dotnet nuget verify

       This article applies to: ✔️ .NET 5.0.100-rc.2.x SDK and later versions

NAME

       dotnet nuget verify - Verifies a signed NuGet package.

SYNOPSIS

              dotnet nuget verify [<package-path(s)>]
                  [--all]
                  [--certificate-fingerprint <FINGERPRINT>]
                  [-v|--verbosity <LEVEL>]

              dotnet nuget verify -h|--help

DESCRIPTION

       The dotnet nuget verify command verifies a signed NuGet package.

   Arguments
       • package-path(s)

         Specifies the file path to the package(s) to be verified.  Multiple position arguments can be passed in
         to verify multiple packages.

OPTIONS

       • --all

         Specifies that all verifications possible should be performed on the package(s).  By default, only sig‐
         natures are verified.

         [!NOTE] This command currently supports only signature verification.

       • --certificate-fingerprint <FINGERPRINT>

         Verify  that the signer certificate matches with one of the specified SHA256 fingerprints.  This option
         can be supplied multiple times to provide multiple fingerprints.

       • -v|--verbosity <LEVEL>

         Sets the verbosity level of the command.  Allowed values are q[uiet], m[inimal], n[ormal],  d[etailed],
         and  diag[nostic].   The  default  is  minimal.  For more information, see <xref:Microsoft.Build.Frame‐
         work.LoggerVerbosity>.

         The following table shows what is displayed for each verbosity level.

         ​                  q[uiet]   m[inimal]   n[ormal]   d[etailed]   diag[nostic]
         ──────────────────────────────────────────────────────────────────────────────
         Certificate        ❌        ❌          ❌         ✔️           ✔️
         chain   Informa‐
         tion
         Path  to package   ❌        ❌          ✔️         ✔️           ✔️
         being verified
         Hashing    algo‐   ❌        ❌          ✔️         ✔️           ✔️
         rithm  used  for
         signature
         Author/Reposito‐   ❌        ❌          ✔️         ✔️           ✔️
         ry   Certificate
         -> SHA1 hash
         Author/Reposito‐   ❌        ❌          ✔️         ✔️           ✔️
         ry   Certificate
         -> Issued By
         Timestamp   Cer‐   ❌        ❌          ✔️         ✔️           ✔️
         tificate  -> Is‐
         sued By
         Timestamp   Cer‐   ❌        ❌          ✔️         ✔️           ✔️
         tificate      ->
         SHA-256 hash
         Timestamp   Cer‐   ❌        ❌          ✔️         ✔️           ✔️
         tificate  -> Va‐
         lidity period
         Timestamp   Cer‐   ❌        ❌          ✔️         ✔️           ✔️
         tificate -> SHA1
         hash
         Timestamp   Cer‐   ❌        ❌          ✔️         ✔️           ✔️
         tificate -> Sub‐
         ject name
         Author/Reposito‐   ❌        ✔️          ✔️         ✔️           ✔️
         ry   Certificate
         -> Subject name
         Author/Reposito‐   ❌        ✔️          ✔️         ✔️           ✔️
         ry   Certificate
         -> SHA-256 hash
         Author/Reposito‐   ❌        ✔️          ✔️         ✔️           ✔️
         ry   Certificate
         ->  Validity pe‐
         riod
         Author/Reposito‐   ❌        ✔️          ✔️         ✔️           ✔️
         ry   Certificate
         -> Service index
         URL (If applica‐
         ble)
         Package name be‐   ❌        ✔️          ✔️         ✔️           ✔️
         ing verified
         Type  of  signa‐   ❌        ✔️          ✔️         ✔️           ✔️
         ture (author  or
         repository)

         ❌ indicates details that are not displayed.  ✔️ indicates details that are displayed.

       • -?|-h|--help

         Prints out a description of how to use the command.

EXAMPLES

       • Verify foo.nupkg:

                dotnet nuget verify foo.nupkg

       • Verify multiple NuGet packages - foo.nupkg and all .nupkg files in the directory specified:

                dotnet nuget verify foo.nupkg c:\mydir\*.nupkg

       • Verify foo.nupkg signature matches with the specified certificate fingerprint:

                dotnet nuget verify foo.nupkg --certificate-fingerprint CE40881FF5F0AD3E58965DA20A9F571EF1651A56933748E1BF1C99E537C4E039

       • Verify foo.nupkg signature matches with one of the specified certificate fingerprints:

                dotnet nuget verify foo.nupkg --certificate-fingerprint CE40881FF5F0AD3E58965DA20A9F571EF1651A56933748E1BF1C99E537C4E039 --certificate-fingerprint EC10992GG5F0AD3E58965DA20A9F571EF1651A56933748E1BF1C99E537C4E027

                                                                                                             (1)