Package security settings

Package security settings lets you define a project-level security policy that determines which packages Unity accepts, based on each package’s signature status and signing organization. Rather than applying a fixed rule, it gives you and your team the control to set a threshold you’re comfortable with. Choose a strict policy for trusted sources only, or a permissive policy, or something in between.

Unity evaluates packages against your security threshold when any project contributor tries to install, update, remove, or reset a package. The result is a consistent experience for members of the same organizations who work together in the project. Packages that meet your threshold install without interruption, while those that don’t trigger a clear message explaining what happened and why.

Package security settings uses three pieces of signature data to evaluate each package:

• Signature status: Whether a package has a valid signature, an invalid signature, or no signature.
• Signing organization: The organization that signed the package.
• Package source: Where the package comes from, such as the Unity registry, a scoped registry, or the Asset Store.

Benefits of package security settings

Package security settings provides the following benefits:

• Creates a consistent package security policy that applies to contributors from the same organizations who bring UPM packages into the project from a registry, Asset Store, or distributed as tarball.
• Automatically allows, warns about, or blocks packages based on their signature status and source.
• Lets you maintain a project as safe as you need it to be, based on the threshold you choose.

Security threshold levels

Package security settings provides three threshold levels. Choose the one that matches your project’s needs.

Accept packages from Unity, Asset Store, or my organizations

This is the most restrictive threshold and the default. Package Manager accepts packages signed by Unity, distributed through the Asset Store, or signed by your own Unity organization. Package Manager blocks packages outside these sources, and a dialog window with an OK button explains the denial.

Use this threshold for production projects or any project where you need strict control over packages.

The following table shows how this threshold affects specific installation scenarios.

Accept all signed packages

Package Manager accepts any package with a valid signature, regardless of which organization signed it. If a package has a valid signature from an organization outside your own, Package Manager displays a warning and gives you the option to select Install Anyway to proceed. Package Manager blocks packages with an invalid or missing signature.

Use this threshold if your project relies on packages from a range of trusted external publishers.

The following table shows how this threshold affects specific installation scenarios.

Accept any package

This is the most permissive threshold. Package Manager accepts packages regardless of their signature status. Package Manager still displays a warning for packages signed outside your organization, or packages with invalid or missing signatures, and you can select Install Anyway to proceed.

Use this threshold for prototyping or research projects where you want to evaluate packages with the fewest restrictions.

The following table shows how this threshold affects specific installation scenarios.

Packages subject to package security settings

Package security settings applies when you install packages from the following sources:

• A Unity registry or scoped registry.
• A local tarball, using Add > Install package from tarball.
• A package technical name, using Add > Install package by name.

Plan and commit to your threshold policy

Package security settings is most effective when you consciously choose a threshold before you start working with packages and maintain the threshold consistently throughout the project. Because the setting applies to all contributors, frequent or unplanned threshold changes undermine the consistent policy that the setting is designed to establish.

Consider the types of packages your project needs and where they come from. After you set a threshold, treat any subsequent change as a deliberate decision rather than a routine adjustment.

Set the security threshold

Set your preferred security threshold in Project SettingsA broad collection of settings which allow you to configure how Physics, Audio, Networking, Graphics, Input and many other areas of your project behave. More info
See in Glossary.

Tighten your security threshold

If you change to a stricter threshold, Unity doesn’t uninstall packages that are already in your project. Packages that no longer meet the new threshold remain in the project, but Unity lists them in the Errors and Warnings view of the Package Manager window. Review those packages to decide whether to remove them manually.

Additional resources

• Introduction to package signatures
• Package signatures