[mikey_p]

The longer I go the more I have actually come to appreciate the way Packagist works for the PHP community, there are lots of cool things it does that I wish NPM or other registries did by default, like forcing you to package from a source repository, so that you can't upload a different artifact from what you keep in source control.

[kelnos]

I'm not sure that really gives you the guarantees you think it does, though.

For example, I could push some malicious code, tag it, wait for Packagist to finish pulling it to publish a package, and then amend history to remove the malicious code, rewrite the git-tag, and force-push both to the git server.

This scheme makes it hard/impossible to push mismatching code by accident, but doesn't do much to stop a malicious actor.

[estebank]

This kind of thing is one of the reasons crates.io distributes source only, and that published crate dependencies can't depend on other repositories (that might allow for that attack).

[ecshafer]

How does a close source package work? Depending on the language its not super helpful, but a package that is closed source should be possible.

[hmry]

For crates.io: They don't allow closed-source packages. But they're just the free community package index, you're not forced to use them.

You can:

- host a private index

- host the proprietary binaries in a git repo and use a git dependency

- commit the proprietary binaries into your source repo, and use a path dependency

[steveklabnik]

crates.io also only distributes source code.