Skip to content

Clarify upstream trust description in documentation #387

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ciaracarey wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Clarify upstream trust description in documentation #387

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/content/supply-chain-security/upstream-trust.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ import configure_upstream_trust from './images/configure_upstream_trust.png'
import edit_upstream_trust from './images/edit_upstream_trust.png'

# Upstream Trust
Upstream trust is a supply chain security feature that prevents namesquatting attacks where bad actors hijack your internal package name in public repositories. By designating upstream sources as trusted or untrusted, you control which sources are permitted to serve versions of packages that exist in your private repository or other trusted sources.
Upstream trust is a supply chain security feature that prevents dependency confusion or namesquatting attacks where bad actors hijack your internal package name in public repositories. By designating upstream sources as trusted or untrusted, you control which sources are permitted to serve versions of packages that exist in your private repository or other trusted sources.
Copy link
Copy Markdown
Contributor

@nicholasmccrea nicholasmccrea Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I’d probably keep it scoped to namesquatting for now. Dependency confusion covers a few different attack vectors, and upstream trust only protects against namesquatting really.

This is particularly important for organizations that publish private packages alongside public open-source dependencies. Without upstream trust, a malicious actor could publish a package with the same name as your private package to a public registry, potentially tricking your build systems into pulling the attacker's version instead of your own.
Comment on lines +6 to 7
Copy link

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The addition of “dependency confusion” here makes the description internally inconsistent: later in this document the feature is described only as namesquatting protection (e.g., “protected from namesquatting” and “protects against namesquatting”). Either update the rest of the page to consistently describe both threats (and distinguish them), or remove “dependency confusion” to avoid over-claiming / confusing readers. Also consider aligning the dependency confusion description with the definition used elsewhere in the docs (src/content/formats/python-repository.mdx around the Dependency confusion note).

Suggested change
Upstream trust is a supply chain security feature that prevents dependency confusion or namesquatting attacks where bad actors hijack your internal package name in public repositories. By designating upstream sources as trusted or untrusted, you control which sources are permitted to serve versions of packages that exist in your private repository or other trusted sources.
This is particularly important for organizations that publish private packages alongside public open-source dependencies. Without upstream trust, a malicious actor could publish a package with the same name as your private package to a public registry, potentially tricking your build systems into pulling the attacker's version instead of your own.
Upstream trust is a supply chain security feature that protects against namesquatting attacks where bad actors publish packages using the same names as your internal packages in public repositories. By designating upstream sources as trusted or untrusted, you control which sources are permitted to serve versions of packages that exist in your private repository or other trusted sources.
This is particularly important for organizations that publish private packages alongside public open-source dependencies. Without upstream trust, a malicious actor could publish a package with the same name as your private package to a public registry, potentially tricking your build systems into pulling the attacker's package instead of your own.

Copilot uses AI. Check for mistakes.

<Note variant="important" headline="Early Access">
Expand Down