dotnet Aspire SDK, lock and private feed combination causes 401 responses

[RahulGautamSingh]

Discussed in #43807

^{Originally posted by herbatnik June 4, 2026}

Minimal reproduction: Test.Aspire.AppHost.zip

Summary

SDK resolution for <Project Sdk="Aspire.AppHost.Sdk/…"> ignores the --configfile Renovate passes to dotnet restore, so the credentials Renovate injects never reach it. It instead uses the repo's own nuget.config (uncredentialed) + PackageSourceMapping, falls back to the Azure credential provider with no creds, and gets 401.

Fix

Setting VSS_NUGET_EXTERNAL_FEED_ENDPOINTS in artifacts.ts's extraEnv

## User Explanation

When using an aspire project that has Aspire SDK in csproj:

<Project Sdk="Aspire.AppHost.Sdk/13.4.2">

with combination of private azure feed (that has nuget.org configured as an upstream) AND package source map that directs all packages at private feed

with combination of use of packages.lock.json file

I get the following logs in the self-hosted renovate runs:

2026-06-04T14:21:03.6327843Z DEBUG: rawExec err (repository=PROJECT/repo-name, branch=feature/renovate/major-refit-monorepo)
2026-06-04T14:21:03.6328200Z        "err": {
2026-06-04T14:21:03.6328568Z          "cmd": "dotnet restore Test.Aspire.AppHost/Test.Aspire.AppHost.csproj --force-evaluate --configfile /rnvt/cache/__renovate-private-cache/nuget/nuget.config",
2026-06-04T14:21:03.6329249Z          "stderr": "",
2026-06-04T14:21:03.6333410Z          "stdout": "Retrying 'FindPackagesByIdAsync' for source 'https://pkgs.dev.azure.com/ORGANIZATION/00000000-0000-0000-0000-000000000001/_packaging/00000000-0000-0000-0000-000000000002/nuget/v3/flat2/aspire.apphost.sdk/index.json'.\nResponse status code does not indicate success: 401 (Unauthorized).\nRetrying 'FindPackagesByIdAsync' for source 'https://pkgs.dev.azure.com/ORGANIZATION/00000000-0000-0000-0000-000000000001/_packaging/00000000-0000-0000-0000-000000000002/nuget/v3/flat2/aspire.apphost.sdk/index.json'.\nResponse status code does not indicate success: 401 (Unauthorized).\nRetrying 'FindPackagesByIdAsync' for source 'https://pkgs.dev.azure.com/ORGANIZATION/00000000-0000-0000-0000-000000000001/_packaging/00000000-0000-0000-0000-000000000002/nuget/v3/flat2/aspire.apphost.sdk/index.json'.\nResponse status code does not indicate success: 401 (Unauthorized).\nRetrying 'FindPackagesByIdAsync' for source 'https://pkgs.dev.azure.com/ORGANIZATION/00000000-0000-0000-0000-000000000001/_packaging/00000000-0000-0000-0000-000000000002/nuget/v3/flat2/aspire.apphost.sdk/index.json'.\nResponse status code does not indicate success: 401 (Unauthorized).\nRetrying 'FindPackagesByIdAsync' for source 'https://pkgs.dev.azure.com/ORGANIZATION/00000000-0000-0000-0000-000000000001/_packaging/00000000-0000-0000-0000-000000000002/nuget/v3/flat2/aspire.apphost.sdk/index.json'.\nResponse status code does not indicate success: 401 (Unauthorized).\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : error : Could not resolve SDK \"Aspire.AppHost.Sdk\". Exactly one of the probing messages below indicates why we could not resolve the SDK. Investigate and resolve that message to correctly specify the SDK.\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : error :   SDK resolver \"Microsoft.DotNet.MSBuildWorkloadSdkResolver\" returned null.\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : error :   Unable to find package Aspire.AppHost.Sdk. No packages exist with this id in source(s): iServer365. PackageSourceMapping is enabled, the following source(s) were not considered: nuget.org.\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : warning :     [CredentialProvider]Warning: Cannot persist Microsoft authentication token cache securely!\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : warning :     [CredentialProvider]Warning: Using plain-text fallback token cache\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : warning : The plugin credential provider could not acquire credentials. Authentication may require manual action. Consider re-running the command with --interactive for `dotnet`, /p:NuGetInteractive=\"true\" for MSBuild or removing the -NonInteractive switch for `NuGet`\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : warning : The plugin credential provider could not acquire credentials. Authentication may require manual action. Consider re-running the command with --interactive for `dotnet`, /p:NuGetInteractive=\"true\" for MSBuild or removing the -NonInteractive switch for `NuGet`\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : warning : The plugin credential provider could not acquire credentials. Authentication may require manual action. Consider re-running the command with --interactive for `dotnet`, /p:NuGetInteractive=\"true\" for MSBuild or removing the -NonInteractive switch for `NuGet`\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : warning : The plugin credential provider could not acquire credentials. Authentication may require manual action. Consider re-running the command with --interactive for `dotnet`, /p:NuGetInteractive=\"true\" for MSBuild or removing the -NonInteractive switch for `NuGet`\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : warning : Failed to retrieve information about 'Aspire.AppHost.Sdk' from remote source 'https://pkgs.dev.azure.com/ORGANIZATION/00000000-0000-0000-0000-000000000001/_packaging/00000000-0000-0000-0000-000000000002/nuget/v3/flat2/aspire.apphost.sdk/index.json'.\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : warning : Failed to retrieve information about 'Aspire.AppHost.Sdk' from remote source 'https://pkgs.dev.azure.com/ORGANIZATION/00000000-0000-0000-0000-000000000001/_packaging/00000000-0000-0000-0000-000000000002/nuget/v3/flat2/aspire.apphost.sdk/index.json'.\n/tmp/renovate/repos/azure/PROJECT/repo-name/Test.Aspire.AppHost/Test.Aspire.AppHost.csproj : error MSB4236: The SDK 'Aspire.AppHost.Sdk/13.2.4' specified could not be found.\n",
2026-06-04T14:21:03.6338248Z          "options": {
2026-06-04T14:21:03.6338481Z            "cwd": "/tmp/renovate/repos/azure/PROJECT/repo-name",
2026-06-04T14:21:03.6338702Z            "env": [
2026-06-04T14:21:03.6338890Z              "NUGET_PACKAGES",
2026-06-04T14:21:03.6339096Z              "MSBUILDDISABLENODEREUSE",
2026-06-04T14:21:03.6339298Z              "HOME",
2026-06-04T14:21:03.6339477Z              "PATH",
2026-06-04T14:21:03.6339655Z              "LC_ALL",
2026-06-04T14:21:03.6339850Z              "LANG",
2026-06-04T14:21:03.6340040Z              "CONTAINERBASE_CACHE_DIR"
2026-06-04T14:21:03.6340224Z            ],
2026-06-04T14:21:03.6340402Z            "maxBuffer": 10485760,
2026-06-04T14:21:03.6340591Z            "timeout": 900000,
2026-06-04T14:21:03.6340790Z            "stdin": "pipe",
2026-06-04T14:21:03.6340971Z            "stdout": "pipe",
2026-06-04T14:21:03.6341161Z            "stderr": "pipe"
2026-06-04T14:21:03.6341344Z          },
2026-06-04T14:21:03.6341524Z          "exitCode": 1,
2026-06-04T14:21:03.6341707Z          "name": "ExecError",
2026-06-04T14:21:03.6342044Z          "message": "Command failed: dotnet restore Test.Aspire.AppHost/Test.Aspire.AppHost.csproj --force-evaluate --configfile /rnvt/cache/__renovate-private-cache/nuget/nuget.config\n"
2026-06-04T14:21:03.6342355Z        },
2026-06-04T14:21:03.6342532Z        "durationMs": 7580
2026-06-04T14:21:03.6342853Z        ExecError: Command failed: dotnet restore Test.Aspire.AppHost/Test.Aspire.AppHost.csproj --force-evaluate --configfile /rnvt/cache/__renovate-private-cache/nuget/nuget.config
2026-06-04T14:21:03.6343180Z        
2026-06-04T14:21:03.6343411Z            at ChildProcess.<anonymous> (file:///usr/local/renovate/lib/util/exec/common.ts:169:13)
2026-06-04T14:21:03.6343786Z            at ChildProcess.emit (node:events:521:24)
2026-06-04T14:21:03.6344025Z            at ChildProcess.emit (node:domain:489:12)
2026-06-04T14:21:03.6344302Z            at Process.ChildProcess._handle.onexit (node:internal/child_process:295:12)