Not sure if this fits in here exactly, but it seems close enough: There is a bunch of “official” or at least “official looking” (???) GitHub organizations in the Julia ecosystem. Some I am aware of: The Julia Programming Language · GitHub Julia Registries · GitHub https://github.com/JuliaBinaryWra…

As you point out in your post, anyone could create a GitHub organization with “Julia” and the name and host repositories that contain popular Julia packages with malicious code inserted. As a general rule, there is nothing “official” about a GitHub organization that has “Julia” in the name. You ar…

Currently, GitHub really only offers one method of verifying the ownership of a GitHub organization: domain verification. It would be great if all Julia-related organizations could verify at least one domain name.

[image] fingolfin: Some of them specify https://julialang.org/ as their homepage. For what it is worth, specifying https://julialang.org/ as your homepage doesn’t really mean anything. Anyone can put any URL as the homepage of their GitHub organization without any verification. Now if you ha…

[image] dilumaluthge: Just FYI: for people that are interested in this topic: we have a Slack channel #pkg-trust for chatting about this kind of stuff. Of course that is really only good for informal conversation, since the Slack message history quickly disappears. Longer more substantive conver…

[image] ericphanson: Maybe one thing to add is that GitHub workflows are not incompatible with a somewhat secure chain of code, because you can see all the steps in your workflow and lock down the versions of each bit of code called. (You are still trusting GitHub to actually execute the workflo…

Sure, I’ll make a PR. Maybe we can set up an example repo showing how to use a manifest too, or just describe it in more detail.

[image] dilumaluthge: For what it is worth, specifying https://julialang.org/ as your homepage doesn’t really mean anything. Anyone can put any URL as the homepage of their GitHub organization without any verification. Just to clarify, I am fully aware of that; I actually meant to write that …

[image] fingolfin: But this is rather fragile. A somewhat related discussion is [image] Pkg: attack vectors Internals & Design Pkg ecosystem: Learning from other's mistakes has gotten a bit long and wandering, as these discussions tend to. I’d like to have a very f…

Plethora of Julia related GitHub organizations and how to know which of them are "official"

Community

Tamas_Papp April 29, 2020, 6:31am 9

A somewhat related discussion is

Topic		Replies	Views
Julia packages organizations question New to Julia packages	7	567	April 4, 2023
Julia Orgs, How Do You Manage Logistics? Community question , community	14	1549	December 13, 2023
How can we create a leaner ecosystem for Julia? Statistics package , proposal , time-series , machine-learning	101	10833	October 15, 2020
Enabling 2FA on major Github orgs Community security	12	1080	April 10, 2020
How to know which Julia package to trust? General Usage question , package	7	1048	September 15, 2022

Plethora of Julia related GitHub organizations and how to know which of them are "official"

Related topics