NuGet secondary-source fallback and checksum verification alignment

NuGet's package restore mechanism downloads missing dependencies from configured sources and populates the packages directory. When a primary source becomes unavailable, the restore process can fall back to secondary sources defined in NuGet.Config. Restored packages are verified by checksum comparison against package metadata. This fallback and verification behavior is documented across NuGet 5.0+ releases and standard .NET project workflows. However, the documented fallback behavior does not explicitly address how checksum validation is performed when the same package version is accessible across multiple sources with potentially differing metadata states. This raises a design question about the consistency of verification outcomes during source fallback.

• Does NuGet prioritize the first matching checksum from the secondary source, or does it aggregate checksums from all available sources?
• If a package is cached locally from a prior primary-source restore, how does verification behave when a subsequent fallback to a secondary source occurs?
• What role does the local packages folder checksum file play in resolving mismatches between source metadata and cached verification data?