buildDotnetModule.fetch-deps doesn't respect NuGet.Config

Help
1

Good Afternoon, I have been stuck for weeks on my journey of trying to introduce nix to our enterprise. They are a big dotnet shop and as the first part of that I’m trying to get a single POC of building a dotnet application with nix, but even after solving for garbage corporate SSL issues I cannot seem to get the fetch-deps from the buildDotnetModule to pickup my gh token&username to use the nuget feed from github.

OS: Mac Arm64
Nix: Determinate

Things I have tried:
appending gh credentials to ~.netrc, created a custom netrc and added it to the /etc/determinate/config.json.authentication.additionalSources: [ “/etc/determinate/netrc.custom” ]
setting the token as an env var
various env vars with netrc.
Credentials are stored in ./NuGet.Config and work with local dotnet restore and appear to also allow a restore within nix, just will not fetch and append the dependencies to deps.json

I’m actually at the point of completely stumped and wondering if I just need to drop it as I’ve already spent a lot of time on this.

Flake:

{
    description = "Base Template";

    inputs = {
        nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
    };

    outputs = inputs@{self, nixpkgs}:
        let
            supportedSystems = ["x86_64-linux" "aarch64-linux" "aarch64-darwin"];
            forSystem = nixpkgs.lib.genAttrs supportedSystems;
            sysPkgs = forSystem (system: import nixpkgs {inherit system;});
        in {
            packages = forSystem (system:
                let
                    pkgs = sysPkgs.${system};

                    mkDotnet = {name, projectPath, version}: pkgs.buildDotnetModule {
                        pname = name;
                        version = version;
                        src = ./.;
                        projectFile = projectPath;
                        nugetDeps = ./deps.json;
                        dotnet-sdk = pkgs.dotnetCorePackages.sdk_9_0;
                        dotnet-runtime = pkgs.dotnetCorePackages.runtime_9_0;
                        dotnetFlags = [ "--configfile ./NuGet.Config" ];
                    };

                    mkDocker = app: pkgs.dockerTools.buildImage {
                        name = app.pname;
                        tag = "latest";
                        copyToRoot = [ app pkgs.cacert ];
                        config.Cmd = [ "${app}/bin/${app.pname}" ];
                    };


                    api_client = mkDotnet {
                        name = "client";
                        projectPath = "apie/client/path/points/to/csproj";
                        version = "1.0.0";
                    };

                in {
                    inherit api_client;
                    app2-contianer = mkDocker api_client;
                }
            );
        };
}

Command to build, run, and followed by result:

❯ nix build path:.#api_client.fetch-deps
warning: Using 'builtins.derivation' to create a derivation named 'client-1.0.0-fetch-deps' that references the store path '/nix/store/yx6lgfmwznp47lrxfrkhwkjg7ih78vy2-source' without a proper context. The resulting derivation will not have a correct store reference, so this is unreliable and may stop working in the future.
❯ ./result deps.json
fetching dependencies for client-1.0.0
warning: unknown setting 'eval-cores'
warning: unknown setting 'lazy-trees'
Running phase: unpackPhase
unpacking source archive /nix/store/6rm8db3f4yl5kay4lx2vks6xq9ag8j3v-yx6lgfmwznp47lrxfrkhwkjg7ih78vy2-source
source root is yx6lgfmwznp47lrxfrkhwkjg7ih78vy2-source
Running phase: patchPhase
Running phase: configureNuget

Running phase: updateAutotoolsGnuConfigScriptsPhase
Running phase: configurePhase
Executing dotnetConfigureHook
  Determining projects to restore...
  Restored /private/var/folders/4f/0cvv50hn5sq937wchfqvc5mh0000gp/T/fetch-deps-client-1.0.0.XXXXXX.BboG0ch8BJ/yx6lgfmwznp47lrxfrkhwkjg7ih78vy2-source/src/Api/XXX.YYY.ZZZZZ.MAINNAME.Dto/XXX.YYY.ZZZZZ.MAINNAME.Dto.csproj (in 3.71 sec).
  Restored /private/var/folders/4f/0cvv50hn5sq937wchfqvc5mh0000gp/T/fetch-deps-client-1.0.0.XXXXXX.BboG0ch8BJ/yx6lgfmwznp47lrxfrkhwkjg7ih78vy2-source/src/Api/XXX.YYY.ZZZZZ.MAINNAME.Api.Client/XXX.YYY.ZZZZZ.MAINNAME.Api.Client.csproj (in 3.71 sec).
  Determining projects to restore...
  Restored /private/var/folders/4f/0cvv50hn5sq937wchfqvc5mh0000gp/T/fetch-deps-client-1.0.0.XXXXXX.BboG0ch8BJ/yx6lgfmwznp47lrxfrkhwkjg7ih78vy2-source/src/Api/XXX.YYY.ZZZZZ.MAINNAME.Api.Client/XXX.YYY.ZZZZZ.MAINNAME.Api.Client.csproj (in 228 ms).
  Restored /private/var/folders/4f/0cvv50hn5sq937wchfqvc5mh0000gp/T/fetch-deps-client-1.0.0.XXXXXX.BboG0ch8BJ/yx6lgfmwznp47lrxfrkhwkjg7ih78vy2-source/src/Api/XXX.YYY.ZZZZZ.MAINNAME.Dto/XXX.YYY.ZZZZZ.MAINNAME.Dto.csproj (in 228 ms).
  Determining projects to restore...
  Restored /private/var/folders/4f/0cvv50hn5sq937wchfqvc5mh0000gp/T/fetch-deps-client-1.0.0.XXXXXX.BboG0ch8BJ/yx6lgfmwznp47lrxfrkhwkjg7ih78vy2-source/src/Api/XXX.YYY.ZZZZZ.MAINNAME.Dto/XXX.YYY.ZZZZZ.MAINNAME.Dto.csproj (in 176 ms).
  Restored /private/var/folders/4f/0cvv50hn5sq937wchfqvc5mh0000gp/T/fetch-deps-client-1.0.0.XXXXXX.BboG0ch8BJ/yx6lgfmwznp47lrxfrkhwkjg7ih78vy2-source/src/Api/XXX.YYY.ZZZZZ.MAINNAME.Api.Client/XXX.YYY.ZZZZZ.MAINNAME.Api.Client.csproj (in 176 ms).
  Determining projects to restore...
  Restored /private/var/folders/4f/0cvv50hn5sq937wchfqvc5mh0000gp/T/fetch-deps-client-1.0.0.XXXXXX.BboG0ch8BJ/yx6lgfmwznp47lrxfrkhwkjg7ih78vy2-source/src/Api/XXX.YYY.ZZZZZ.MAINNAME.Api.Client/XXX.YYY.ZZZZZ.MAINNAME.Api.Client.csproj (in 203 ms).
  Restored /private/var/folders/4f/0cvv50hn5sq937wchfqvc5mh0000gp/T/fetch-deps-client-1.0.0.XXXXXX.BboG0ch8BJ/yx6lgfmwznp47lrxfrkhwkjg7ih78vy2-source/src/Api/XXX.YYY.ZZZZZ.MAINNAME.Dto/XXX.YYY.ZZZZZ.MAINNAME.Dto.csproj (in 203 ms).
Finished dotnetConfigureHook
curl: (22) The requested URL returned error: 401

I cannot solve for the

curl: (22) The requested URL returned error: 401
2

It seems to me (as a none bash script master ninja) that there is no way for passin in any credentials in fetchdeps and it creates a fake home dir in a temp folder:

3

Hi, we’ve worked around this by modifying nuget-to-json to parse credentials from nuget.config and inject them directly into the url fields in deps.json. This allows authenticated feeds to work with fetch-deps, but it’s not an ideal solution. Our approach also relies heavily on GitLab internal APIs (our NuGet feed provider), so it’s unfortunately not generally applicable — and not really in a state suitable for a PR, sadly.