Fewer keys under the doormat: why trusted publishing matters for Open VSX

Fewer keys under the doormat: why trusted publishing matters for Open VSX Every software registry eventually learns the same lesson: the most valuable thing in a publishing pipeline is not the code. It is the credential that lets someone ship it. For most of its history, publishing an extension to the Open VSX Registry from CI has meant creating a personal access token and storing it as a secret in a pipeline.