I work on a package manager and there are two main philosophies here. 1. Trust but verify - Assumes that some packages are inherently trustworthy and can be re

I work on a package manager and there are two main philosophies here. 1. Trust but verify - Assumes that some packages are inherently trustworthy and can be relied upon. This is where we are today. 2. Zero trust - Assumes you should not automatically trust anything, even if it appears to come from a trusted source. This is where it seems we're headed. For OSS/central registries, #1 is followed. For internal registries, #2 is followed. At least where the industry is headed towards are constant gates of "verification" following the #2 model. Think of the following: 1. Code signing 2. Reproducibility / Integrity 3. Verified sources 4. Least privilege 5. Monitoring tooling 6. 2FA 7. Vulnerability scanning 8. Allowlisting etc But are all those even practical for maintaining the ethos of open source? We'll find out. https://opensource.org/osd/ https://opensource.org/osd/