5 ms·
Without identity federation via oidc it’s basically not really a replacement for verdaccio
by merb 1mo ago
Without identity federation via oidc it’s basically not really a replacement for verdaccio
- clarke78 1mo agoThis is coming imminently but appreciate the feedback & will push to get this landed here quickly. That said, our client does support OIDC publishing if your registry does so hopefully you'll still find value there as it's a major step up from legacy npm clients.
- merb 1mo agoA little late reply: Preferably I do not use a client on my machine to publish a package. That’s what I meant, modern registries should always support working with oidc providers to support publishing credentials from ci/cd systems. Sometimes called trusted publishing: https://repos.openssf.org/trusted-publishers-for-all-package-repositories https://repos.openssf.org/trusted-publishers-for-all-package...