19:52:28.4776409Z DEBUG: 00:00:00.0933152 ProviderName: PowerShellGet 2019-06-24T19:52:28.4776797Z DEBUG: 00:00:00.0938633 ScriptPublishLocation: https://pkgs.dev.azure.com/***/_packaging/***/nuget/v2 2019-06-24T19:52:28.4913906Z DEBUG: 00:00:00.0944756 PublishLocation: https://pkgs.dev.azure.com/***/_packaging/***/nuget/v2 2019-06-24T19:52:28.5099152Z DEBUG: 00:00:00.0997836 MessageResolver: Microsoft.PowerShell.PackageManagement.Cmdlets.GetMessageString 2019-06-24T19:52:28.5099329Z DEBUG: 00:00:00.1151458 Verbose: True 2019-06-24T19:52:28.5114411Z DEBUG: 00:00:00.1207929 Location: https://pkgs.dev.azure.com/BrandMuscle/_packaging/BMIPowershellGallery/nuget/v2 2019-06-24T19:52:28.5117941Z DEBUG: 00:00:00.1236430 Trusted: True 2019-06-24T19:52:28.5140050Z DEBUG: 00:00:00.1302943 INVOKING PowerShell Fn Resolve-PackageSource with args that has length 0 2019-06-24T19:52:28.5213906Z DEBUG: 00:00:00.1368437 In PowerShellGet Provider - 'Resolve-PackageSource'. 2019-06-24T19:52:28.5881822Z VERBOSE: Repository details, Name = 'PSGallery', Location = 'https://www.powershellgallery.com/api/v2'; IsTrusted = 'False'; IsRegistered = 'True'. 2019-06-24T19:52:28.5889863Z DEBUG: 00:00:00.2055089 Yielding package source for PSGallery at location https://www.powershellgallery.com/api/v2 2019-06-24T19:52:28.5921091Z DEBUG: 00:00:00.2083705 Done calling powershell «Resolve-PackageSource» «PSModule» 2019-06-24T19:52:28.7081217Z PackageManagement\Register-PackageSource : Unhandled Exception - Message:'One or more errors occurred. (PowerShell is in NonInteractive mode. Read and Prompt functionality is not available.)' Name:'AggregateException' Stack Trace:' at System.Threading.Tasks.Task`1.GetResultCore(Boolean waitCompletionNotification) 2019-06-24T19:52:28.7082498Z at Microsoft.PowerShell.PackageManagement.Cmdlets.RegisterPackageSource.ProcessRecordAsync() 2019-06-24T19:52:28.7082618Z at Microsoft.PowerShell.PackageManagement.Cmdlets.AsyncCmdlet.<>c__DisplayClass83_0.<AsyncRun>b__0()' 2019-06-24T19:52:28.7083008Z At C:\Users\VssAdministrator\Documents\PowerShell\Modules\PowerShellGet\2.1.5\PSModule.psm1:11323 char:17 2019-06-24T19:52:28.7083961Z + ... $null = PackageManagement\Register-PackageSource @PSBoundParamete ... 2019-06-24T19:52:28.7084444Z + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 2019-06-24T19:52:28.7084889Z + CategoryInfo : InvalidOperation: (Microsoft.PowerShel\u2026gisterPackageSource:RegisterPackageSource) [Register-PackageSource], Exception 2019-06-24T19:52:28.7085373Z + FullyQualifiedErrorId : UnhandledException,Microsoft.PowerShell.PackageManagement.Cmdlets.RegisterPackageSource 2019-06-24T19:52:28.7085716Z 2019-06-24T19:52:28.8216220Z ##[error]PowerShell exited with code '1'. 2019-06-24T19:52:28.8556689Z ##[section]Finishing: Register-PSGalleryAs a workaround for this broken azure devops / azure artifacts powershell repository experience you can use a local repo and the builtin nuget commands in Azure DevOps to publish.
You will need to handle the dependencies by publishing them first or specifying as externalDependencies.
I created a gist here of a pipeline that uses this workaround.
https://gist.github.com/jasonchester/12597c0af92e65b728644155a19f05a3Sydney Smith (@SydneyhSmith) the new release is so much better, but still broken.
EVERY TIME I search for a module that is not in the authenticated feed, I get prompted for credentials.
Simple repro:
Assuming I have installed the Nuget Credential provider using the script from their github in an elevated console:
#requires -RunAsAdministrator iwr https://raw.githubusercontent.com/microsoft/artifacts-credprovider/master/helpers/installcredprovider.ps1 -out ~\Downloads\installcredprovider.ps1 ~\Downloads\installcredprovider.ps1 -AddNetfx
And I have updated to the current versions of both relevant modules:
Install-Module PackageManagement -RequiredVersion "1.4.2" -SkipPublisherCheck Install-Module PowerShellGet -RequiredVersion "2.1.5"
In a new window ...
Register-PSRepository -Name PoshCode -SourceLocation https://pkgs.dev.azure.com/poshcode/_packaging/PowerShell/nuget/v2 -InstallationPolicy Trusted # Find a module that's in that feed, it works! Huzzah! Find-Module ModuleBuilder
But then ...
# Find a module that's NOT in that feed: Find-Module PowerShellGet
At this point, it appears that whenever it fails to find a module in the Azure feed that requires credentials, it re-prompts for credentials, and regenerates a new PAT token.
If I again search for a module that does exist in my feed, it works fine. But the next time I search for one that does not exist in my feed, it prompts for credentials!
Ok, update ...
After re-installing the credential helper (with-Force) I've been able to get this to work now ...# -Force to install latest credential provider iwr https://raw.githubusercontent.com/microsoft/artifacts-credprovider/master/helpers/installcredprovider.ps1 -out ~\Downloads\installcredprovider.ps1 ~\Downloads\installcredprovider.ps1 -AddNetfx -Force # Update to latest modules Find-Module PackageManagement, PowerShellGet -Repository PSGallery | ForEach { Install-Module -Name $_.Name -RequiredVersion $_.Version -Repository PSGallery -SkipPublisherCheck -AllowClobber }
After exiting all PowerShell windows and re-opening, I was able to register and search for modules both in my feed and the PSGallery feed.
Register-PSRepository -Name PoshCode -SourceLocation https://pkgs.dev.azure.com/poshcode/_packaging/PowerShell/nuget/v2
Additionally, putting JSON in
ENV:VSS_NUGET_EXTERNAL_FEED_ENDPOINTSseems to work now too.Reacted by Dave Schafer and eashendenNVPUgh. Ok, maybe not. I don't understand. I tested this in PS5 earlier today and it worked.
Just now I ran a Find-Module without thinking in PS6, and it went back to requesting credentials when it couldn't find a module in our repo -- and NOW, PS5 seem broken again too. I don't understand at all.
I'm not sure this should be closed. I'm hitting all the same errors you're hitting.
Nick Hudacin (@nhudacin) we just published PowerShellGet and PackageManagement to our int gallery (www.poshtestgallery.com/api/v2) to resolve these errors. Please feel free to test these out and see if behavior is working appropriately. The credential provider should only be prompted if the -credential parameter is not passed in.
You can register the int gallery and install the respective modules by running:
Register-PSRepository -Name PoshTestGallery -SourceLocation https://www.poshtestgallery.com/api/v2 Install-Module PowerShellGet, PackageManagement -Repository PoshTestGallery -ForceThanks Sydney Smith (@SydneyhSmith). I installed the two modules from your int gallery, closed all of my powershell windows, and opened up a fresh one. I'm getting all sorts of errors now:
~> Register-PSRepository -Name 'internal' -SourceLocation 'https://pkgs.dev.azure.com/my_org/_packaging/powershell/nuget/v2' -InstallationPolicy Trusted Start-Process : This command cannot be run due to the error: The system cannot find the file specified. At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\2.2\PSModule.psm1:9330 char:5 + Start-Process $filename -ArgumentList "$arguments -V minimal" ` + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) [Start-Process], InvalidOperationException + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.Commands.StartProcessCommand Start-Process : This command cannot be run due to the error: The system cannot find the file specified. At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\2.2\PSModule.psm1:9337 char:5 + Start-Process $filename -ArgumentList "$argumentsNoRetry -V verbo ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) [Start-Process], InvalidOperationException + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.Commands.StartProcessCommand Exception calling "Match" with "2" argument(s): "Value cannot be null. Parameter name: input" At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\2.2\PSModule.psm1:9346 char:5 + $username = [System.Text.RegularExpressions.Regex]::Match($conten ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : ArgumentNullException Exception calling "Match" with "2" argument(s): "Value cannot be null. Parameter name: input" At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\2.2\PSModule.psm1:9347 char:5 + $password = [System.Text.RegularExpressions.Regex]::Match($conten ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : ArgumentNullException Start-Process : This command cannot be run due to the error: The system cannot find the file specified. At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\2.2\PSModule.psm1:9330 char:5 + Start-Process $filename -ArgumentList "$arguments -V minimal" ` + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) [Start-Process], InvalidOperationException + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.Commands.StartProcessCommand Start-Process : This command cannot be run due to the error: The system cannot find the file specified. At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\2.2\PSModule.psm1:9337 char:5 + Start-Process $filename -ArgumentList "$argumentsNoRetry -V verbo ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) [Start-Process], InvalidOperationException + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.Commands.StartProcessCommand Exception calling "Match" with "2" argument(s): "Value cannot be null. Parameter name: input" At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\2.2\PSModule.psm1:9346 char:5 + $username = [System.Text.RegularExpressions.Regex]::Match($conten ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : ArgumentNullException Exception calling "Match" with "2" argument(s): "Value cannot be null. Parameter name: input" At C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\2.2\PSModule.psm1:9347 char:5 + $password = [System.Text.RegularExpressions.Regex]::Match($conten ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotSpecified: (:) [], MethodInvocationException + FullyQualifiedErrorId : ArgumentNullException Register-PSRepository : The specified repository 'internal' is unauthorized and cannot be registered. Try running with -Credential. At line:1 char:1 + Register-PSRepository -Name 'internal' -SourceLocation 'https:// ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (:) [Write-Error], WriteErrorException + FullyQualifiedErrorId : RepositoryCannotBeRegistered,Register-PSRepositoryNick Hudacin (@nhudacin) you’ll need the credential provider itself installed (see: https://devblogs.microsoft.com/powershell/using-powershellget-with-azure-artifacts/#). That error isn't the most helpful but if you don’t have the credential provider installed you’ll need to use the -credential parameter
37 remaining items
Thanks Andy Feller (@andyfeller), we are integrating credential persistence and will likely have this out with the next release. We are integrating with Secret Management with PowerShellGet.
Here is some blog posts describing Secret Management:
Reacted by Andy FellerThanks, Steven Bucher (@StevenBucher98)! ✨
This came up on my radar while trying to put this PoC together but just trying to get something working, so I hadn't delved deeper, you know? Let me dig into this and see how to incorporate to GitHub Actions.
Reacted by Steven BucherDon't know if anybody at Microsoft still cares, but the issue persists.
I have a deployment group of buildservers and another of developer machines. They are identical in OS and most of the setup.
After spending hours reading the docs and redoing everything many times I also found that passing credentials with every command is the only way. Well if it's so, it's so...BUT I furthermore found out that on my buildservers registering a repository behaves differently on dev vs buildservers.
I run the exact same script on both machines:#Param $ArtifactSource = $env:PackageFeedEndpointV2 $RegisterAs = $env:PowerShellRepositoryName $Credential = [pscredential]::new($env:COMPUTERNAME,($env:SYSTEM_ACCESSTOKEN | ConvertTo-SecureString -AsPlainText -Force)) Register-PsRepository -Name $RegisterAs -SourceLocation $ArtifactSource -PublishLocation $ArtifactSource -InstallationPolicy Trusted -Credential $Credential
On my buildservers it runs just fine.
On the dev machines it tries to use DeviceFlow four times (times out every time) before adding the repository anyway (successfully).
The main difference I can find is that on dev machines Visual Studio is installed. On the build servers it isn't. I cannot say for sure that's the issue but that is what I suspect to be the issue...I also found the fix via Add-Packagesource here: https://andrewmatveychuk.com/how-to-access-private-powershell-repository-from-azure-pipeline/
I still think it's sad to see that the issue has persisted for years, costs the community loads of time and frustration and nobody is bothering to fix it (reliably)...
I ran into the same problem as many here, where you are constantly taken to the device flow even thought it seems like you should not be. But using the troubleshooting tips for the Azure Artifacts Credential Provider I figured out that our Azure DevOps authentication setup required multifactor authentication. Maybe that's why I was getting the device flow so much? But even if that's not it, I found a reasonable alternative that means I don't need to enter credentials all the time.
The key is to setup the
VSS_NUGET_EXTERNAL_FEED_ENDPOINTSenvironment variable as talked about here. You follow mostly the steps in Use an Azure Artifacts feed as a private PowerShell repository but instead of passing credentials, you rely onVSS_NUGET_EXTERNAL_FEED_ENDPOINTS.So basically this:
- Create a PAT that has package permissions
- Set a user-level environment variable
VSS_NUGET_EXTERNAL_FEED_ENDPOINTSto something like:'{"endpointCredentials": [{"endpoint":"https://pkgs.dev.azure.com/<organization>/_packaging/<feed>/nuget/v2", "username":"<youremail>, "password":"<pat>"}]}' Register-PSRepository -Name "YourFeedName" -SourceLocation "https://pkgs.dev.azure.com/<organization>/_packaging/<feed>/nuget/v2" -PublishLocation "https://pkgs.dev.azure.com/<organization>/_packaging/<feed>/nuget/v2" -InstallationPolicy TrustedRegister-PackageSource -Name "YourFeedName" -Location "https://pkgs.dev.azure.com/<organization>/_packaging/<feed>/nuget/v2" -ProviderName NuGet -Trusted -SkipValidate- You do need this for
Install-Moduleto work.
- You do need this for
- Make sure it worked with
Find-Module -Repository YourFeedName
Setting up the
VSS_NUGET_EXTERNAL_FEED_ENDPOINTSenvironment variable may make you uneasy. But for me it's like using a PAT in anuget.configlike I've done in the past. But you do have to remember to re-generate the PAT and update the environment variable when it expires.Tom Winter (@twinter-amosfivesix) can you try using our latest prerelease version (can be found here). There is an integration with the SecretMangement module that allows for a smoother experience with handling credentials and credential persistence.
Tom Winter (@twinter-amosfivesix) that's a pretty hefty amount of prerequisites. I was just trying to come up with some simple instructions for people to install a utility module from our Azure Artifacts. For CI/CD that's fine, but just to get a module that's a lot of hoops.
alerickson I tried the latest prerelease and couldn't get it working but maybe the steps are different since all the commands changed in psg 3.0. IDK... I'm giving up on this and telling people to store their pat in a file and pass -Credential everywhere. Nothing else works.
Cody Batt (@CodyBatt) Yes credential management is different in PowerShellGetV3. It relies on Microsoft.PowerShell.SecretsManagement module, and you can look at this blogpost to get familiar with SecretsManagement, install that module and set up a vault. In order for credential persistence to work with PSGet, it needs SecretsManagement, otherwise if it's not there it will automatically give an error. After the vault is set up with SecretsManagement then all you need to do is create a PSCredentialInfo object like this example here (which assumes you have a vault named
"testvault"already).You should register (or set) the repository with the
-CredentialInfo, like this example hereWe'll put out a blogpost by end of this month to show all the steps for working with Credentials in PSGetV3, thank you for sharing this feedback!
Anam Navied (@anamnavi) Right, I tried to set it up with SecretsManagment and didn't get anywhere. Succinct documentation for getting it set up will be a big help.
Reacted by Anam NaviedTom Winter (@twinter-amosfivesix) In case you rely on the command during a pipeline, you don't even need to do it manually. It suffices to add a NuGet Authenticate step which creates the environment variable for you.
That way you don't need to store a PAT somewhere. Instead it will be generated with the appropriate permissions that the agent actually has.Sorry I never got any notifications about replies. I was just trying this again recently and I was not getting the repeated prompt for credentials. Still using PSGetV2. So not sure what was going on there.
And yes NuGet Authenticate is what you'd use in an Azure DevOps pipeline. I haven't gotten there yet.
Tom Winter (@twinter-amosfivesix) are you able to try using PowerShellGetV3? If so, please see my earlier message about using credential management with PSGetV3, thanks!
I did a deep dive today to come up with a cleaner process for using Azure Artifact Feeds that I could hand off to non-technical people. During that dive I found that the "easiest" work-around may just be to have Visual Studio installed. There's more detail below if anyone is interested.
The cleaner process for downloading from feeds using PowerShellGet v2 that I came up with today follows.
One time do this:
install-module powershellget -force -allowclobber iex "& { $(irm https://aka.ms/install-artifacts-credprovider.ps1) } -AddNetfx"That gets you the latest version of PowerShellGet and installs the Azure Artifacts Credential Provider. You will need to restart your PowerShell window after you've done the above steps.
Then in PowerShell you can do this:
$repositoryName = <your repository name> $packageLocation = <your artifacts feed v2 uri> $vssCredentialProvider = "$env:UserProfile\.nuget\plugins\netfx\CredentialProvider.Microsoft\CredentialProvider.Microsoft.exe" $tokenJson = ConvertFrom-Json (& $vssCredentialProvider -U $packageLocation -F Json) $pscred = new-object PSCredential -ArgumentList $tokenJson.Username, (ConvertTo-SecureString $tokenJson.Password -AsPlainText -Force) Register-PsRepository $repositoryName -SourceLocation $packageLocation -PublishLocation $packageLocation -InstallationPolicy Trusted -Credential $pscred $moduleName = <name of your module> install-module $moduleName -SkipPublisherCheck -Credential $pscred import-module $moduleName -ForceThe VssCredentialProvider variable can have "netfx" replaced with "netcore" if you're running in PowerShell Core.
You can get around the credentials request by installing Visual Studio due to a bug where PowerShellGet presumes that
$env:NUGET_PLUGIN_PATHSwill be set to the location of the credential provider. This always fails on Windows since that environment variable is the root directory where Nuget gets its plugins not a direct pointer to the credential provider. The module really needs to go looking for the credential provider. Linux and MacOS work though since that case falls through to a .NET Core specific scenario and builds out the entire path to the credential provider.Windows thus always fails the first check for the credential provider and falls back to "vswhere" to locate the provider. If you don't have Visual Studio installed then the check fails.
However, even if you solve the problem by pointing $env:NUGET_PLUGIN_PATHS to the credential provider you've only won half the battle. Your registration will work and even
Find-Packagewill work butinstall-moduleandinstall-packagewill fail because they cannot authenticate to the feed. I've triedinstall-package -verbose -debugto narrow down what exactly is going wrong but without something to debug into the output isn't useful. I cannot even locate the source that is raising the issue.I hope this helps anyone else having the same issue.
Reacted by Cody Batt and Jeff LewisWe'll put out a blogpost by end of this month to show all the steps for working with Credentials in PSGetV3, thank you for sharing this feedback!
Anam Navied (@anamnavi) did the blog post get created? Can you link it here?
What is the status of this? It seems that
Install-PSResourceandFind-PSResourcestill do not work properly with Azure Artifacts and the Azure Artifacts Credential Provider in Microsoft.PowerShell.PSResourceGet v1.0.3; they result in a401 (Not Authorized)error.The
Install-ModuleandFind-Modulecommands work properly though when registered with the same repository URI, so I know that the Azure Artifacts Credential Provider is setup properly.What's worse though is it seems that the latest version 3.0.23 of PowerShellGet has broken the
Install-ModuleandFind-Modulecommands completely; see PowerShell/PowerShellGet#58. Luckily I still have PowerShellGet v3.0.12 installed so the commands still work on my local machine, but new servers that I'm setting up are not able to connect to our Azure Artifacts feed without the-Credentialparameter.I created the AzureArtifactsPowerShellModuleHelper module a while back to help solve this issue, but found that sometimes even with that module PowerShellGet 2.2.5 still couldn't access the feed and we'd need to use the prerelease v3 version. With v3.0.23 broken though, and older v3 versions delisted and thus can't be installed, there's not much we can do when v2.2.5 has issues.
Here's a screenshot showing the issue. If you need any other information for troubleshooting let me know; I'm happy to provide anything that can help get this issue resolved.
I noticed afterward that this issue is for PowerShellGet v2. I've opened this new issue in the PSResourceGet repo: PowerShell/PSResourceGet#1601
I don't know why #133 was closed when this is still so COMPLETELY BROKEN
We cannot work with repositories that require credentials unless we ...
... pass credentials
... with every,
... single
... call.
That's not how any of this is supposed to work.
For example, following the docs for the Azure Artifacts CredProvider, and the blog post from earlier this month we should be able to install the credential provider:
Set something like this:
Register the feed:
And get a list of modules:
But what actually happens is that with no error I get no results.
But if I try it with nuget:
It works fine, and I get a list of modules...
YOU'RE DOING IT WRONG
The problem is that PowerShellGet isn't looking up the credentials against the feed address.
Instead, it's looking up (or rather, relying on nuget to) the credentials against the final url with all the parameters in it. So we can make the
Find-Modulecommand work if we change the stored endpoint to this:And then re-run:
But this is because I've hard-coded the token to a particular search.
Of course the result is that when we don't use the environment variable (i.e.
Remove-Item ENV:VSS_NUGET_EXTERNAL_FEED_ENDPOINTS) and do aFind-Modulewe get a "devicelogin" from the credential provider, but the credentials are cached for that specific URL, so if weFind-Modulefor any other specific module, or try anything else (likeInstall-Module), they will fail to find the cached credentials, and require going through the "devicelogin" again...The worst part is that each time we go through the device login, you're creating a new PAT token that you'll never re-use...
Please, fix it again.