执行dotnet restore时GitLab私有包仓库出现502错误求助

问题 #

执行dotnet restore时遭遇大量502（Bad Gateway）错误，程序尝试从GitLab私有包仓库获取System.ObjectModel、MessagePack这类公共依赖，导致依赖恢复失败。

错误日志片段 #

Retrying 'FindPackagesByIdAsync' for source 'https://git.somedomain.com/api/v4/projects/22/packages/nuget/download/system.objectmodel/index.json'.
  Response status code does not indicate success: 502 (Bad Gateway).
  Retrying 'FindPackagesByIdAsync' for source 'https://git.somedomain.com/api/v4/projects/22/packages/nuget/download/messagepackanalyzer/index.json'.
  Response status code does not indicate success: 502 (Bad Gateway).
  Retrying 'FindPackagesByIdAsync' for source 'https://git.somedomain.com/api/v4/projects/22/packages/nuget/download/microsoft.win32.systemevents/index.json'.
  Response status code does not indicate success: 502 (Bad Gateway).
  Retrying 'FindPackagesByIdAsync' for source 'https://git.somedomain.com/api/v4/projects/22/packages/nuget/download/runtime.debian.8-x64.runtime.native.system.security.cryptography.openssl/index.json'.
  Response status code does not indicate success: 502 (Bad Gateway).
  Retrying 'FindPackagesByIdAsync' for source 'https://git.somedomain.com/api/v4/projects/22/packages/nuget/download/messagepack/index.json'.
  Response status code does not indicate success: 502 (Bad Gateway).
  Retrying 'FindPackagesByIdAsync' for source 'https://git.somedomain.com/api/v4/projects/22/packages/nuget/download/system.io.pipes/index.json'.
  Response status code does not indicate success: 502 (Bad Gateway).
/builds/rvn/reports/ServerFace/ServerFace/ServerFace.csproj : error NU1301: Failed to retrieve information about 'runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl' from remote source 'https://git.somedomain.com/api/v4/projects/22/packages/nuget/download/runtime.fedora.23-x64.runtime.native.system.security.cryptography.openssl/index.json'. [/builds/rvn/reports/ServerFace/ServerFace.sln]
  Retrying 'FindPackagesByIdAsync' for source 'https://git.somedomain.com/api/v4/projects/22/packages/nuget/download/system.security.principal.windows/index.json'.
  Response status code does not indicate success: 502 (Bad Gateway).
/builds/rvn/reports/ServerFace/ServerFace/ServerFace.csproj : error NU1301: Failed to retrieve information about 'runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl' from remote source 'https://git.somedomain.com/api/v4/projects/22/packages/nuget/download/runtime.fedora.23-x64.runtime.native.system.security.cryptography.openssl/index.json'. [/builds/rvn/reports/ServerFace/ServerFace.sln]
/builds/rvn/reports/ServerFace/ServerFace/ServerFace.csproj : error NU1301: Failed to retrieve information about 'runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl' from remote source 'https://git.somedomain.com/api/v4/projects/22/packages/nuget/download/runtime.fedora.23-x64.runtime.native.system.security.cryptography.openssl/index.json'. [/builds/rvn/reports/ServerFace/ServerFace.sln]
/builds/rvn/reports/ServerFace/ServerFace/ServerFace.csproj : error NU1301: Failed to retrieve information about 'runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl' from remote source 'https://git.somedomain.com/api/v4/projects/22/packages/nuget/download/runtime.fedora.23-x64.runtime.native.system.security.cryptography.openssl/index.json'. [/builds/rvn/reports/ServerFace/ServerFace.sln]

当前NuGet配置（nuget.config） #

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="NuGets Feed" value="https://nexus.somedomain.com/nexus/service/local/nuget/dotnet-packages/" />
    <add key="GitLab" value="https://git.somedomain.com/api/v4/projects/22/packages/nuget/index.json" />
  </packageSources>
  <packageSourceCredentials>
      <GitLab>
          <add key="Username" value="%GITLAB_PACKAGE_REGISTRY_USERNAME%" />
          <add key="ClearTextPassword" value="%GITLAB_PACKAGE_REGISTRY_PASSWORD%" />
      </GitLab>
  </packageSourceCredentials>
  <activePackageSource>
    <!-- this tells that all of them are active -->
    <add key="All" value="(Aggregate source)" />
  </activePackageSource>
</configuration>

解决方案 #

核心问题是NuGet会向所有配置源请求包，而GitLab私有仓库没有公共依赖且返回502错误。解决思路是让NuGet仅向GitLab请求私有包，公共依赖走nuget.org或Nexus。

1. 配置包源映射（推荐） #

修改nuget.config，添加packageSourceMapping规则，指定不同包源的匹配范围：

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <clear />
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="NuGets Feed" value="https://nexus.somedomain.com/nexus/service/local/nuget/dotnet-packages/" />
    <add key="GitLab" value="https://git.somedomain.com/api/v4/projects/22/packages/nuget/index.json" />
  </packageSources>
  <packageSourceCredentials>
      <GitLab>
          <add key="Username" value="%GITLAB_PACKAGE_REGISTRY_USERNAME%" />
          <add key="ClearTextPassword" value="%GITLAB_PACKAGE_REGISTRY_PASSWORD%" />
      </GitLab>
  </packageSourceCredentials>
  <!-- 新增包源映射规则 -->
  <packageSourceMapping>
    <packageSource key="nuget.org">
      <package pattern="*" /> <!-- 所有公共包优先走nuget.org -->
    </packageSource>
    <packageSource key="NuGets Feed">
      <package pattern="YourNexusPackages.*" /> <!-- 替换为你的Nexus私有包前缀 -->
    </packageSource>
    <packageSource key="GitLab">
      <package pattern="YourPrivatePackages.*" /> <!-- 替换为你的GitLab私有包前缀，比如公司内部包命名空间 -->
    </packageSource>
  </packageSourceMapping>
</configuration>

• 确保nuget.org的*匹配放在最前面，避免公共包误请求GitLab；
• 私有包用具体前缀匹配，精准控制请求源。

2. 调整包源顺序（临时方案） #

如果不想用映射，可调整包源顺序，让公共源优先级高于GitLab：

<packageSources>
  <clear />
  <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
  <add key="NuGets Feed" value="https://nexus.somedomain.com/nexus/service/local/nuget/dotnet-packages/" />
  <add key="GitLab" value="https://git.somedomain.com/api/v4/projects/22/packages/nuget/index.json" />
</packageSources>

注意：NuGet可能并行请求所有源，此方案可靠性不如包源映射。

3. 关闭GitLab包转发 #

若GitLab开启了公共包转发功能，可能是转发故障导致502：

• 登录GitLab项目，进入设置 > 包仓库；
• 关闭转发请求到公共包注册表选项；
• 确保GitLab仅存储私有包，公共依赖直接从nuget.org获取。

4. 临时指定源恢复 #

执行命令时直接指定可信源，跳过GitLab或明确包含所需源：

# 仅从nuget.org和Nexus恢复公共依赖
dotnet restore --source https://api.nuget.org/v3/index.json --source https://nexus.somedomain.com/nexus/service/local/nuget/dotnet-packages/

# 用配置文件完整恢复（含私有包）
dotnet restore --configfile ./nuget.config

内容的提问来源于stack exchange，提问作者Roman R.