Dependably Packages · NuGet
A private NuGet feed for dotnet
One feed for dotnet restore. nuget.org packages come through a pull-through cache that verifies every checksum; your own packages push with a token; the policy gate decides what reaches a build.
dotnet
Point NuGet at your registry
dotnet manages NuGet.config for you. Remove the default nuget.org source so a restore cannot fall through to the public feed.
The placeholders are your base URL and a token from the web UI.
dotnet nuget add source https://repo.example.com/nuget/v3/index.json \
--name dependably --username user --password <your token> \
--store-password-in-clear-text
# keep restores from falling through to nuget.org
dotnet nuget remove source nuget.orgWhat happens to every fetch
The client sees a registry. Behind it, Dependably Packages stages each upstream artefact and refuses the ones that fail a check you configured.
- The checksum is verified against the digest the upstream publishes before the artefact is stored.
- The version is screened against OSV, and the policy gate can refuse on licence, severity, CISA KEV, EPSS, install scripts, or release age.
- A name your organization reserves cannot be squatted upstream and resolved into your builds.
- Every refusal is written to the audit log with the arm that refused it, so a 403 in CI is explained in the web UI.
Verify, publish, revert
The NuGet guide continues with a verification step, publishing your own packages, and reverting the configuration.