Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Automate validation of Nuget signatures

See original GitHub issue

We need to automate validation that our NuGet packages are signed.

Specifically this means running nuget verify -all on every nupkg after signing completes. If that fails, upload will fail later.

We should not rely on remembering to do this manually. Perhaps this is a dupe, but I can’t find it.

@mmitche @shawnro

Issue Analytics

  • State:closed
  • Created 5 years ago
  • Comments:8 (8 by maintainers)

github_iconTop GitHub Comments

JohnTortugocommented, Mar 29, 2019

I’m closing this issue as SignCheck already perform such validation and we’re going to use it in our builds.

danmoseleycommented, Mar 29, 2019


Read more comments on GitHub >

github_iconTop Results From Across the Web

NuGet signed-package verification - .NET CLI
You can sign a NuGet package to enable package consumers to validate the package's authenticity and integrity. If verification is enabled, .NET ...
Read more >
Package Signatures Technical Details · NuGet/Home Wiki
At signing time, a certificate MUST be within its validity period according to the package writer and MUST NOT be revoked. At validation...
Read more >
Package Signature Verification - Robot
Package Signature is a method through which NuGet Packages prove that they come from trusted sources. A package is signed by using a ......
Read more >
How to verify Package Signature when using Nuget. ...
I need to validate the subject and issuer details to validate right source of the package. var s = SignedPackageArchiveUtility.
Read more >
Why NuGet Package Signing Is Not (Yet) for Me - Haacked
With signatureValidationMode set to require , NuGet rejects package installation unless the package is signed by a trusted signer. Let's take a ...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Post

No results found

github_iconTop Related Hashnode Post

No results found