.NET Installer claims .NET download is hosted on an unexpected domain

[curiousblueprints]

Describe the bug.

.NET Install tool 2.2.6.

Used the ".NET Install Tool: Install the .NET SDK system-wide" command to attempt to install .NET SDK 9.0.102. This resulted in the following error:

Error : (DotnetCommandFailed)
Failed to download .NET 9.0.102-global~arm64:
The url: https://builds.dotnet.microsoft.com/dotnet/Sdk/9.0.102/dotnet-sdk-9.0.102-osx-arm64.pkg is hosted on an unexpected domain.
We cannot verify that .NET downloads are hosted in a secure location, so we have rejected .NET. The url should be download.visualstudio.microsoft.com.
Please report this issue so it can be remedied or investigated.

--

Solution from @nagilson

This is fixed in version 2.2.8 but for people who have the older versions, they will experience this error again starting next week. I'm going to pin this issue for now.

TLDR: Please update your extension version to 2.2.8.

This should happen automatically for most people.

(Go to the extensions tab -> click .NET Install Tool -> Click the settings gear -> Update or Enable auto update) -- the picture shows auto update because mine is already updated.

--

Please attach log file(s) here if you have any.

DotNetAcquisition-ms-dotnettools.vscode-dotnet-runtime-1738811870782.txt

Extension Version: 1.0.0

Reproduction Steps

1. press CMD-SHIFT-P.
2. Select the command, ".NET Install Tool: Install the .NET SDK system-wide"
3. Enter 9.0.102 as the version and hit enter
4. Observe the error after 10 minutes

Expected Behavior

.NET installs successfully from that domain OR domain is changed so it downloads from an expected domain.

Exceptions & Errors (if any)

No response

.NET Install Tool Version

2.2.6

Your operating system? Please provide more detail, such as the version and or distro above.

OSX / Darwin / Mac

VS Code Version

1.96.1

[richlander]

Thanks for reporting. We're in the process of migrating to a new domain. It is expected/secure. Does that work?

It was my hope that some users would notice this difference and report it.

DevKit acquires the releases-index.json file from this same domain, so you are already using it: https://builds.dotnet.microsoft.com/dotnet/release-metadata/releases-index.json.

Context:

• Update dotnetcli domain #2089
• Use builds.dotnet.microsoft.com not download.visualstudio.microsoft.com core#9675
• Switch links to use new domain core#9706
• Critical: .NET install domains and URLs are changing core#9671

[willxj36]

I also hit this issue on Windows 10 Home v22H2, for me just hitting the install button again started the installation normally.

[richlander]

Do you think it was a timeout?

We cannot verify that .NET downloads are hosted in a secure location, so we have rejected .NET. The url should be download.visualstudio.microsoft.com.

Did you write that or that is an error message you saw?

[curiousblueprints]

I copy-pasted the error message. I did get a timeout on another run, but this was copied straight from my terminal:

Error : (DotnetCommandFailed)
Failed to download .NET 9.0.102-global~arm64:
The url: https://builds.dotnet.microsoft.com/dotnet/Sdk/9.0.102/dotnet-sdk-9.0.102-osx-arm64.pkg is hosted on an unexpected domain.
We cannot verify that .NET downloads are hosted in a secure location, so we have rejected .NET. The url should be download.visualstudio.microsoft.com.
Please report this issue so it can be remedied or investigated.

[curiousblueprints]

I also hit this issue on Windows 10 Home v22H2, for me just hitting the install button again started the installation normally.

I was able to successfully install at a later time by re-running, but did get this multiple times when attempted.

[richlander]

Got it. Looks like we need to make a code change @nagilson. I wonder why this error hasn't come
up in our testing. We likely want to take a closer look at that.

Great report @curiousblueprints!

vscode-dotnet-runtime/vscode-dotnet-runtime-library/src/Acquisition/GlobalInstallerResolver.ts

Lines 250 to 255 in 674f368

	if(!(installerUrl as string).startsWith('https://download.visualstudio.microsoft.com/'))
	{
	const releaseJsonErr = new DotnetInvalidReleasesJSONError(new EventBasedError('DotnetInvalidReleasesJSONError',
	`The url: ${installerUrl} is hosted on an unexpected domain.
	We cannot verify that .NET downloads are hosted in a secure location, so we have rejected .NET. The url should be download.visualstudio.microsoft.com.
	Please report this issue so it can be remedied or investigated.`), getInstallFromContext(this.context));

[richlander]

@nagilson -- this is due to dotnet/core#9706.

Revert: dotnet/core#9725

We'll need to address this in the next update (2.2.8).

[richlander]

This should be resolved. The releases.json file has been updated.

https://builds.dotnet.microsoft.com/dotnet/release-metadata/9.0/releases.json

[nagilson]

Thank you @richlander for handling this while I was OOF. Working on the fix now.

[richlander]

FYI: I was wrong. The file wasn't updated. It was updated this morning but the file is still cached on the CDN. I'm hoping that the old copy ages out later today.

[nagilson]

This is fixed in version 2.2.8 but for people who have the older versions, they will experience this error again starting next week. I'm going to pin this issue for now.

TLDR: Please update your extension version to 2.2.8.

This should happen automatically for most people.

(Go to the extensions tab -> click .NET Install Tool -> Click the settings gear -> Update or Enable auto update) -- the picture shows auto update because mine is already updated.