“作者”可以吗？ Nuget上的字段被欺骗了？我可以相信该文件的真实性吗？
我正在浏览某位作者的 Nuget 库，并看到有问题的内容……这些内容与我之前见过的一些作品的质量不一样。
我如何知道 Nuget 包的作者确实是那个人？
我可以将这种信任扩展到 Nuget 的内置更新过程吗？
I'm browsing Nuget libraries from an author and see questionable content.. something that doesn't have the same quality as some of the prior work I've seen.
How do I know that the author of a Nuget package is really that person?
Can I extend that trust into the built-in update process of Nuget?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
“作者”只是 .nuspec 文件中包含的元数据。请参阅（http://docs.nuget.org/docs/reference/nuspec-reference）。这可能与包所有者/创建者不同。
在 NuGet 刚刚起步时，有一些人正在为他们没有编写的项目创建包，主要是为了在存储库中获取包。
现在 NuGet 已经更加成熟，建议人们联系项目所有者并让他们创建自己的 NuGet 包。
对于已经由作者以外的其他人上传到存储库的包，作者可以请求将所有权转移给他们。
由于无法保证包创建者是原始作者，因此我不确定这如何影响信任。但是，如果您安装了一个软件包，那么可以肯定地说，更新要么来自创建初始软件包的同一个人，要么可能已转移给项目的实际作者。
换句话说，信任度可能与您安装的原始软件包相同或更好（如果是实际作者），但很少会差。
希望有帮助。
The "author" is simply metadata that is included in the .nuspec file. See (http://docs.nuget.org/docs/reference/nuspec-reference). This can be different than the package owner/creator.
In the beginning when NuGet was starting out, there were a few people that were creating packages for projects that they didn't author mainly to get the package in the repository.
Now that NuGet is more established, it is recommended that people contact the project owner and have them create their own NuGet package.
For packages that have already been uploaded to the repository by someone other than the author, the author can request to have the ownership transferred to them.
Since there's no guarantee that the package creator is the original author, I'm not sure how that affects trust. However, if you install a package, it is pretty safe to say that updates will either be from the same person that created the initial package, or potentially it will have transferred to the actual author of the project.
In other words, trust will likely be the same or perhaps better (if actual author), but seldom worse than the original package you installed.
Hope that helps.
我知道这是一个相当老的问题，但这是我找到的最佳答案。我想将 0.02 美元添加到收银台中。我在 nuget.org 上有几个基于另一个包的包。 Unity.Mvc3.VB，Unity.Mvc3.DLL，我正在开发 Unity.Mvc4.VB 包。它们都基于 Unity.Mvc3 来自 devtrends。 DLL项目基本上只是安装了Unity.Mvc3的程序集引用，没有c#源代码文件，这样在其他语言的项目中使用起来更容易一些。 VB 包包括 C# 源文件的 VB.Net 版本。由于我除了DLL包中的nuspec文件之外没有写任何东西，所以我只列出了 Paul Hiles 作为作者，我作为包所有者。
对于 VB 包，我再次被列为所有者，但对于作者，我列出了 Paul 和我自己，并在括号中列出了我们的每个贡献，如下所示：
这个想法是我将功劳归功于我的衍生作品的原作者。
I know this is a fairly old question, but this is the best answer I've found. I'd like to add my $.02 to the till. I've got a couple of packages on nuget.org that are based on another package. Unity.Mvc3.VB, Unity.Mvc3.DLL, and I'm working on a Unity.Mvc4.VB package. They're all based on Unity.Mvc3 from devtrends. The DLL project basically just installs the assembly reference for Unity.Mvc3 without the c# source code files so that it's a little easier to use in projects of other languages. The VB package(s) include VB.Net versions of the C# source files. Since I didn't write anything other than the nuspec file in the DLL package, I just listed Paul Hiles as the author and myself as the package owner.
For the VB package(s), again I'm listed as the owner, but for the author I list Paul and myself with each of our contributions in parenthesis like so:
The idea is that I'm giving credit to the original author of my derivative work.
基利曼的回答是正确且全面的。我想补充一点，社区应该开始在 NuGet Gallery 中撰写 nuget 包的评论。评论很少且相差很远，并且它们有一个星级评级系统，因此如果您认为某个包没有用，或者您对某个特定包有疑虑，请将它们写在那里并帮助您的程序员同事。
Kiliman's answer is correct and comprehensive. I would like to add that it is up to the community to start writing reviews of nuget packages in the NuGet Gallery. Reviews are very few and far between and they have a star-rating system, so if you don't think a package is useful, or if you have concerns about a particular package, write them there and help your fellow programmers.