Hacker News Reader

Comment by mikey_p | Hacker News Reader

The longer I go the more I have actually come to appreciate the way Packagist works for the PHP community, there are lots of cool things it does that I wish NPM or other registries did by default, like forcing you to package from a source repository, so that you can't upload a different artifact from what you keep in source control.

View on HN

I'm not sure that really gives you the guarantees you think it does, though.

For example, I could push some malicious code, tag it, wait for Packagist to finish pulling it to publish a package, and then amend history to remove the malicious code, rewrite the git-tag, and force-push both to the git server.

This scheme makes it hard/impossible to push mismatching code by accident, but doesn't do much to stop a malicious actor.

This kind of thing is one of the reasons crates.io distributes source only, and that published crate dependencies can't depend on other repositories (that might allow for that attack).

How does a close source package work? Depending on the language its not super helpful, but a package that is closed source should be possible.

For crates.io: They don't allow closed-source packages. But they're just the free community package index, you're not forced to use them.

You can:

- host a private index

- host the proprietary binaries in a git repo and use a git dependency

- commit the proprietary binaries into your source repo, and use a path dependency

crates.io also only distributes source code.

Reply on news.ycombinator.com