rorixrorix
sign in →

Trusted NuGet Registry

Private preview: the registry is enabled only for enrolled organizations. Do not configure it as an exclusive production package source until the production canary and launch checklist are green.

Rorix Registry is a provenance-enforcing NuGet gateway. It rebuilds a package when Rorix can resolve defensible source evidence and falls back to the exact upstream package bytes when a source build is not possible. Every path is labeled; a mirror is never presented as a rebuild.

The registry is fail closed: only package versions in the published state are visible to NuGet clients. Quarantined, failed, queued, and dependency-blocked versions cannot be restored.

Configure a client

Create an API key with the registry.read scope, expose it to the restore process as RORIX_NUGET_API_KEY, and use the generated nuget.config from Registry → Setup. The gateway accepts the NuGet client's Basic credentials as well as Authorization: Bearer rxk_...; the API key may be supplied as either the Basic username or password.

For a local developer configuration, the equivalent CLI command is:

dotnet nuget add source "https://registry.rorix.io/v3/index.json" \
  --name rorix \
  --username rorix \
  --password "$RORIX_NUGET_API_KEY" \
  --store-password-in-clear-text

Prefer environment-backed configuration in CI and avoid committing an API key to source control.

Provenance levels

From strongest to weakest:

| Level | Meaning | | --- | --- | | Reproduced source | An exact commit was rebuilt and its normalized package contents and assemblies matched upstream. | | Pinned source | An exact commit was rebuilt in an isolated environment, but the output differs from upstream. | | Inferred source | An immutable commit behind an exact version-tag heuristic was rebuilt. | | Upstream signed | Rorix preserved the exact upstream nupkg bytes after NuGet signature verification. | | Digest only | Rorix preserved unsigned upstream bytes with a pinned SHA-256 digest. This always requires a version-specific provenance override. |

Each organization selects a minimum provenance level in Settings → Registry. A version below that threshold is quarantined. Changing the threshold does not erase previous decisions or evidence.

Packages without a repository commit

A missing nuspec repository.commit value is a normal state, not an automatic failure. An approved package-version mapping takes precedence so a reviewer can correct stale or moved upstream metadata. Without an approved mapping, Rorix resolves evidence in this order:

  1. nuspec repository URL and commit attributes, parsed as XML
  2. Source Link mappings found in portable PDBs
  3. commit IDs in assembly informational versions
  4. exact release and version tag candidates resolved to immutable Git commits
  5. output comparison after building a candidate
  6. an authenticated upstream-binary fallback when source evidence or the source build fails

Reviewed mappings require a full immutable Git commit, a repository allowed by source policy, and review notes. Superseded mapping rows are retained as history.

Reviewed build recipes and private source

A reviewed mapping can carry a versioned build recipe. The current recipe pins the exact relative .csproj, the exact .NET SDK, and whether publication requires reproduced-source. If the project path is absent, the SDK cannot be installed, the commit differs, or the rebuilt output does not reproduce, the package is quarantined instead of silently entering a lower provenance tier.

Selected private GitHub repositories are accessed through a dedicated GitHub App installed only on an explicit repository allowlist with Contents: read and Metadata: read. Rorix exchanges the App identity for a short-lived, single-repository installation token. The token is used only for source checkout and read-only GitHub archive requests; it is never placed in the repository process environment and is not available during restore or build.

Dependency boundary

Reproduced source describes the selected package artifact, not an unsupported claim that the entire .NET toolchain and dependency graph were bootstrapped from source. During the networked restore stage, NuGet resolves exact dependency versions from approved upstream endpoints. Pack then runs with deny-all egress. Rorix records the resolved graph, classifies runtime versus build-only dependencies, analyzes each package, and blocks publication until every blocking dependency has its own acceptable publication decision.

This gives two honest operating tiers:

  • Verified upstream: preserve signed upstream bytes, analyze them, pin their digest, and enforce policy at restore time.
  • Rorix rebuilt: use a reviewed recipe and immutable source commit, then publish only when reproduction and policy gates pass.

Uncurated transitive dependencies take the verified-upstream tier directly instead of spending customer onboarding time on an unreviewed generic source-build attempt. A transitive dependency is rebuilt only when it has its own reviewed source mapping. Rorix never labels verified-upstream dependencies as source rebuilt. A future closed-world mode may compile a root exclusively against Rorix-built dependencies, but that stronger property requires a curated bootstrap set and separate evidence.

Publication gates

Provenance is necessary but not sufficient. Rorix also quarantines versions with:

  • typosquat findings
  • denied-license findings
  • high or critical vulnerabilities
  • provenance below the organization minimum
  • unsigned digest-only provenance without a version-specific override

An organization administrator can record a provenance or security exception for one package version. The rationale and reviewer are retained, the original findings remain visible, and verification is re-run before publication.

Existing NuGet lock files

Upstream-signed and digest-only mirrors preserve the exact upstream nupkg bytes, so existing NuGet content hashes remain valid. Source-built packages can have a different package hash, even when normalized contents reproduce successfully. This can surface as NU1403 when an existing packages.lock.json still contains the upstream content hash.

Perform a reviewed one-time lock migration when moving a project to source-built packages:

dotnet restore --force-evaluate
# Review and commit packages.lock.json
dotnet restore --locked-mode

Do not silently delete lock files or disable locked mode permanently. Review the changed source and content hashes, commit the new lock file, and keep --locked-mode in CI.

Beta operating boundary

The controlled beta supports NuGet packages and Git repositories on configured source hosts. Build isolation, source-owner allowlists, private-source GitHub App access, artifact storage, signing keys, workflow secrets, the restore canary, and the source-rebuild canary must be configured before use. Rorix emits its own signed verification artifacts; the beta does not claim a public Sigstore transparency-log identity unless that integration is separately configured and verified.

Dashboard GuideCLI