Chocolatey Download signature Incorrect on Windows 2022 image

[JWHolding]

Description

The fix for chocolatey download has included in #9876 / #9891 was not included in the most recent windows 2022 release / tag. Any chance you could produce a new version?

Platforms affected

• Azure DevOps
• GitHub Actions - Standard Runners
• GitHub Actions - Larger Runners

Runner images affected

• Ubuntu 20.04
• Ubuntu 22.04
• Ubuntu 24.04
• macOS 11
• macOS 12
• macOS 13
• macOS 13 Arm64
• macOS 14
• macOS 14 Arm64
• Windows Server 2019
• Windows Server 2022

Image version and build link

Win22/20240514.3

Is it regression?

No

Expected behavior

Chocolatey installs successfully when building the Windows images

Actual behavior

Chocolatey fails to install when building the Windows images with the following message: Signature thumbprint do not match expected.

Repro steps

Attempting to build Windows 2022 image will error out when attempting to install chocolatey.

[kishorekumar-anchala]

Hi @JWHolding ,

Please provide us with repro steps for further investigation. It would be great if you could provide us with error logs.

[ymerej]

I get the same error.

"stderr_lines": ["Signature thumbprint do not match expected.", "At C:\\Program Files\\WindowsPowerShell\\Modules\\ImageHelpers\\InstallHelpers.ps1:972 char:9", "+
         throw \"Signature thumbprint do not match expected.\"", "+
         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~", "    + CategoryInfo          : OperationStopped: (Signature thumb...match expected.:String) [], RuntimeException", "    + FullyQualifiedErrorId : Signature thumbprint do not match expected.", " "]

The signature is on line 16 of Install-Chocolatey.ps1.

I don't know if this is relevant, but on the Chocolatey security page it mentions the signature and that it is not valid after May 1st.

[kishorekumar-anchala]

Hi @ymerej ,

we are unable to re-produce the error, we are requesting you , fork the latest main branch into your local and retry and kindly check the thumbprint value in the logs and script both are match ?

[JWHolding]

Hi @kishorekumar-anchala, the fix / PR that I mentioned has been merged into main, and I believe an new release was created for Server 2019 which consumes the fix. But the issue also affected Server 2022 but no new release was created for it, and we depend on the release tags for version pining.

[kishorekumar-anchala]

Hi @JWHolding ,

Got it , But the file (Install-Chocolatey.ps1) is common for both win19 and win22 images, the mentioned PR / change applicable to both versions and the change is available with main branch . could you please try to re run the pipeline from main branch once you fork the latest main branch into your repo.

[Alexey-Ayupov]

Hello @JWHolding, it is better to build images from the main branch only, please read the faq section https://github.com/actions/runner-images?tab=readme-ov-file#faqs.

If you have any other questions feel free to reach us.

[ymerej]

Hi @ymerej ,

we are unable to re-produce the error, we are requesting you , fork the latest main branch into your local and retry and kindly check the thumbprint value in the logs and script both are match ?

Using the main branch fixed my issue. Thank you for the suggestions everyone!