Add "dotnet nuget install" command

[akoeplinger]

NuGet Product(s) Involved

dotnet.exe

The Elevator Pitch

Related to #4855

We had multiple internal teams at MSFT who are doing a migration to Mariner reach out to us when moving from Mono's nuget(which is just the nuget.exe CLI) to the dotnet CLI and one common pain point was the missing support for the install command.

Most of these teams are not even using .NET but have some tool which is hosted on an internal AzDO feed and they were using nuget install <tool> e.g. from CMake to grab the assets. Right now you need to create a dummy .csproj like this so you can run dotnet restore on it which makes this a lot more complicated:

<Project Sdk="Microsoft.NET.Sdk">

<PropertyGroup>
   <OutputType>Exe</OutputType>
   <TargetFramework>net6.0</TargetFramework>
   <RestorePackagesPath>packages</RestorePackagesPath>
</PropertyGroup>

<ItemGroup>
  <PackageDownload Include="Some.Internal.Tool" Version="[7.0.7]" />
</ItemGroup>

</Project>

It'd be great if we could get dotnet nuget install supported in the future 😄

Additional Context and Details

No response

Please 👍 or 👎 this comment to help us with the direction of this feature & leave as much feedback/questions/concerns as you'd like on this issue itself and we will get back to you shortly.

[JonDouglas]

Adding a quick comment here.

We've had a number of requests for this specific feature. Basically the concept is to acquire a NuGet package without a .csproj and without being so tied down to a project system to get an asset to disk.

We want to continue to collect upvotes and scenarios for this experience, so I've edited the description to help us do so.

Some of the additional scenarios we have heard regarding this are:

1. Wanting to download a NuGet package to run security health checks with (See https://github.com/ossf/scorecard)
2. Wanting to download a NuGet package without a dummy .csproj / project system attachment.
3. Wanting to download a NuGet package as the equivalent of NuGet.org's raw nupkg download (i.e. Download package)
4. Wanting to download a NuGet package without any client or server-side validation performed.
5. Wanting to download a NuGet package similar to nuget.exe install <packageid> -OutputDirectory <directory>, npm install <package id> --prefix <prefix>, pip install <package id> --target <target>, etc.

Please feel free to share your scenarios if you're reading this comment!

Also related to #6849

[vlm---]

Ours is scenario no. 3: pure downloading of newest packages by name to populate a feed in an offline environment.

[deitry]

Ours is no.5. We use GitHub NuGet private registry for binaries distribution, and specifically we have to download packages and extract binaries for Unity project. Sadly, Unity can not handle it by internal package management system, neither does NuGetForUnity.

[616b2f]

Ours is 5: download and extract binaries from nuget package to a local folder.

[mzorzella-simeon]

+1 Ours is 5: download and extract binaries from nuget package to a local folder.

[marcopelegrini]

+1 to embed a cross platform cli to a nodejs application

[snnn]

Our team uses nuget.org to distribute native DLLs(and *.so/dylibs) for different platforms. From security and compliance perspective, it is the best way of doing this as NuGet is a standard package manager and it has excellent codesign verification mechanism. It helps protect our supply chain. On the other hand, I see some big companies use PyPI to distribute their native DLLs but python packages today still do not support any of kind of codesign. NuGet is better and more secure. I hope it also could be easier to use.

[natke]

+1