plucky (1) dotnet-nuget-verify.1.gz
dotnet nuget verify
This article applies to: ✔️ .NET 5.0.100-rc.2.x SDK and later versions
NAME
dotnet-nuget-verify - Verifies a signed NuGet package.
SYNOPSIS
dotnet nuget verify [<package-path(s)>]
[--all]
[--certificate-fingerprint <FINGERPRINT>]
[-v|--verbosity <LEVEL>]
[--configfile <FILE>]
dotnet nuget verify -h|--help
DESCRIPTION
The dotnet nuget verify command verifies a signed NuGet package.
This command requires a certificate root store that is valid for both code signing and
timestamping. Also, this command may not be supported on some combinations of operating system
and .NET SDK. For more information, see NuGet signed package verification.
ARGUMENTS
• package-path(s)
Specifies the file path to the package(s) to be verified. Multiple position arguments can be passed in
to verify multiple packages.
OPTIONS
• --all
Specifies that all verifications possible should be performed on the package(s). By default, only
signatures are verified.
This command currently supports only signature verification.
• --certificate-fingerprint <FINGERPRINT>
Verify that the signer certificate matches with one of the specified SHA256 fingerprints. This option
can be supplied multiple times to provide multiple fingerprints.
• -v|--verbosity <LEVEL>
Sets the verbosity level of the command. Allowed values are q[uiet], m[inimal], n[ormal], d[etailed],
and diag[nostic]. The default is minimal. For more information, see
<xref:Microsoft.Build.Framework.LoggerVerbosity>.
The following table shows what is displayed for each verbosity level.
q[uiet] m[inimal] n[ormal] d[etailed] diag[nostic]
───────────────────────────────────────────────────────────────────────────────
Certificate ❌ ❌ ❌ ✔️ ✔️
chain
Information
Path to package ❌ ❌ ✔️ ✔️ ✔️
being verified
Hashing ❌ ❌ ✔️ ✔️ ✔️
algorithm used
for signature
Author/Repository ❌ ❌ ✔️ ✔️ ✔️
Certificate ->
SHA1 hash
Author/Repository ❌ ❌ ✔️ ✔️ ✔️
Certificate ->
Issued By
Timestamp ❌ ❌ ✔️ ✔️ ✔️
Certificate ->
Issued By
Timestamp ❌ ❌ ✔️ ✔️ ✔️
Certificate ->
SHA-256 hash
Timestamp ❌ ❌ ✔️ ✔️ ✔️
Certificate ->
Validity period
Timestamp ❌ ❌ ✔️ ✔️ ✔️
Certificate ->
SHA1 hash
Timestamp ❌ ❌ ✔️ ✔️ ✔️
Certificate ->
Subject name
Author/Repository ❌ ✔️ ✔️ ✔️ ✔️
Certificate ->
Subject name
Author/Repository ❌ ✔️ ✔️ ✔️ ✔️
Certificate ->
SHA-256 hash
Author/Repository ❌ ✔️ ✔️ ✔️ ✔️
Certificate ->
Validity period
Author/Repository ❌ ✔️ ✔️ ✔️ ✔️
Certificate ->
Service index URL
(If applicable)
Package name ❌ ✔️ ✔️ ✔️ ✔️
being verified
Type of signature ❌ ✔️ ✔️ ✔️ ✔️
(author or
repository)
❌ indicates details that are not displayed. ✔️ indicates details that are displayed.
• --configfile <FILE>
The NuGet configuration file (nuget.config) to use. If specified, only the settings from this file
will be used. If not specified, the hierarchy of configuration files from the current directory will
be used. For more information, see Common NuGet Configurations.
• -?|-h|--help
Prints out a description of how to use the command.
EXAMPLES
• Verify foo.nupkg:
dotnet nuget verify foo.nupkg
• Verify multiple NuGet packages - foo.nupkg and all .nupkg files in the directory specified:
dotnet nuget verify foo.nupkg c:\mydir\*.nupkg
• Verify foo.nupkg signature matches with the specified certificate fingerprint:
dotnet nuget verify foo.nupkg --certificate-fingerprint CE40881FF5F0AD3E58965DA20A9F571EF1651A56933748E1BF1C99E537C4E039
• Verify foo.nupkg signature matches with one of the specified certificate fingerprints:
dotnet nuget verify foo.nupkg --certificate-fingerprint CE40881FF5F0AD3E58965DA20A9F571EF1651A56933748E1BF1C99E537C4E039 --certificate-fingerprint EC10992GG5F0AD3E58965DA20A9F571EF1651A56933748E1BF1C99E537C4E027
• Verify the signature of foo.nupkg by using settings (packagesources and trustedSigners) only from the
specified nuget.config file:
dotnet nuget verify foo.nupkg --configfile ..\Settings\nuget.config
2024-10-02 dotnet-nuget-verify(1)