8

Visual Studio now includes a Package Manager that downloads and updates software packages from the internet. The common name for this is "Nuget"

The problem I have is that anyone can pretend to be someone else, by spoofing the owner field. This opens up a whole can of worms with regard to updates, and verifying the authenticity of every patch.

  • Are these valid concerns? (did I miss any?)

  • What technical and procedural controls can we implement to limit risk?

  • Is there any way to use Nuget in a secure manner?

Improve this question
1
  • I am surprised none of the answers touched on the idea of a nuget package author adding malicious code. Nuget gallery does not expose the origin or proof of the source code, does not build it and does not audit it, unless I see a rebuttal... Even Maven Central does not have resources to check the incoming code. stackoverflow.com/questions/24967270/…
    – eel ghEEz
    Commented Nov 26, 2019 at 17:19

3 Answers 3

Reset to default
5

Updated 2024-02-05

From NuGet 4.6 package signing is supported. An Author signature can optionally, be included when distributing NuGet packages via NuGet.org or via a separate distribution channel.

The Author signature provides two key benefits:

  • It cryptographically verifies that the package has not been changed since it was signed by the author (to the limits of the hashing algorithms which is are currently supported SHA-2-256/ SHA-2-384/ SHA-2-512).
  • It identifies the author through an external chain of trust, as the author must provide proof of identity to obtain a code signing certificate from an public certificate authority. On Windows, the list of trusted publishers and root certificate authorities configured in the Operating System further limits which publishers and certificate authorities are trusted for code signing.

Noting for clarify in addition to the Author signature, NuGet.org also provides a Repository signature which is automatically applied to all packages. This signature verifies the package has not been tampered with from when it was uploaded to NuGet.org but do not verify the identity of the author.

The NuGet CLI provides the nuget verify command to check both signatures.

In additional to packages signatures, NuGet.org provides Package ID prefix reservation. A prefix reserved by an owner can not be used to prefix packages by other parties (unless delegated or made public).

For example if the Microsoft prefix is reserved. Another undelegated party can not upload a package with the Microsoft. prefix i.e. Microsoft.SomePackage.

Improve this answer
2

Since everything from the CLR to 3rd party libraries will be distributed via NuGet in ASP.NET vNext, the NuGet team has committed to supporting signed packages by, I believe, the time Visual Studio 2015 is released.

See the blog announcement: http://blog.nuget.org/20150203/package-signing.html

Also, see the signing spec: https://github.com/aspnet/Signing/blob/dev/Spec.md

Improve this answer
0

Nuget now supports Package ID Reservation (see also Press Release)

This allows for additional trust between the developer and producer, but also is a step in the right direction for trust for Continuous Integration (CI) builds (since deterministic builds aren't possible in .NET)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .