Package Signatures Technical Details

Status: InProgress

Technical Details

This document describes what a Signed NuGet Package is from a technical perspective.

It will include details such as (but not limited to):

• X.509 Certificate requirements. (e.g. Code Signing EKU, Revocation methods allowed, ...)
• Digital Signature format. (e.g. XAdES-XL, Timestamp counterparts, OPC relationships,...)
• Command line tools description. (e.g. Which commands will be added to NuGet.exe to sign packages)
• Signature Validation (details on the validation process)