Post #970882

I had a chat with @andrewnez about why creating a new package repository is so hard. There are a ton of little details like support from SBOM and vulnerability scanners nobody even thinks about usually. There are so many little details Andrew does a great job explaining all this and more https://opensourcesecurity.io/2026/2026-04-ecosystems-andrew/