Publish and consume NuGet packages.

Separate feed administration from package use.

Feed management permission does not become a NuGet client credential. Create a separately scoped, expiring token for each developer workstation or automation client.

Create a private project feed.

1. Choose New feed.Use a name people will recognize in the project package picker.
2. Set the slug.Use lowercase letters, digits, and internal hyphens. The slug identifies the feed in Mozaic, while clients use the generated service-index URL.
3. Understand the fixed defaults.The current creation form always makes the feed private and permits explicitly addressed restores of unlisted versions; those values are shown in the feed inventory rather than chosen in this form.
4. Create the feed.Return to the feed inventory and copy the generated service-index URL.

Feed names contain 1-120 characters. Slugs are at most 63 ASCII characters and contain lowercase letters, digits, and hyphens, with no leading or trailing hyphen.

Issue one show-once token per client.

Credential creation requires fresh authentication and Manage packages. The raw value begins with mznuget_, is displayed once, and cannot be recovered later.

read

Read a private feed, search packages, and restore package bytes.

push

Publish primary .nupkg files whose normalized IDs match the token pattern.

push_symbols

Publish .snupkg or symbols-package bytes for matching package IDs.

lifecycle

Unlist through NuGet delete and perform permitted package lifecycle operations.

1. Name the client.Use a name such as Ada workstation or release automation; names contain 1-120 characters.
2. Constrain package IDs.Enter one exact ID, a prefix with one trailing wildcard such as Contoso.*, or * only when the client truly needs the whole feed.
3. Select scopes.At least one is required. Restore-only clients normally need only read; a release client commonly needs push and push symbols.
4. Set expiry.Enter 1-8,760 hours (up to 365 days) in the current creation form.
5. Copy and store the token.Put it directly into the intended credential store or CI secret, then close the show-once view.

Connect the dotnet CLI.

Use the exact service-index URL from the feed page. NuGet accepts a non-secret username; Mozaic authenticates the password value.

dotnet nuget add source "https://<app-host>/nuget/<feed-id>/v3/index.json" \
  --name mozaic \
  --username token \
  --password "<show-once-mznuget-token>" \
  --store-password-in-clear-text

dotnet nuget list source

The clear-text flag is needed on clients without a supported encrypted NuGet credential store. It writes the token to the user's NuGet configuration, so protect that file with operating-system permissions and never add it to the repository. Prefer an environment-provided temporary NuGet configuration in automation.

dotnet nuget add source "https://<app-host>/nuget/<feed-id>/v3/index.json" \
  --name mozaic-public

Use the feed without changing project-wide sources.

dotnet package search Contoso.Widget --source mozaic --exact-match

dotnet add src/MyApp/MyApp.csproj package Contoso.Widget \
  --version 1.2.3 \
  --source mozaic

dotnet restore MySolution.slnx --source mozaic

Search and version discovery return listed, explicitly published, non-quarantined versions. If the feed allows unlisted restore, a client requesting an exact unlisted version can still restore it; broad search and version enumeration will not rediscover it.

For repeatable builds, commit package references and a lock file, but not credentials. Keep the source URL in NuGet.config only if it is safe for every repository reader to know; put authentication in a user or build-time configuration.

Push packages and symbols deliberately.

dotnet pack src/Contoso.Widget/Contoso.Widget.csproj \
  --configuration Release \
  --output ./artifacts/packages \
  -p:IncludeSymbols=true \
  -p:SymbolPackageFormat=snupkg

dotnet nuget push "./artifacts/packages/Contoso.Widget.1.2.3.nupkg" \
  --source "https://<app-host>/nuget/<feed-id>/v3/index.json" \
  --api-key "<push-token>" \
  --symbol-api-key "<push-token>"

1. Inspect the package locally.Confirm ID, version, dependency ranges, license metadata, and intended files before uploading immutable release coordinates.
2. Use a matching token.The normalized package ID must match its exact or trailing-wildcard pattern. Primary and symbol uploads require their corresponding scopes.
3. Push the primary package.Mozaic validates the NuGet archive, computes hashes and signature evidence, and records publisher provenance.
4. Confirm the version page.Check package hash, signature result, listed state, and provenance rather than relying only on a successful CLI exit.

Publish exact build artifacts with provenance.

A pipeline artifact declaration retains files but does not publish them. Add a terminal publish_in_feed step to the job that produced the packages. Identify exactly one feed by ID or slug and use bounded paths that match only .nupkg or .snupkg entries.

      - name: Publish packages
        publish_in_feed:
          feed:
            slug: releases
          paths:
            - artifacts/packages/*.nupkg
            - artifacts/packages/*.snupkg
          allow_untrusted: false

The publication record links the package to the run, attempt, artifact entry, repository revision, plan hash, and—when applicable—pull request snapshot, check, merge operation, and related work. The provenance also records whether the execution was trusted.

Prefer reversible release controls.

Deprecate

Add a reason and message while leaving the version restorable.

Unlist

Remove the version from search and version discovery. Exact restore remains possible only when the feed explicitly allows unlisted restore.

Relist

Return a previously unlisted, available version to normal discovery.

Purge

Permanently remove package and symbol bytes while retaining a tombstone so the coordinate and audit history are not silently reused.

Unlist with the NuGet client

dotnet nuget delete Contoso.Widget 1.2.3 \
  --source "https://<app-host>/nuget/<feed-id>/v3/index.json" \
  --api-key "<lifecycle-token>"

NuGet delete maps to unlisting, not byte deletion. To deprecate, relist, or purge, use the version lifecycle controls in Mozaic. Purge requires fresh authentication, an audit reason, and the exact normalized confirmation package-id@version.

A deprecation reason contains 1-120 characters; its message is limited to 2,048 characters. Purge is not an escape hatch for replacing an incorrectly published version—publish a corrected version whenever possible.

Make external reads explicit.

Understand public-feed gates and the current UI boundary

An existing feed is anonymously readable only when its visibility is Public, it has been explicitly published, and both its organization and project are publicly available. Setting one child resource to Public never overrides a private parent. The current project feed settings list each feed's visibility and unlisted-restore policy, but do not provide a feed publication editor; new feeds are always private. Treat the inventory as evidence, not as a publication workflow.

Configure an upstream

1. Add an HTTPS flat-container source.Mozaic accepts public DNS destinations and rejects unsafe loopback, private-network, or credential-bearing URLs.
2. Constrain the package pattern.Route an exact ID or one trailing-wildcard prefix instead of mirroring every request by default.
3. Set priority and enabled state.Priority controls selection where more than one mapping applies.
4. Choose cache-on-error behavior.Serving an already verified cache entry during an upstream error improves availability but can intentionally return older upstream bytes.

Fetched bytes are hashed and cached. If an upstream later returns different bytes for the same package coordinate, Mozaic quarantines the changed result instead of silently replacing trusted cached content.

Design releases inside the registry envelope.

• Never put a feed token in source, command output, pipeline logs, package metadata, or a committed NuGet.config.
• Give restore, publication, and lifecycle automation separate tokens so compromise or rotation has a narrow effect.
• Use exact or team-prefix package patterns; reserve * for deliberately feed-wide clients.
• Inspect SHA-256, NuGet SHA-512, signature evidence, provenance, and quarantine state when validating a release.

Resolve common package failures.