Dependably Packages · NuGet

A private NuGet feed for dotnet

One feed for dotnet restore. nuget.org packages come through a pull-through cache that verifies every checksum; your own packages push with a token; the policy gate decides what reaches a build.

Read the setup guide About Dependably Packages

dotnet

Point NuGet at your registry

dotnet manages NuGet.config for you. Remove the default nuget.org source so a restore cannot fall through to the public feed.

The placeholders are your base URL and a token from the web UI. The guide covers the same steps for a single project, plain HTTP, verifying the change, and reverting it.

bash · repo.example.com

dotnet nuget add source https://repo.example.com/nuget/v3/index.json \
  --name dependably --username user --password <your token> \
  --store-password-in-clear-text
# keep restores from falling through to nuget.org
dotnet nuget remove source nuget.org

What happens to every fetch

The client sees a registry. Behind it, Dependably Packages stages each upstream artefact and refuses the ones that fail a check you configured.

The checksum is verified against the digest the upstream publishes before the artefact is stored.
The version is screened against OSV, and the policy gate can refuse on licence, severity, CISA KEV, EPSS, install scripts, or release age.
A name your organization reserves cannot be squatted upstream and resolved into your builds.
Every refusal is written to the audit log with the arm that refused it, so a 403 in CI is explained in the web UI.

Verify, publish, revert

The NuGet guide continues with a verification step, publishing your own packages, and reverting the configuration if you need to.

Read the setup guide Know which of your projects are exposed, and whether it matters.Checks that gate the merge, in JavaScript, C#, and Python.