TLDR Tech / Practical
Package Registries: Trusted Publishing Without API Keys
This analysis compares six distinct package registries—RubyGems.org, NuGet.org, crates.io, pub.dev, JSR, and Open VSX—focusing on their methods for secure publishing that avoid the use of persistent API keys. The author investigates whether these registries utilize CI-issued OIDC ID tokens to obtain temporary credentials or employ them directly, how they verify the identity of trusted entities, and what specific triggers or settings they refuse.
Read the full story