The future of NuGet
summary
NuGet positions itself as the central .NET package manager and outlines concrete changes: package source mapping prevents dependency‑confusion by mapping packages to exact registries; NuGet plans built‑in SBOMs generation and OpenSSF scorecard awareness for package vetting; signed packages use X.509 signatures today and nuget.org enforces mandatory two‑factor authentication and prefix reservations to block typosquatting; upcoming UI shows vulnerability scans and dependency alerts, adds central package management and Package Manager UI support, and lets authors mark packages as “needs funding.”
AI-written summary · about
chapters (10)
- 0:00Introduction and context
- 1:08Security and trust focus
- 5:14Supply chain attack prevention
- 9:07OpenSSF and security standards
- 13:30Digital signatures and auth
- 15:05Leveraging developer community
- 16:40OSS sustainability efforts
- 17:48Tooling and UI improvements
- 20:41Best practices and documentation
- 23:09Creating effective readmes
related talks
57m.NET supply chain: Protecting against hidden threats
52mBuilding Community-Driven Security Analysis for Your .NET Software Supply Chain
58mNUKE — a modern build system for C#/.NET
01h 04mWhat is new in .NET 6 and the future of .NET
53mThe .NET standards for Dummies
01h 02mHow to stop worrying and love MSBuild
46mBuild great libraries using .NET Standard
52mWhat is .NET Standard?