Release pipeline: `mono` executable error when mirroring NuGet packages

[mthalman]

This error is showing up in the Publish packages task:

##[error]Error: Unable to locate executable file: 'mono'. Please verify either the file path exists or the file can be found within a directory specified by the PATH environment variable. Also check the file mode to verify the file is executable.

Build link (internal)

Presumably, this is because of the change in the agent type which doesn't include the required mono executable.

Additionally, I don't think this task should be configured to continue on error. If it fails, we want the pipeline to have an error.

I couldn't figure out the best area label to add to this issue. If you have write-permissions please help me learn by adding exactly one area label.

[mthalman]

Just installing mono isn't enough. It requires other packages as well. Otherwise, leads to this error:

System.IO.FileNotFoundException: Could not load file or assembly 'System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' or one of its dependencies.
File name: 'System.ComponentModel.Composition, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'
  at NuGet.CommandLine.Program.MainCore (System.String workingDirectory, System.String[] args) [0x000e3] in <dc1b484fc03b4c9e94db6d2032a7a13d>:0 

[mthalman]

I've tried a few things to try to fix this.

First, installing .NET SDK doesn't help. It still complains that it's unable to find mono.

I then was able to get nuget/mono installed with the following:

- script: sudo apt update && DEBIAN_FRONTEND=noninteractive sudo apt install -y apt-transport-https mono-complete nuget
  displayName: Install NuGet

But that resulted in the following error:

Unable to load the service index for source https://pkgs.dev.azure.com/dotnet-security-partners/dotnet/_packaging/dotnet/nuget/v3/index.json.
  Response status code does not indicate success: 401 (Unauthorized).

Build link (internal only)

So I'm not sure if that's related to the configuration of the agent or if this is an actual issue with the access token. @premun - Can you verify secret used by the service connection is up-to-date?

[premun]

@mthalman have you also tried to call the NuGet authenticate step? I believe that one gives the build access to feeds in the same AzDO organization.

https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/nuget-authenticate-v1?view=azure-pipelines

[mthalman]

@mthalman have you also tried to call the NuGet authenticate step? I believe that one gives the build access to feeds in the same AzDO organization.

I tried that but it didn't help.

[mthalman]

According to the service connection description, it uses the dn-bot-all-orgs-artifact-feeds-rw secret. @premun - Can you confirm this is not expired?

[premun]

Will do. Btw @mthalman we've talked with Tomas that we might give Ali the task of onboarding source-build onto secret manager. Might be worth since this is a second time there's a token problem.

[premun]

Ah, so the token is not expired but was rotated without support for the dotnet-security-partners organization. Same as the last time we saw this issue (not sure it was the same token?).