Secure nuget packages to require signatures by known parties

Author: AArnott

azure-pipelines/official.yml

@@ -29,6 +29,9 @@ parameters:
   type: boolean
   default: false
 
+variables:
+  NugetSecurityAnalysisWarningLevel: none # nuget.config requires signed packages by trusted owners
+
 stages:
 
 - stage: Build

nuget.config

@@ -2,12 +2,23 @@
 <configuration>
   <config>
     <add key="repositorypath" value="packages" />
+    <add key="signatureValidationMode" value="require" />
   </config>
   <packageSources>
     <clear />
-    <add key="api.nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />
-    <add key="vs-impl-public" value="https://pkgs.dev.azure.com/azure-public/vside/_packaging/vs-impl/nuget/v3/index.json" protocolVersion="3" />
-    <add key="vssdk-public" value="https://pkgs.dev.azure.com/azure-public/vside/_packaging/vssdk/nuget/v3/index.json" protocolVersion="3" />
+    <add key="nuget" value="https://api.nuget.org/v3/index.json" />
+    <add key="vs-impl-public" value="https://pkgs.dev.azure.com/azure-public/vside/_packaging/vs-impl/nuget/v3/index.json" />
+    <add key="vssdk-public" value="https://pkgs.dev.azure.com/azure-public/vside/_packaging/vssdk/nuget/v3/index.json" />
     <add key="dotnet-tools" value="https://pkgs.dev.azure.com/dnceng/public/_packaging/dotnet-tools/nuget/v3/index.json" />
   </packageSources>
+  <trustedSigners>
+    <repository name="nuget" serviceIndex="https://api.nuget.org/v3/index.json">
+      <owners>Microsoft;xunit;manuel.roemer;sharwell;jamesnk;aarnott;MarcoRossignoli;Thecentury;clairernovotny;reg;mmanela</owners>
+      <certificate fingerprint="0e5f38f57dc1bcc806d8494f4f90fbcedd988b46760709cbeec6f4219aa6157d" hashAlgorithm="SHA256" allowUntrustedRoot="false" />
+    </repository>
+    <author name="Microsoft">
+      <certificate fingerprint="aa12da22a49bce7d5c1ae64cc1f3d892f150da76140f210abd2cbffca2c18a27" hashAlgorithm="SHA256" allowUntrustedRoot="false" />
+      <certificate fingerprint="3f9001ea83c560d712c24cf213c3d312cb3bff51ee89435d3430bd06b5d0eece" hashAlgorithm="SHA256" allowUntrustedRoot="false" />
+    </author>
+  </trustedSigners>
 </configuration>