#NuGet Configuration

nuget:
  enabled: true
  repository:
    - name: nuget
      registry: https://api.nuget.org
      scan-manifest: true
      scan-package: true
      work-mode: strict_wait

Add a package source:

dotnet nuget add source https://osa-proxy.example.com/nuget/nuget-api/v3/index.json --name osa-proxy
dotnet restore --source https://osa-proxy.example.com/nuget/nuget-api/v3/index.json

Equivalent NuGet.Config:

<configuration>
  <packageSources>
    <clear />
    <add key="osa-proxy" value="https://osa-proxy.example.com/nuget/nuget-api/v3/index.json" />
  </packageSources>
</configuration>

To download a package with dotnet package download in .NET SDK 10, use the same NuGet.Config:

dotnet package download AutoMapper@16.1.1 \
  --configfile NuGet.Config --output ./packages

#Registration metadata filtering

With scan-manifest: true, OSA Proxy checks versions in registration metadata. The default is remove-blocked-versions: true: blocked versions are removed from the response.

If all versions on an individual registration page are blocked, OSA Proxy returns HTTP 200 with items: [] and count: 0, preserving the original lower and upper bounds. This lets dotnet package download continue searching subsequent pages for an allowed version instead of failing on a blocked page.

With remove-blocked-versions: false, versions remain in metadata as delisted with a deprecation message naming the blocking policy. The manifest is returned even when all versions are blocked. With scan-package enabled, directly downloading a blocked .nupkg remains forbidden.