A few days ago I detailed how to create a nupkg containing a native library. Next we’ll sign and upload it to nuget.org.
Nuget.org also has an excellect post on the topic.
Motivations:
- Make our own libraries more accessible to others. Previously we provided instructions on cloning the repo and bringing it into an existing project- using nuget would be easier.
- Simplify our codebase. Our main .sln has 55 projects; perhaps 10 of which are third party libs that we made minor changes to but otherwise rarely touch.
Organization
We want all our packages to be owned by the Subor organization so everything won’t be tied to a single person.
After creating an organization (profile ->Manage Organizations->Add new ), you can click the pencil icon to access the organization’s settings page and configure various things:
Certificate Creation and Registration
Assuming you have a PKCS #12 file (with a .pfx extension) for signing, you need to export a .cer to register with nuget.org. On Windows, double-clicking the pfx should launch the Certificate Import Wizard, or you can run certmgr.exe
and click Import….
Once imported, select the key and click Export… :
When prompted select No, do not export the private key :
Then click through to create the .cer. Now, go to the organization’s settings page on nuget.org and pick Certificates->Register new. Select the .cer you just created.
Nuget.org API Key
While you’re visiting nuget.org it’s worth creating an API key profile->API Keys->+Create :
For Package Owner pick the organization. Uploaded packages will belong to the organization rather than your individual account.
For Select Scopes I’ve got Push only new package versions because I’m planning to use this on our build machine and it really has no reason to create new packages.
Click Create then Copy to save the API key to your clipboard. You cannot get this key again later; if you forget it you just have to Regenerate it (invalidating the old one):
Signing
I’ve got Subor.NNanomsg.NETStandard.0.5.2.nupkg
from the other day and our private key (the pfx). To sign the package:
nuget.exe sign Subor.NNanomsg.NETStandard.0.5.2.nupkg -Timestamper http://sha256timestamp.ws.symantec.com/sha256/timestamp -CertificatePath path_to_private_key.pfx
Output should be similar to:
Please provide password for: path_to_private_key.pfx
Password: ********************************
Signing package(s) with certificate:
Subject Name: CN=???????????????????, O=???????????????????, L=??, C=CN
SHA1 hash: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
SHA256 hash: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
Issued by: CN=DDDDDDDDDDDDDDD SHA256 Code Signing CA, OU=EEEEEEEEEEEEEEEEE, O=FFFFFFFFFFFFFFFFFF, C=US
Valid from: 12/34/56 00:00:00 to 12/34/56 00:00:00
Timestamping package(s) with:
http://sha256timestamp.ws.symantec.com/sha256/timestamp
Package(s) signed successfully.
After signing the size of the nupkg file should increase slightly (in this case 10KB).
If you get output that ends with Key does not exist.
, make sure the .pfx (the private key) follows -CertificatePath
and not the .cer (public key).
You can verify the package with:
nuget.exe verify Subor.NNanomsg.NETStandard.0.5.2.nupkg -All
And there should be a bunch of similar output that ends with Successfully verified package 'Subor.NNanomsg.NETStandard.0.5.2'.
.
Uploading
The first time I uploaded the package I used nuget.org’s web interface: profile ->Manage Packages->+Add new.
Thereafter I can use the “update package versions”-only API key I created to push updates:
nuget.exe push Subor.NNanomsg.NETStandard.0.5.2.nupkg -Source "https://www.nuget.org" -ApiKey abcdef01234567890abcdef01234567890
If everything is working:
Pushing Subor.NNanomsg.NETStandard.0.5.2.nupkg to the NuGet gallery (https://www.nuget.org)...
PUT https://www.nuget.org/api/v2/package/
Created https://www.nuget.org/api/v2/package/ 3158ms
Your package was pushed.
The package is validated before becoming available via nuget.org. This seems to take around 5 minutes for a small package like this, although I’d imagine it might take longer for large packages or during peak usage. You can keep an eye on its status via the package’s page: https://www.nuget.org/packages/Subor.NNanomsg.NETStandard/0.5.2.
The Circle is Now Complete
Back in Visual Studio, you can now:
- Right-click a project ->Manage NuGet Packages…->Browse.
Make sure Package source is
nuget.org
(in case you changed it during package development). And search forSubor.NNanomsg.NETStandard
:
Install it and build the project (don’t forget to set Platform target!).
Browse to the output folder and
nanomsg.dll
should be there.
Pretty slick.
Top comments (0)