All 15 Assemblies & NuGet questions
More in Assemblies & NuGet
What is strong naming of assemblies, and why is it much less commonly required in modern .NET? How do you create and publish your own NuGet package from a class library project? What is the difference between a NuGet package's dependency group targeting different frameworks, and why do multi-targeted packages need this? What is a NuGet lock file (packages.lock.json), and what problem does it solve for reproducible builds? What is Central Package Management (CPM) in NuGet, and how does Directory.Packages.props centralize version control? How does semantic versioning apply to NuGet packages, and what do version range operators like [1.0,2.0) mean? What is assembly loading context, and how does AssemblyLoadContext enable plugin isolation in modern .NET? How do you audit a .NET project's dependencies for known security vulnerabilities using NuGet tooling? How does reflection allow inspecting an assembly's types and metadata at runtime, and what are common uses? What is package source mapping, and how does it protect against dependency confusion attacks?
Advertisement
.NET › Assemblies & NuGet

What are NuGet package sources, and how do you configure a project to pull packages from a private/internal feed alongside NuGet.org?

Intermediate

Answer

NuGet package sources are configured (globally or per-solution via NuGet.Config) URLs NuGet searches when resolving packages -- you can add multiple sources simultaneously (e.g., NuGet.org for public packages plus an internal Azure Artifacts feed for proprietary packages), with authentication handled via API keys or credential providers for private feeds.
<!-- NuGet.Config -->
<configuration>
  <packageSources>
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
    <add key="CompanyFeed" value="https://pkgs.dev.azure.com/mycompany/_packaging/internal/nuget/v3/index.json" />
  </packageSources>
</configuration>
Real-world example A company's internal shared libraries are published to a private Azure Artifacts feed configured alongside NuGet.org in every project's NuGet.Config, so developers use the same `dotnet add package` workflow for both public and internal dependencies.

Common follow-ups: How do you securely store credentials for a private feed in CI?;What's the package source mapping feature and why does it improve security?

CI/CD Publishing & Deployment;.NET CLI SDK & Project Structure (csproj)
All 15 Assemblies & NuGet questions