microsoft / microsoft/fluentui-blazor

Preview NuGet packages produce NU3018, NU3027, and NU3042 signature warnings

Open
#5,252 3 comments 0 reactions 1 assignee View on GitHub

@dvoituron is already working on this.

Since Sep 12, 2026.

status:needs-investigation v5
Dominant language
C#
Stars
4.8k
Forks
483
Avg merge
14h 41m
Merged PRs (30d)
68

Description

Description

Preview builds of Microsoft.FluentUI.AspNetCore.Components are signed with a certificate/signature that produces NuGet signature validation warnings during restore. This makes preview packages difficult to consume in repositories that treat warnings as errors.

This was observed with Microsoft.FluentUI.AspNetCore.Components version 5.0.0-preview.26251.2 from the dotnet9 feed using .NET SDK 10.0.400. Other preview Microsoft.FluentUI.* packages produced by the same build/signing process are likely affected as well, so it would be useful to verify and correct the full preview package set rather than only this specific package.

On Windows, restore reports:

NU3018: The author primary signature's signing certificate is not trusted by the trust provider.
NU3027: The signature should be timestamped to enable long-term signature validity after the certificate has expired.

Linux restore can additionally report:

NU3042: The package signature certificate chain uses an untrusted root certificate.

For projects that treat NuGet warnings as errors, restore fails. Suppressing the warnings only for an affected package requires a direct PackageReference with NoWarn="NU3018;NU3027;NU3042" at each restore entry point because package-specific metadata does not flow through project references. This adds otherwise unnecessary package references and temporary suppression configuration throughout a repository.

Expected behavior

All preview Microsoft.FluentUI.* packages should restore without package-signature warnings. It would be helpful if preview packages used the same signing key and timestamping/signing process as RC and release packages.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.