dotnet-nuget-verify(1)                                   .NET Documentation                                  dotnet-nuget-verify(1)

dotnet nuget verify
       This article applies to: ✔️ .NET 5.0.100-rc.2.x SDK and later versions

NAME
       dotnet-nuget-verify - Verifies a signed NuGet package.

SYNOPSIS
              dotnet nuget verify [<package-path(s)>]
                  [--all]
                  [--certificate-fingerprint <FINGERPRINT>]
                  [-v|--verbosity <LEVEL>]
                  [--configfile <FILE>]

              dotnet nuget verify -h|--help

DESCRIPTION
       The dotnet nuget verify command verifies a signed NuGet package.

              This  command  requires  a  certificate  root  store that is valid for both code signing and timestamping.  See NuGet
              signed package verification for details.

ARGUMENTS
       • package-path(s)

         Specifies the file path to the package(s) to be verified.  Multiple position arguments can be passed in to verify multiple
         packages.

OPTIONS
       • --all

         Specifies  that  all  verifications possible should be performed on the package(s).  By default, only signatures are veri‐
         fied.

         This command currently supports only signature verification.

       • --certificate-fingerprint <FINGERPRINT>

         Verify that the signer certificate matches with one of the specified SHA256 fingerprints.  This  option  can  be  supplied
         multiple times to provide multiple fingerprints.

       • -v|--verbosity <LEVEL>

         Sets  the  verbosity level of the command.  Allowed values are q[uiet], m[inimal], n[ormal], d[etailed], and diag[nostic].
         The default is minimal.  For more information, see <xref:Microsoft.Build.Framework.LoggerVerbosity>.

         The following table shows what is displayed for each verbosity level.

         ​                     q[uiet]   m[inimal]   n[ormal]   d[etailed]   diag[nostic]
         ─────────────────────────────────────────────────────────────────────────────────
         Certificate   chain   ❌        ❌          ❌         ✔️           ✔️
         Information
         Path to package be‐   ❌        ❌          ✔️         ✔️           ✔️
         ing verified
         Hashing   algorithm   ❌        ❌          ✔️         ✔️           ✔️
         used for signature
         Author/Repository     ❌        ❌          ✔️         ✔️           ✔️
         Certificate -> SHA1
         hash
         Author/Repository     ❌        ❌          ✔️         ✔️           ✔️
         Certificate ->  Is‐
         sued By

         Timestamp  Certifi‐   ❌        ❌          ✔️         ✔️           ✔️
         cate -> Issued By
         Timestamp  Certifi‐   ❌        ❌          ✔️         ✔️           ✔️
         cate   ->   SHA-256
         hash
         Timestamp  Certifi‐   ❌        ❌          ✔️         ✔️           ✔️
         cate   ->  Validity
         period
         Timestamp  Certifi‐   ❌        ❌          ✔️         ✔️           ✔️
         cate -> SHA1 hash
         Timestamp  Certifi‐   ❌        ❌          ✔️         ✔️           ✔️
         cate   ->   Subject
         name
         Author/Repository     ❌        ✔️          ✔️         ✔️           ✔️
         Certificate -> Sub‐
         ject name
         Author/Repository     ❌        ✔️          ✔️         ✔️           ✔️
         Certificate      ->
         SHA-256 hash
         Author/Repository     ❌        ✔️          ✔️         ✔️           ✔️
         Certificate ->  Va‐
         lidity period
         Author/Repository     ❌        ✔️          ✔️         ✔️           ✔️
         Certificate -> Ser‐
         vice  index URL (If
         applicable)
         Package name  being   ❌        ✔️          ✔️         ✔️           ✔️
         verified
         Type  of  signature   ❌        ✔️          ✔️         ✔️           ✔️
         (author or  reposi‐
         tory)

         ❌ indicates details that are not displayed.  ✔️ indicates details that are displayed.

       • --configfile <FILE>

         The  NuGet configuration file (nuget.config) to use.  If specified, only the settings from this file will be used.  If not
         specified, the hierarchy of configuration files from the current directory will be used.  For more information, see Common
         NuGet Configurations.

       • -?|-h|--help

         Prints out a description of how to use the command.

EXAMPLES
       • Verify foo.nupkg:

                dotnet nuget verify foo.nupkg

       • Verify multiple NuGet packages - foo.nupkg and all .nupkg files in the directory specified:

                dotnet nuget verify foo.nupkg c:\mydir\*.nupkg

       • Verify foo.nupkg signature matches with the specified certificate fingerprint:

                dotnet nuget verify foo.nupkg --certificate-fingerprint CE40881FF5F0AD3E58965DA20A9F571EF1651A56933748E1BF1C99E537C4E039

       • Verify foo.nupkg signature matches with one of the specified certificate fingerprints:

                dotnet nuget verify foo.nupkg --certificate-fingerprint CE40881FF5F0AD3E58965DA20A9F571EF1651A56933748E1BF1C99E537C4E039 --certificate-fingerprint EC10992GG5F0AD3E58965DA20A9F571EF1651A56933748E1BF1C99E537C4E027

       • Verify the signature of foo.nupkg by using settings (packagesources and trustedSigners) only from the specified nuget.con‐
         fig file:

                dotnet nuget verify foo.nupkg --configfile ..\Settings\nuget.config

                                                             2022-11-08                                      dotnet-nuget-verify(1)