microsoft / microsoft/fluentui-blazor
Preview NuGet packages produce NU3018, NU3027, and NU3042 signature warnings
@dvoituron is already working on this.
Since Sep 12, 2026.
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 483
- Avg merge
- 14h 41m
- Merged PRs (30d)
- 68
Description
Description
Preview builds of Microsoft.FluentUI.AspNetCore.Components are signed with a certificate/signature that produces NuGet signature validation warnings during restore. This makes preview packages difficult to consume in repositories that treat warnings as errors.
This was observed with Microsoft.FluentUI.AspNetCore.Components version 5.0.0-preview.26251.2 from the dotnet9 feed using .NET SDK 10.0.400. Other preview Microsoft.FluentUI.* packages produced by the same build/signing process are likely affected as well, so it would be useful to verify and correct the full preview package set rather than only this specific package.
On Windows, restore reports:
NU3018: The author primary signature's signing certificate is not trusted by the trust provider.
NU3027: The signature should be timestamped to enable long-term signature validity after the certificate has expired.
Linux restore can additionally report:
NU3042: The package signature certificate chain uses an untrusted root certificate.
For projects that treat NuGet warnings as errors, restore fails. Suppressing the warnings only for an affected package requires a direct PackageReference with NoWarn="NU3018;NU3027;NU3042" at each restore entry point because package-specific metadata does not flow through project references. This adds otherwise unnecessary package references and temporary suppression configuration throughout a repository.
Expected behavior
All preview Microsoft.FluentUI.* packages should restore without package-signature warnings. It would be helpful if preview packages used the same signing key and timestamping/signing process as RC and release packages.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.