dotnet nuget verify

       This article applies to: ✔️ .NET 5.0.100-rc.2.x SDK and later versions

NAME

       dotnet-nuget-verify - Verifies a signed NuGet package.

SYNOPSIS

              dotnet nuget verify [<package-path(s)>]
                  [--all]
                  [--certificate-fingerprint <FINGERPRINT>]
                  [-v|--verbosity <LEVEL>]
                  [--configfile <FILE>]

              dotnet nuget verify -h|--help

DESCRIPTION

       The dotnet nuget verify command verifies a signed NuGet package.  In .NET 10 and later versions, the com‐
       mand  also  outputs the package’s content hash, which might be useful to investigate lock file validation
       errors.

              This command requires a certificate root store that is valid for both code signing and  timestamp‐
              ing.   Also,  this  command may not be supported on some combinations of operating system and .NET
              SDK.  For more information, see NuGet signed package verification.

ARGUMENTS

       • package-path(s)

         Specifies the file path to the package(s) to be verified.  Multiple position arguments can be passed in
         to verify multiple packages.

OPTIONS

       • --all

         Specifies that all verifications possible should be performed on the package(s).  By default, only sig‐
         natures are verified.

         This command currently supports only signature verification.

       • --certificate-fingerprint <FINGERPRINT>

         Verify that the signer certificate matches with one of the specified SHA256 fingerprints.  This  option
         can be supplied multiple times to provide multiple fingerprints.

       • -v|--verbosity <LEVEL>

         Sets  the verbosity level of the command.  Allowed values are q[uiet], m[inimal], n[ormal], d[etailed],
         and diag[nostic].  The default is minimal.   For  more  information,  see  <xref:Microsoft.Build.Frame‐
         work.LoggerVerbosity>.

         The following table shows what is displayed for each verbosity level.

         ​                  q[uiet]   m[inimal]   n[ormal]   d[etailed]   diag[nostic]
         ──────────────────────────────────────────────────────────────────────────────
         Certificate        ❌        ❌          ❌         ✔️           ✔️
         chain   Informa‐
         tion
         Path to  package   ❌        ❌          ✔️         ✔️           ✔️
         being verified
         Hashing    algo‐   ❌        ❌          ✔️         ✔️           ✔️
         rithm  used  for
         signature
         Author/Reposito‐   ❌        ❌          ✔️         ✔️           ✔️
         ry   Certificate
         -> SHA1 hash
         Author/Reposito‐   ❌        ❌          ✔️         ✔️           ✔️
         ry   Certificate
         -> Issued By
         Timestamp   Cer‐   ❌        ❌          ✔️         ✔️           ✔️
         tificate ->  Is‐
         sued By
         Timestamp   Cer‐   ❌        ❌          ✔️         ✔️           ✔️
         tificate      ->
         SHA-256 hash
         Timestamp   Cer‐   ❌        ❌          ✔️         ✔️           ✔️
         tificate ->  Va‐
         lidity period
         Timestamp   Cer‐   ❌        ❌          ✔️         ✔️           ✔️
         tificate -> SHA1
         hash
         Timestamp   Cer‐   ❌        ❌          ✔️         ✔️           ✔️
         tificate -> Sub‐
         ject name
         Author/Reposito‐   ❌        ✔️          ✔️         ✔️           ✔️
         ry   Certificate
         -> Subject name
         Author/Reposito‐   ❌        ✔️          ✔️         ✔️           ✔️
         ry   Certificate
         -> SHA-256 hash
         Author/Reposito‐   ❌        ✔️          ✔️         ✔️           ✔️
         ry   Certificate
         -> Validity  pe‐
         riod
         Author/Reposito‐   ❌        ✔️          ✔️         ✔️           ✔️
         ry   Certificate
         -> Service index
         URL (If applica‐
         ble)
         Package name be‐   ❌        ✔️          ✔️         ✔️           ✔️
         ing verified
         Type  of  signa‐   ❌        ✔️          ✔️         ✔️           ✔️
         ture  (author or
         repository)

         ❌ indicates details that are not displayed.  ✔️ indicates details that are displayed.

       • --configfile <FILE>

         The NuGet configuration file (nuget.config) to use.  If specified, only the  settings  from  this  file
         will  be  used.  If not specified, the hierarchy of configuration files from the current directory will
         be used.  For more information, see Common NuGet Configurations.

       • -?|-h|--help

         Prints out a description of how to use the command.

EXAMPLES

       • Verify foo.nupkg:

                dotnet nuget verify foo.nupkg

       • Verify multiple NuGet packages - foo.nupkg and all .nupkg files in the directory specified:

                dotnet nuget verify foo.nupkg c:\mydir\*.nupkg

       • Verify foo.nupkg signature matches with the specified certificate fingerprint:

                dotnet nuget verify foo.nupkg --certificate-fingerprint CE40881FF5F0AD3E58965DA20A9F571EF1651A56933748E1BF1C99E537C4E039

       • Verify foo.nupkg signature matches with one of the specified certificate fingerprints:

                dotnet nuget verify foo.nupkg --certificate-fingerprint CE40881FF5F0AD3E58965DA20A9F571EF1651A56933748E1BF1C99E537C4E039 --certificate-fingerprint EC10992GG5F0AD3E58965DA20A9F571EF1651A56933748E1BF1C99E537C4E027

       • Verify the signature of foo.nupkg by using settings (packagesources and trustedSigners) only  from  the
         specified nuget.config file:

                dotnet nuget verify foo.nupkg --configfile ..\Settings\nuget.config

                                                   2025-07-30                             dotnet-nuget-verify(1)