How do you know if a Nuget package has been signed

user_3019291 0
Viewed 3406

Nuget.org is now able to allow for authors of a Nuget package to sign their packages so that users of the package can verify that the package has not been tampered with and it builds in some authentication of the author of who made the package. Here is the blog announcing this.

It sounds like anything new will require the package to be signed but the past packages will not be signed. Is this correct? How can I know that a package has been signed?

I am using Visual Studio 2017 above the version 15.8.5 and Nuget Package Manager 4.6.0

nuget-package nuget visual-studio
1 Answers

No, there is no requirement for packages to be author signed to upload to nuget.org. There are some more docs on signed packages, including the reference page and signing packages.

NuGet.org will also sign packages. Most popular packages are already repository signed at the time I'm writing this, and all other packages will eventually be repo signed. Yes, there's a difference between author signature and repo signature, so some packages will have two signatures.

To check if a packaged is signed or not, you can follow these instructions. Or open the package in NuGet Package Explorer, although you need to know what to look for, as I'm not sure there's anything that explicitly says unsigned. Or you can open the nupkg with any program that knows zips (or if it's a package you've already restored, go to the folder in your global packages folder %USERPROFILE%\.nuget\packages and look for a file named .signature.p7s.

user_28430650
Related