We'd like to enable Packages.Config scenarios to track and enforce SHA.

For PackageReference users, project lock file will enable SHA enforcement.
We are exploring either:

1. adding SHA as a new Attribute of the Package element in Packages.Config
2. adding lock file to Packages.Config scenarios.

@zivkan

spec: https://github.com/NuGet/Home/wiki/Packages.config-SHA-Validation

Tasks:

• Create/update lock file on package install and uninstall Create and update lock file for packages.config projects on package install and uninstall #7951
• Update lock file on restore when lock file out-of-sync with project packages.config sha enforcement - regenerate lock file when needed #8035
• Validate SHA on restore packages.config sha enforcement - validate sha #8036
• Add nuget.exe command line parameters for lock file features Add nuget.exe command line parameters for lock file features #8038