NuGet

Credentials

Internal NuGet feeds typically require a authentication and authorization. Usually an application can use a personal access token (PAT) with an associated scope that allows read-only access to the feed on your behalf. For GitHub tokens, the minimum scope is read:packages, and package sources are located at https://nuget.pkg.github.com/:org/index.json. For Azure DevOps the minimum scope is Packaging (Read), and package sources are located at https://pkgs.dev.azure.com/:org/_packaging/:name/nuget/v3/index.json.

When the token expires, a new token must be generated. The new token can then be used as described below, depending on the command-line program being used.

dotnet

• dotnet nuget list source
• dotnet nuget update source <Name> --username any --password <PAT> --store-password-in-clear-text

nuget.exe

• nuget sources List -Format Detailed
• nuget sources Update -Name <Name> -Username any -Password <PAT>

Credential providers

Some NuGet feed hosts offer a NuGet credential provider, a plugin for NuGet that allows for a credential to be provided from a custom location. Typically such a plugin creates a PAT on behalf of the user. Azure DevOps offers [artifacts-credprovider][https://github.com/Microsoft/artifacts-credprovider] for this purpose.

On first use, or when the cached credential expires, the credential provider must be triggered. To do this, execute a restore command interactively once:

• dotnet restore --interactive
• nuget restore (without -NonInteractive)
• msbuild /t:restore /p:nugetInteractive=true

Paths

dotnet

Some of these paths can be listed using dotnet nuget locals all --list.

Type	Path
global-packages	~/.nuget/packages
http-cache	~/.local/share/NuGet/http-cache
Configuration	~/.nuget/NuGet/NuGet.Config
Plugins	~/.nuget/plugins/netcore

nuget.exe

Some of these paths can be listed using nuget locals all -list.

Type	Path
global-packages	~/.nuget/packages
http-cache	~/.local/share/NuGet/v3-cache
Configuration	~/.config/NuGet/nuget.config
Plugins	~/.nuget/plugins/netfx