3 ms·
As I recall it's mandatory. I can see the package indexes becoming much more involved in supply chain issues. A bit like the app stores, where a considerable a
by tlocke 4y ago
As I recall it's mandatory.
I can see the package indexes becoming much more involved in supply chain issues. A bit like the app stores, where a considerable amount of vetting goes on.
- senko 4y agoThat's an interesting idea! A "vetted" package index that charges subscription and splits the revenue with package maintainers. In return, maintainers agree to jump through all the extra hoops and index maintainers do extra verification (but still no warranty except that the standard procedure is followed). The same package can then be uploaded to the normal index (as it is now), but without these extra steps, and no vetting.