dotnet-nuget-verify(1)

💖 dotnet-nuget-verify — the .NET Documentation manual page, bestie edition 💖

okay so you found the dotnet-nuget-verify(1) page from the .NET Documentation, and honestly? iconic of you. this one applies to ✔️ .NET 6 SDK and later versions, so if you're on anything older... babes, we gotta talk. 🫶

---

✨ NAME ✨

dotnet-nuget-verify — verifies a signed NuGet package. that's it, that's the whole vibe. it's the "bestie, is this actually signed tho?" command. 🔥

---

🌸 SYNOPSIS 🌸

dotnet nuget verify [<package-path(s)>]
    [--all]
    [--certificate-fingerprint <FINGERPRINT>]
    [-v|--verbosity <LEVEL>]
    [--configfile <FILE>]

dotnet nuget verify -h|--help

---

🦋 DESCRIPTION 🦋

so dotnet nuget verify verifies a signed NuGet package. lowkey its whole job. ✨

and in .NET 10 and later versions, it also outputs the package's content hash, which might be useful to investigate lock file validation errors. so if your lock file is being dramatic, this is your girl. 💅

🚨 okay important stuff, no cap: this command requires a certificate root store that is valid for both code signing and timestamping. also, this command may not be supported on some combinations of operating system and .NET SDK. for more info, see NuGet signed package verification. don't come for me, come for the cert store. 😭

---

🎀 ARGUMENTS 🎀

• package-path(s) — specifies the file path to the package(s) to be verified. you can pass in multiple position arguments to verify multiple packages at once. slay, batch it. 👑

---

✨ OPTIONS ✨

• --all — specifies that all verifications possible should be performed on the package(s). by default, only signatures are verified. heads up tho: this command currently supports only signature verification. so --all is giving main character energy but it's a one-trick pony rn. 🙈
• --certificate-fingerprint <FINGERPRINT> — verify that the signer certificate matches with one of the specified SHA256 fingerprints. you can supply this option multiple times to provide multiple fingerprints. stack 'em like friendship bracelets. 🎀
• -v|--verbosity <LEVEL> — sets the verbosity level of the command. allowed values are q[uiet], m[inimal], n[ormal], d[etailed], and diag[nostic]. the default is minimal. for more information, see <xref:Microsoft.Build.Framework.LoggerVerbosity>. 👀

okay so here's what actually shows up at each level (the original page does this as a big table, but tables are not the vibe here so we're doing bullets, and every single row is still here, promise):

• Certificate chain Information — q[uiet] ❌ · m[inimal] ❌ · n[ormal] ❌ · d[etailed] ✔️ · diag[nostic] ✔️
• Path to package being verified — q[uiet] ❌ · m[inimal] ❌ · n[ormal] ✔️ · d[etailed] ✔️ · diag[nostic] ✔️
• Hashing algorithm used for signature — q[uiet] ❌ · m[inimal] ❌ · n[ormal] ✔️ · d[etailed] ✔️ · diag[nostic] ✔️
• Author/Repository Certificate -> SHA1 hash — q[uiet] ❌ · m[inimal] ❌ · n[ormal] ✔️ · d[etailed] ✔️ · diag[nostic] ✔️
• Author/Repository Certificate -> Issued By — q[uiet] ❌ · m[inimal] ❌ · n[ormal] ✔️ · d[etailed] ✔️ · diag[nostic] ✔️
• Timestamp Certificate -> Issued By — q[uiet] ❌ · m[inimal] ❌ · n[ormal] ✔️ · d[etailed] ✔️ · diag[nostic] ✔️
• Timestamp Certificate -> SHA-256 hash — q[uiet] ❌ · m[inimal] ❌ · n[ormal] ✔️ · d[etailed] ✔️ · diag[nostic] ✔️
• Timestamp Certificate -> Validity period — q[uiet] ❌ · m[inimal] ❌ · n[ormal] ✔️ · d[etailed] ✔️ · diag[nostic] ✔️
• Timestamp Certificate -> SHA1 hash — q[uiet] ❌ · m[inimal] ❌ · n[ormal] ✔️ · d[etailed] ✔️ · diag[nostic] ✔️
• Timestamp Certificate -> Subject name — q[uiet] ❌ · m[inimal] ❌ · n[ormal] ✔️ · d[etailed] ✔️ · diag[nostic] ✔️
• Author/Repository Certificate -> Subject name — q[uiet] ❌ · m[inimal] ✔️ · n[ormal] ✔️ · d[etailed] ✔️ · diag[nostic] ✔️
• Author/Repository Certificate -> SHA-256 hash — q[uiet] ❌ · m[inimal] ✔️ · n[ormal] ✔️ · d[etailed] ✔️ · diag[nostic] ✔️
• Author/Repository Certificate -> Validity period — q[uiet] ❌ · m[inimal] ✔️ · n[ormal] ✔️ · d[etailed] ✔️ · diag[nostic] ✔️
• Author/Repository Certificate -> Service index URL (If applicable) — q[uiet] ❌ · m[inimal] ✔️ · n[ormal] ✔️ · d[etailed] ✔️ · diag[nostic] ✔️
• Package name being verified — q[uiet] ❌ · m[inimal] ✔️ · n[ormal] ✔️ · d[etailed] ✔️ · diag[nostic] ✔️
• Type of signature (author or repository) — q[uiet] ❌ · m[inimal] ✔️ · n[ormal] ✔️ · d[etailed] ✔️ · diag[nostic] ✔️

💀 ❌ indicates details that are not displayed. ✔️ indicates details that are displayed. that's the whole legend, not me gatekeeping.

• --configfile <FILE> — the NuGet configuration file (nuget.config) to use. if specified, only the settings from this file will be used. if not specified, the hierarchy of configuration files from the current directory will be used. for more info, see Common NuGet Configurations. ✨
• -?|-h|--help — prints out a description of how to use the command. classic. the "help me bestie" button. 🫶

---

🌈 EXAMPLES 🌈

1. verify foo.nupkg:

dotnet nuget verify foo.nupkg

2. verify multiple NuGet packages — foo.nupkg and all .nupkg files in the directory specified:

dotnet nuget verify foo.nupkg c:\mydir\*.nupkg

3. verify foo.nupkg signature matches with the specified certificate fingerprint:

dotnet nuget verify foo.nupkg --certificate-fingerprint CE40881FF5F0AD3E58965DA20A9F571EF1651A56933748E1BF1C99E537C4E039

4. verify foo.nupkg signature matches with one of the specified certificate fingerprints:

dotnet nuget verify foo.nupkg --certificate-fingerprint CE40881FF5F0AD3E58965DA20A9F571EF1651A56933748E1BF1C99E537C4E039 --certificate-fingerprint EC10992GG5F0AD3E58965DA20A9F571EF1651A56933748E1BF1C99E537C4E027

5. verify the signature of foo.nupkg by using settings (packagesources and trustedSigners) only from the specified nuget.config file:

dotnet nuget verify foo.nupkg --configfile ..\Settings\nuget.config

---

and that's the whole page, bestie, every last crumb of it. 🍓

sign-off time: this page came from the .NET Documentation and it's dated 2025-10-30, and it lives at the address dotnet-nuget-verify(1). go verify something and feel extremely powerful about it. 💜🧚✨