Skip to content

C#: Rollback NuGet CLI proxy usage. #22888

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
michaelnebel merged 3 commits into from
Oct 27, 2026
Merged

C#: Rollback NuGet CLI proxy usage. #22888

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c992610
C#: Do not set the private registry proxy environment variables when …
michaelnebel Oct 26, 2026
e867ab0
C#: Add change note.
michaelnebel Oct 26, 2026
36933ca
Update csharp/ql/lib/change-notes/2026-10-26-nugetcli-proxy-config-ro…
michaelnebel Oct 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@ internal sealed partial class NugetPackageRestorer : IDisposable
private readonly IFileProvider fileProvider;
private readonly FileContent fileContent;
private readonly IDotNet dotnet;
private readonly IRegistryProxy? registryProxy;
private readonly IDiagnosticsWriter diagnosticsWriter;
private readonly DependencyDirectory legacyPackageDirectory;
private readonly DependencyDirectory missingPackageDirectory;
Expand All @@ -41,7 +40,6 @@ public NugetPackageRestorer(
this.fileProvider = fileProvider;
this.fileContent = fileContent;
this.dotnet = dotnet;
this.registryProxy = registryProxy;
this.diagnosticsWriter = diagnosticsWriter;
this.logger = logger;
this.compilationInfoContainer = compilationInfoContainer;
Expand Down Expand Up @@ -135,7 +133,7 @@ public HashSet<AssemblyLookupLocation> Restore()

try
{
var packagesConfigRestore = PackagesConfigRestoreFactory.Create(fileProvider, legacyPackageDirectory, logger, feedManager, registryProxy);
var packagesConfigRestore = PackagesConfigRestoreFactory.Create(fileProvider, legacyPackageDirectory, logger, feedManager);
var count = packagesConfigRestore.InstallPackages();
if (packagesConfigRestore.PackageCount > 0)
{
Expand Down
11 changes: 3 additions & 8 deletions csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/PackagesConfigRestorer.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,11 +33,11 @@ internal interface IPackagesConfigRestore
/// </summary>
internal class PackagesConfigRestoreFactory
{
public static IPackagesConfigRestore Create(IFileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, FeedManager feedManager, IRegistryProxy? registryProxy)
public static IPackagesConfigRestore Create(IFileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, FeedManager feedManager)
{
if (SystemBuildActions.Instance.IsWindows() || SystemBuildActions.Instance.IsMonoInstalled())
{
return new NugetExeWrapper(fileProvider, packageDirectory, logger, feedManager, registryProxy);
return new NugetExeWrapper(fileProvider, packageDirectory, logger, feedManager);
}

return new NoOpPackagesConfig(fileProvider.PackagesConfigs, logger);
Expand All @@ -52,7 +52,6 @@ private class NugetExeWrapper : IPackagesConfigRestore
{
private readonly string? nugetExe;
private readonly Semmle.Util.Logging.ILogger logger;
private readonly IRegistryProxy? registryProxy;

public int PackageCount => fileProvider.PackagesConfigs.Count;

Expand All @@ -71,13 +70,12 @@ private class NugetExeWrapper : IPackagesConfigRestore
/// <summary>
/// Create the package manager for a specified source tree.
/// </summary>
public NugetExeWrapper(IFileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, FeedManager feedManager, IRegistryProxy? registryProxy)
public NugetExeWrapper(IFileProvider fileProvider, DependencyDirectory packageDirectory, Semmle.Util.Logging.ILogger logger, FeedManager feedManager)
{
this.fileProvider = fileProvider;
this.packageDirectory = packageDirectory;
this.logger = logger;
this.feedManager = feedManager;
this.registryProxy = registryProxy;

if (fileProvider.PackagesConfigs.Count > 0)
{
Expand Down Expand Up @@ -211,9 +209,6 @@ private bool TryRestoreNugetPackage(string packagesConfig)
UseShellExecute = false
};

// Configure the proxy settings, if applicable.
registryProxy?.SetProcessEnvironment(pi);

Comment on lines -214 to -216

@mbg mbg Oct 26, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We know that running this with mono doesn't work because mono doesn't respect the environment variable for the certificate. But does it work without mono and would it make sense to keep that case?

@michaelnebel michaelnebel Oct 26, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As far as I can tell SSL_CERT_FILE is not respected by the NuGet CLI on any operating system (not on windows either). The support was introduced with dotnet nuget. I have asked various AIs as well; They claim the same, with the reasoning "It is not supported due to lack of documentation that it should be supported".
Have you found other information?

@mbg mbg Oct 26, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you found other information?

No, I don't know what the situation with NuGet itself is. I just had theunderstanding that it definitely was a problem with mono and that it was the initial blocker, but had no insights into whether it does or doesn't work even without mono in the picture.

var threadId = Environment.CurrentManagedThreadId;
void onOut(string s) => logger.LogDebug(s, threadId);
void onError(string s) => logger.LogError(s, threadId);
Expand Down
4 changes: 4 additions & 0 deletions csharp/ql/lib/change-notes/2026-10-26-nugetcli-proxy-config-rollback.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
category: minorAnalysis
---
* Rolled back the change that set proxy and certificate environment variables for the subprocess that invokes the NuGet CLI because the environment variables were only partially respected by the target process in some cases.
Loading