Install a dotnet tool from local source only

Question

I'm making a dotnet tool that will be used in our production servers as a command line application. So I'm installing it from a local source feed as the tutorial recommends.

dotnet tool install --tool-path /usr/bin --add-source path/to/nupkg coolcompany.cooltool

The tutorial above also has this warning:

You gave your package a unique name to make sure that it will only be found in the ./nupkg directory, not on the Nuget.org site.

It seems that in case of a name conflict, dotnet tool install picks the package from nuget.org over the local one.

Now, coolcompany.cooltool does not actually exist on nuget.org. But somebody could add it later, either by accident or not, and we'd get unexpected code running in production without even knowing it.

Is there a way to force a local source to be used for a particular package? And if not, is it not a security issue? Or am I missing something obvious here?

Answer 1

While I haven't tried this, I'd expect that using the --configfile flag with dotnet tool install would work. You'd then specify a config file which only includes your local source:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <packageSources>
        <!-- Don't use any default sources -->
        <clear />
        <!-- Just use the local one -->
        <add key="LocalRepo" value="path/to/nupkg" />
    </packageSources>
</configuration>