SolvedHome error NU1403: The package Microsoft.CSharp.4.0.1 sha512 validation failed.

I'm trying to add nuget 4.9 lock files, but I get the error:

/src/Serialization.Test/Froto.Serialization.Test.fsproj : error NU1403: The package Microsoft.CSharp.4.0.1 sha512 validation failed. The package is different than the last restore. [/src/Froto.sln]

Steps to reproduce:
Checkout the lock branch from ctaggart/froto#104, then restore using docker:

docker run -it --rm -v ${PWD}:/src -w /src mcr.microsoft.com/dotnet/core/sdk:2.2.105 bash
dotnet restore Froto.sln

My hunch is that the nuget is NuGetFallbackFolder is causing problems. It includes nuget packages that don't match NuGet.org. WHY DOES IT HAVE PACKAGES THAT DON'T MATCH NUGET.ORG?

The Froto.Serialization.Test.fsproj has a lock to:

      "Microsoft.CSharp": {
        "type": "Transitive",
        "resolved": "4.0.1",
        "contentHash": "eEgt/ktABPBa/1xBex3M6b7C4dYsGQ0HWuwe9Xhflgu4cvn4a5VvFSLj5vyTKkp+hKrVpTRdqTXDTAxsIL1Reg==",

It matches what is downloaded from nuget.org:

C:\Users\taggac\.nuget\packages\microsoft.csharp\4.0.1\.nupkg.metadata
{
  "version": 1,
  "contentHash": "eEgt/ktABPBa/1xBex3M6b7C4dYsGQ0HWuwe9Xhflgu4cvn4a5VvFSLj5vyTKkp+hKrVpTRdqTXDTAxsIL1Reg=="
}

The docker image NuGetFallbackFolder contentHash does not match:

root@0366cb41b8b4:/src# cat /usr/share/dotnet/sdk/NuGetFallbackFolder/microsoft.csharp/4.0.1/.nupkg.metadata
{
  "version": 1,
  "contentHash": "17h8b5mXa87XYKrrVqdgZ38JefSUqLChUQpXgSnpzsM0nDOhE40FTeNWOJ/YmySGV6tG6T8+hjz6vxbknHJr6A=="
}

At least the NuGetFallbackFolder on my Windows PC matches the docker image:

C:\Program Files\dotnet\sdk\NuGetFallbackFolder\microsoft.csharp\4.0.1\.nupkg.metadata
{
  "version": 1,
  "contentHash": "17h8b5mXa87XYKrrVqdgZ38JefSUqLChUQpXgSnpzsM0nDOhE40FTeNWOJ/YmySGV6tG6T8+hjz6vxbknHJr6A=="
}

Is there a way to disable NuGetFallbackFolder from the lock check? I tried this without luck:

<DisableImplicitNuGetFallbackFolder>true</DisableImplicitNuGetFallbackFolder>

If you are going to continue shipping NuGet packages in NuGetFallbackFolder, can you make sure they match NuGet.org?

28 Answers

✔️Accepted Answer

My mistake was not locking down my NuGet sources with a NuGet.Config, which had this one enabled: Microsoft Visual Studio Offline Packages, but probably better to lock down your the sources with NuGet.Config:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
  </packageSources>
</configuration>

The DisableImplicitNuGetFallbackFolder of true is required for the restore to work correctly in docker. Here is my working Directory.Build.props:

<Project>
  <PropertyGroup>
    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
    <RestoreLockedMode>true</RestoreLockedMode>
    <NoWarn>NU1603</NoWarn>
    <DisableImplicitNuGetFallbackFolder>true</DisableImplicitNuGetFallbackFolder>
  </PropertyGroup>
</Project>

I then best to clear all the local nuget caches and regenerate the lock files.

dotnet nuget locals all --clear
git clean -xfd
git rm **/packages.lock.json -f
dotnet restore Froto.sln

It is working now for me. Some of the hash's don't make sense to me still, but at least it is consistent across platforms when you take the NuGetFallbackFolder's completely out of the picture.

Related Issues:

66
Home extern alias support for NuGet package references
After some experimentation and got it to work Design document From @fubar-coder on April 5 2017 15:5...
59
Home Package 'NameOfPackage' is incompatible with 'all' frameworks in project
I was surprised by this error as well Clearing NuGet cache fixed the problem. From @bsmayer on April...
38
Home Package Manager Error: Unable to load the service index for source (bad proxy settings)
For me removing the .nuget folder located in C:\Users\YourNameHere fixed the problem. ...
32
Home Unhelpful error message when incorrectly using nuspec version tag of nuget pack
This is definitely an error message which could do with some improvement It seems there are two prob...
27
Home Framework assemblies are no longer added to .nuspec when using the new .csproj project system
Is there any hope of getting this fixed soon? We're ready to merge in .csproj ports on several major...
27
Home error NU1403: The package Microsoft.CSharp.4.0.1 sha512 validation failed.
My mistake was not locking down my NuGet sources with a NuGet.Config which had this one enabled: Mic...
24
Home Add --prerelease option to dotnet add package
At the very least the error message needs to change This is the current experience: The message impl...
20
Home contentFiles (cs, compile) not working in NetStandard projects.
@emgarten Thanks for your fantastic support Two suggestions Please provide docs! NuGet is essential ...
13
Home dotnet.exe nuget push command now supports -skipDuplicate like nuget.exe did.
To clarify my expectation: #1630 should have included the required changes to dotnet Without that th...
12
Home Invoke must be called on a background thread
The error is generated by NuGet attempting to execute init.ps1 scripts for packages installed in a p...
11
Home dotnet restore on 2.1 preview1 throws error instead of warning when project files are "missing"
I have fixed that by changing Docker file from to From @christiansparre on March 8 ...
7
Home nuget.exe does not work with msbuild 12 as of 3.5.0 [fixed in 4.0.0]
.. Before NuGet CLI version 3.5.0.1938 We were using the NuGet CLI version 3.4.4.1321 When using ver...
3
Home Please provide a way to reference package ID and version in .target/.props files
I have the same problem I want to have way to specify package ID and version at my .targets file For...