Pull NuGet from Nuget.org or from our own Nuget Server?

Question

We are running a TeamCity Continuous Integration System which has its own built-in NuGet server.

We have our own proprietary NuGet packages being published to there. One of those NuGet packages we created is a NuGet that contains all of our third-party DLLs.

Some of these third-party DLLs are available via https://www.nuget.org/.

In terms of architectural decisions, what would be a better solution?

1. Take out all the third-party DLLs that are currently available from our own ThirdParty Nuget, thus we now pull the DLLs from Nugets hosted at nuget.org during the building of our product.

2. Keep the our current Third-Party NuGet we we created, which means we know exactly what DLLs are going in our product.

Answer 1

We implemented the second option for our products with a slight difference: There is a separate NuGet packages for each third-party library which we use.

The reasons for this are:

• We can independently put a new version of a third-party library to our company's NuGet server. Hence, different products can pull different combinations of third-party library.
• There is no need to redeploy one large package for every change of a third-party library. This saves disk space on the server which may become an issue for extensive sets of third-party libraries.

The reason for which we don't use nuget.org is also two-fold:

• First, it's performance: Pulling from the local server over Ethernet is significantly faster than pulling over the internet.
• Second (and more important), it's safety: We can never control who is uploading what package to nuget.org. Hence, someone could exchange a package with a malicious version and we would deploy this with our product.