.NET on

Chainguard Libraries for .NET overview

Wed, 23 Sep 2026 00:00:00 +0000

Chainguard Libraries for .NET provides a secure source for your open source NuGet dependencies. NuGet is the primary public registry for .NET packages, but packages from public registries can expose applications and build pipelines to malicious or compromised code. Chainguard addresses these supply chain risks through the Chainguard Repository by applying malware and greyware scanning, organization-defined policies, and additional security controls before packages are made available. The Chainguard Repository provides a single endpoint for package retrieval.

Global configuration

Wed, 23 Sep 2026 00:00:00 +0000

.NET package consumption in a large organization is typically managed by a repository manager. The repository manager acts as a single point of access for developers and development tools to retrieve NuGet packages.

This page describes how to configure JFrog Artifactory and Sonatype Nexus Repository to proxy Chainguard Libraries for .NET. The instructions use Chainguard Repository’s built-in upstream fallback, which is the recommended configuration.

With upstream fallback enabled, configure Artifactory with a single remote repository that points to the Chainguard NuGet v3 service index: https://libraries.cgr.dev/dotnet/v3/index.json.

Configure .NET build tools

Wed, 23 Sep 2026 00:00:00 +0000

Chainguard Libraries for .NET works with the standard NuGet client through a package-source configuration change. This page is a reference for configuration, authentication, and cache clearing. Apply these changes on every workstation and build server that builds and restores .NET dependencies, including CI/CD infrastructure.

The https://libraries.cgr.dev/dotnet endpoint is also the Chainguard Repository endpoint for .NET. It serves requested versions from upstream under Chainguard security controls.

This guide outlines build tool configuration. If you are looking for something else, refer to the following guides depending on your goals:

Migrating a .NET project to Chainguard Libraries

Wed, 23 Sep 2026 00:00:00 +0000

Chainguard Libraries for .NET provides a registry of NuGet packages that have been scanned for malware and are subject to configurable policies. Switching an existing project requires only a registry configuration change – no changes to your application code or dependency versions.

This guide walks through migrating an existing .NET project to Chainguard Libraries, covering the two most common setups:

Direct access: Your build tool connects directly to libraries.cgr.dev. This option is faster for initial evaluation and smaller-scale setups.
Repository manager: Your build tool connects to a repository manager, which proxies requests to Chainguard Libraries. This option is recommended for teams and organizations.

Prerequisites

Before getting started, you need: