NuGet Gallery Publish Anonymously

Question

I am on a team implmenting an internal NuGet Gallery for a client. Our client would like to not require apikeys when publishing packages. Our big issue with this right now is using the mirror command from the command line. If I don't enter an Api Key, it asks for a username and password, or if I set

    <add key="Auth.ApiKey.Enabled" value="false"/>

then it will ask for a Username and password every time. I can see that it's using the OwinContext in order to handle the authentication, but I don't understand all of the settings.

So my questions are:

1. Can I publish with a username/password (in one command) instead of using an apikey?

2. Can I publish anonymously? If so, how? I don't see how to just disable the authentication or make it login as a certain user. I do see that in the CreateInternalPackage method of ApiController, it is calling:

   var user = GetCurrentUser(); So it will need to be able to get some sort of user object.

Thanks so much, gang!

Answer 1

If you really wanted to publish anonymously, it would probably be best to establish your own, custom package store thusly: https://docs.nuget.org/create/hosting-your-own-nuget-feeds

That way, you can configure whatever security you want.

Otherwise, if you're trying to publish to Nuget.org, then having anonymous authentication would be a bad idea, since it would allow anyone (including hackers) to overwrite your package with potentially dangerous code.

You can potentially explore setting user name/password in the Nuget.config file: https://docs.nuget.org/consume/nuget-config-file

I don't know the details of how you're publishing, but I know the push command uses a Nuget.config file: https://docs.nuget.org/consume/command-line-reference#push-command-options

...and you can even have the config file be specific to each user, then load it as an option.