NuGet package verification in NugetUpgrader on mac

Does Nuget package verification work on mac currently? nuget sign and nuget verify don’t work (and it’s documented here https://docs.microsoft.com/en-us/nuget/reference/cli-reference/cli-ref-sign and here https://docs.microsoft.com/en-us/nuget/reference/cli-reference/cli-ref-verify).

My tests to verify package signatures on mac using the NugetFeed class are failing, but perhaps I need to add the signers to some trusted list?

If package signature verification doesn’t work on Mac, what’s the plan there? Skipping package verification altogether on Mac is probably not the best idea.

[jamill]

We are going to default to the more secure option here. This will let users running the tool know that we are not performing the verification, and give them a chance to do any additional checks or make sure they are comfortable running this command. I will update the messaging to explain this a bit more.

[jamill]

The original decision was to default to the secure option, and require the user to specify the --no-verify option if needed. This was before we implemented this on net core, where verification is not possible at this time.

It seems like we can either update this to not require this flag on the Mac, or to update the documentation. My thought was to continue with the “secure by default” during the development period, and see where nuget was with with full support when we brought this fully online.

@nickgra - have we heard any feedback on this one way or the other?

@jrbriggs - do you have any preference here?