What Role Do Package Registries Have in Securing the Supply Chain?
summary
GitHub proposes five draft principles that push registries to build concrete tooling and processes: prioritize trust-first registries, map exact roles for registry/maintainer/user with clear roles and appeals, and add proactive malware detection plus vulnerability prompts so downloads show known-risk warnings. Registries keep historical packages for research but block active malware, share telemetry (download counts, affected versions) with maintainers, and treat public registries like common carriers while allowing stricter corporate registries and consent-driven defaults.
AI-written summary · about
chapters (15)
- 0:00Supply chain security intro
- 1:54Package registry challenges
- 5:25Code at rest vs in flight
- 8:57Malware vs vulnerabilities
- 13:14Five registry principles
- 16:43Workshopping principles
- 21:18Santa Clara principles
- 27:05Known vulnerabilities
- 28:09Registries as intermediaries
- 31:56Public vs corporate registries
- 34:23Transparency and rights
- 35:37Registry business models
- 37:23Community vs corporate policies
- 38:46Global regulations
- 40:10Security as priority
related talks
45mPractical Software Supply Chain Security Solutions
18mExploring a Risk Approach to Software Supply Chain Security
19mSecuring Packages in npm, Homebrew, PyPI, Maven Central, and...
01h 01mWorms in our software supply chain - Where do we go from here?
23mMastering Secure Software Supply Chains
30mSecuring Open Source Supply Chains
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
15mSupply chain security for dummies