Featured article
Modern Software Registries are a Trust Service
A modern software registry is increasingly a trust service. Public registries like npm and PyPI provide identity, provenance, discovery, policy, short-lived signing, and reputation. They were built as open catalogs: anyone can publish, names are first come first served, and trust is something the consumer infers after...
