Conversation
Adding docs for upstream trust
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
Pull request overview
Adds new documentation describing Cloudsmith’s “Upstream Trust” supply chain security feature, including how trust affects dependency resolution and how to configure trust status on upstreams.
Changes:
- Introduces a new “Upstream Trust” documentation page explaining trust evaluation and key behaviors (including cached/proxied package nuances).
- Adds multiple example scenarios showing how trusted/untrusted sources affect resolved versions.
- Documents configuration steps and clarifies package identity matching rules (scopes/qualifiers).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
| import { Note } from '@/components' | ||
|
|
||
| # Upstream Trust | ||
| Upstream trust is a supply chain security feature that protects your repositories from dependency confusion and namesquatting attacks. By designating upstream sources as trusted or untrusted, you control which sources are permitted to serve versions of packages that exist in your private repository or other trusted sources. |
There was a problem hiding this comment.
The way this reads right now, it implies Upstream Trust protects from both dependency confusion and namesquatting, but I believe it's just namesquatting, a subset of dependency confusion. Suggestion to edit to:
Upstream trust is a supply chain security feature that prevents namesquatting attacks where bad actors hijack your internal package name in public repositories.
Adding content around upstream trust