dotnet-nuget-trust(1)

📦
version 11.0.0~rc3 · 6 versions
, in alpine 3.24, centos-stream 10, centos-stream 9, fedora 43, fedora 44, nixpkgs unstable, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 dotnet-nuget-trust(1) — the .NET Documentation glow-up 💖

okay bestie, welcome to dotnet-nuget-trust, page one of the whole saga. this is a .NET Documentation moment, and it applies to: ✔️ .NET 6 SDK and later versions. yes queen, we're in the modern era. ✨

✨ NAME ✨

dotnet-nuget-trust — literally just gets or sets trusted signers to the NuGet configuration. that's the whole vibe. 🎀

🌸 SYNOPSIS 🌸

dotnet nuget trust [command] [Options]

dotnet nuget trust -h|--help

like, you call the thing, you give it a command, you give it options. help is always there for you. 🫶

🦋 DESCRIPTION 🦋

so the dotnet nuget trust command is the one managing the trusted signers, mmkay? by default, NuGet is out here accepting all authors and repositories. no thoughts, head empty, trusting everyone. 😭

these commands let you be picky — you specify only a specific subset of signers whose signatures will be accepted, and reject literally everyone else. main character energy only. 👑

for more information, see Common NuGet configurations. and for the deets on what the nuget.config schema looks like, refer to the NuGet config file reference.

⚠️ heads up bestie: this command requires a certificate root store that is valid for both code signing and timestamping. also, this command may not be supported on some combinations of operating system and .NET SDK. for more information, see NuGet signed package verification. don't come for me, that's just what the docs said. 💀

💅 OPTIONS 💅

  • -? | -h | --help — prints out a description of how to use the command. the classic "help me bestie" button. 🙈

🎀 Commands 🎀

if no command is specified, the command will default to list. it said "not me choosing for you" and honestly? valid. ✨

🌈 list

lists all the trusted signers in the configuration. this option will include all the certificates (with fingerprint and fingerprint algorithm) each signer has. and if a certificate has a preceding [U], it means that certificate entry has allowUntrustedRoot set as true. iykyk. 💖

Synopsis:

dotnet nuget trust list [--configfile <PATH>] [-h|--help] [-v, --verbosity <LEVEL>]

Options:

  • --configfile <FILE> — the NuGet configuration file (nuget.config) to use. if specified, only the settings from this file will be used. if not specified, the hierarchy of configuration files from the current directory will be used. for more information, see Common NuGet Configurations. it's giving "choose your own adventure" but for configs. 🗂️
  • -? | -h | --help — prints out a description of how to use the command.
  • -v | --verbosity <LEVEL> — sets the verbosity level of the command. allowed values are q[uiet], m[inimal], n[ormal], d[etailed], and diag[nostic]. the default is minimal. for more information, see xref:Microsoft.Build.Framework.LoggerVerbosity. lowkey the most-used flag in existence fr fr.

🧚 sync

deletes the current list of certificates and replaces them with an up-to-date list from the repository. out with the old, in with the fresh. slay. 🔥

Synopsis:

dotnet nuget trust sync <NAME> [--configfile <PATH>] [-h|--help] [-v, --verbosity <LEVEL>]

Arguments:

  • NAME — the name of the existing trusted signer to sync.

Options:

  • --configfile <FILE> — the NuGet configuration file (nuget.config) to use. if specified, only the settings from this file will be used. if not specified, the hierarchy of configuration files from the current directory will be used. for more information, see Common NuGet Configurations.
  • -? | -h | --help — prints out a description of how to use the command.
  • -v | --verbosity <LEVEL> — sets the verbosity level of the command. allowed values are q[uiet], m[inimal], n[ormal], d[etailed], and diag[nostic]. the default is minimal. for more information, see xref:Microsoft.Build.Framework.LoggerVerbosity.

💀 remove

removes any trusted signers that match the given name. it's the block button but for signers. not me being dramatic, it literally says that. 🙈

Synopsis:

dotnet nuget trust remove <NAME> [--configfile <PATH>] [-h|--help] [-v, --verbosity <LEVEL>]

Arguments:

  • NAME — the name of the existing trusted signer to remove.

Options:

  • --configfile <FILE> — the NuGet configuration file (nuget.config) to use. if specified, only the settings from this file will be used. if not specified, the hierarchy of configuration files from the current directory will be used. for more information, see Common NuGet Configurations.
  • -? | -h | --help — prints out a description of how to use the command.
  • -v | --verbosity <LEVEL> — sets the verbosity level of the command. allowed values are q[uiet], m[inimal], n[ormal], d[etailed], and diag[nostic]. the default is minimal. for more information, see xref:Microsoft.Build.Framework.LoggerVerbosity.

🌟 author

adds a trusted signer with the given name, based on the author signature of the package. respecting the author's whole artistry. 🎨

Synopsis:

dotnet nuget trust author <NAME> <PACKAGE> [--allow-untrusted-root] [--configfile <PATH>] [-h|--help] [-v, --verbosity <LEVEL>]

Arguments:

  • NAME — the name of the trusted signer to add. if NAME already exists in the configuration, the signature is appended. no overwriting, just stacking. 💅
  • PACKAGE — the given PACKAGE should be a local path to the signed .nupkg file.

Options:

  • --allow-untrusted-root — specifies if the certificate for the trusted signer should be allowed to chain to an untrusted root. this is not recommended. like, genuinely not recommended. don't do it. 🚩
  • --configfile <FILE> — the NuGet configuration file (nuget.config) to use. if specified, only the settings from this file will be used. if not specified, the hierarchy of configuration files from the current directory will be used. for more information, see Common NuGet Configurations.
  • -? | -h | --help — prints out a description of how to use the command.
  • -v | --verbosity <LEVEL> — sets the verbosity level of the command. allowed values are q[uiet], m[inimal], n[ormal], d[etailed], and diag[nostic]. the default is minimal. for more information, see xref:Microsoft.Build.Framework.LoggerVerbosity.

💜 repository

adds a trusted signer with the given name, based on the repository signature or countersignature of a signed package. repository girlies rise up. 🫶

Synopsis:

dotnet nuget trust repository <NAME> <PACKAGE> [--allow-untrusted-root] [--configfile <PATH>] [-h|--help] [--owners <LIST>] [-v, --verbosity <LEVEL>]

Arguments:

  • NAME — the name of the trusted signer to add. if NAME already exists in the configuration, the signature is appended.
  • PACKAGE — the given PACKAGE should be a local path to the signed .nupkg file.

Options:

  • --allow-untrusted-root — specifies if the certificate for the trusted signer should be allowed to chain to an untrusted root. this is not recommended. fr, they said it, not me. 😭
  • --configfile <FILE> — the NuGet configuration file (nuget.config) to use. if specified, only the settings from this file will be used. if not specified, the hierarchy of configuration files from the current directory will be used. for more information, see Common NuGet Configurations.
  • -? | -h | --help — prints out a description of how to use the command.
  • --owners <LIST> — semicolon-separated list of trusted owners to further restrict the trust of a repository. yes, LIST. yes, semicolons. no, not commas. ✨
  • -v | --verbosity <LEVEL> — sets the verbosity level of the command. allowed values are q[uiet], m[inimal], n[ormal], d[etailed], and diag[nostic]. the default is minimal. for more information, see xref:Microsoft.Build.Framework.LoggerVerbosity.

🎀 certificate

adds a trusted signer with the given name, based on a certificate fingerprint. very specific, very secure, very cunt. 💅

Synopsis:

dotnet nuget trust certificate <NAME> <FINGERPRINT> [--algorithm <ALGORITHM>] [--allow-untrusted-root] [--configfile <PATH>] [-h|--help] [-v, --verbosity <LEVEL>]

Arguments:

  • NAME — the name of the trusted signer to add. if a trusted signer with the given name already exists, the certificate item is added to that signer. otherwise a trusted author is created with a certificate item from the given certificate information. either way, you're getting a signer. 👑
  • FINGERPRINT — the fingerprint of the certificate.

Options:

  • --algorithm <ALGORITHM> — specifies the hash algorithm used to calculate the certificate fingerprint. defaults to SHA256. values supported are SHA256, SHA384 and SHA512. pick your fighter. ⭐
  • --allow-untrusted-root — specifies if the certificate for the trusted signer should be allowed to chain to an untrusted root. this is not recommended. okay but why does this option keep showing up. it keeps showing up because it's real and you should still avoid it. 🚩
  • --configfile <FILE> — the NuGet configuration file (nuget.config) to use. if specified, only the settings from this file will be used. if not specified, the hierarchy of configuration files from the current directory will be used. for more information, see Common NuGet Configurations.
  • -? | -h | --help — prints out a description of how to use the command.
  • -v | --verbosity <LEVEL> — sets the verbosity level of the command. allowed values are q[uiet], m[inimal], n[ormal], d[etailed], and diag[nostic]. the default is minimal. for more information, see xref:Microsoft.Build.Framework.LoggerVerbosity.

🍓 source

adds a trusted signer based on a given package source. sourcing the tea, respectfully. ☕

Synopsis:

dotnet nuget trust source <NAME> [--configfile <PATH>] [-h|--help] [--owners <LIST>] [--source-url] [-v, --verbosity <LEVEL>]

Arguments:

  • NAME — the name of the trusted signer to add. if only <NAME> is provided without --<source-url>, the package source from your NuGet configuration files with the same name is added to the trusted list. if <NAME> already exists in the configuration, the package source is appended to it. it's giving "it knows what you mean". 🔮

Options:

  • --configfile <FILE> — the NuGet configuration file (nuget.config) to use. if specified, only the settings from this file will be used. if not specified, the hierarchy of configuration files from the current directory will be used. for more information, see Common NuGet Configurations.
  • -? | -h | --help — prints out a description of how to use the command.
  • --owners <LIST> — semicolon-separated list of trusted owners to further restrict the trust of a repository.
  • --source-url — if a source-url is provided, it must be a v3 package source URL (like https://api.nuget.org/v3/index.json). other package source types are not supported. v3 or nothing, bestie. 🦋
  • -v | --verbosity <LEVEL> — sets the verbosity level of the command. allowed values are q[uiet], m[inimal], n[ormal], d[etailed], and diag[nostic]. the default is minimal. for more information, see xref:Microsoft.Build.Framework.LoggerVerbosity.

okay that's part 1, and there's more coming so don't go anywhere 💖✨

✨ EXAMPLES ✨

Okay bestie, this is the part where it all clicks. Real commands, real vibes, copy-paste energy. Let's go 💅

🌸 Peek at who you already trust

Want the full roster of trusted signers? Just:

dotnet nuget trust list

No flags, no drama. It's giving "let me see the guest list" 📋✨

🌈 Trust a whole source, but in that config file

Say you wanna trust the source NuGet, but only inside a specific nuget.config (not the default one, we're being ✨specific✨):

dotnet nuget trust source NuGet --configfile ..\nuget.config

The --configfile points at ..\nuget.config, so this trust lives there and nowhere else. Lowkey iconic behavior tbh 🫶

🎀 Trust an author straight from a package

Got a signed nupkg file and you wanna vouch for whoever made it? Slide in with the author subcommand:

dotnet nuget trust author PackageAuthor .\foo.nupkg

Here PackageAuthor is the name you're giving that trusted author, and .\foo.nupkg is the signed package file you're pulling them from. Two args, one trust, zero regrets 🌟

🦋 Trust a repository from a package file

Same energy, but for a repo instead of a human:

dotnet nuget trust repository PackageRepository .\foo.nupkg

PackageRepository = the name you're assigning, .\foo.nupkg = the signed package it comes from. Chef's kiss 👑

🔥 Trust a certificate by its SHA256 fingerprint

This one's the fancy one, ngl. You're trusting a package signing certificate using its fingerprint:

dotnet nuget trust certificate MyCert  F99EC8CDCE5642B380296A19E22FA8EB3AEF1C70079541A2B3D6E4A93F5E1AFD --algorithm SHA256

Let's break the vibe check down:

  • MyCert — the name you're giving this trusted certificate.
  • F99EC8CDCE5642B380296A19E22FA8EB3AEF1C70079541A2B3D6E4A93F5E1AFD — the actual SHA256 fingerprint, no cap.
  • --algorithm SHA256 — telling it which algorithm that fingerprint belongs to.
Heads up bestie: that fingerprint has to be exactly right. One wrong character and it's over 💀

💜 Trust some owners from a source URL

You can trust specific owners from a repository too. Like, say, Nuget and Microsoft from https://api.nuget.org/v3/index.json:

dotnet nuget trust source NuGetTrust --source-url https://api.nuget.org/v3/index.json --owners "Nuget;Microsoft"
  • NuGetTrust — the name for this trusted source.
  • --source-url https://api.nuget.org/v3/index.json — where the repo lives.
  • --owners "Nuget;Microsoft" — the owners you're trusting. Note the ; separating them inside the quotes — that's the separator, bestie, don't @ me.

Multiple owners, one command. Efficiency queen behavior fr fr 👸

🧚 Remove a trusted signer (goodbye era)

When someone's gotta go, they gotta go. Here's how you remove the trusted signer named NuGet from a specific config file:

dotnet nuget trust remove NuGet --configfile ..\nuget.config

remove + the signer name + --configfile ..\nuget.config and poof, they're out of that file. Unbothered, uninvited, slayed 🎀

And that's the whole page, bestie! 🌈 This lil' slice of manpage magic came from the dotnet-nuget-trust(1) manual, dated 2025-10-30 — go forth and trust responsibly, mwah 💖✨

📦 where this page comes from