Specification: Provenance

[Ipstenu]

• Solve plugin name squatting
• All updates come from the initial author, even in the Package server moves
• Show verification checkmarks
• Add labels (see Documentation: Plan how moderation should work at scale #11 ) that can be used to inform developers that the source is true

[toderash]

Honest question: do we need to solve plugin name squatting? If it's a brand or trademark, it would violate the existing policy. If it's a more generic term, I don't think we want to police that.

Tangentially related: thinking about how to easily migrate legacy wp to FAIR DID-based repo as authoritative, and came up with this: if a WordPress plugin included a DID in its meta, we stop serving it from the legacy repo and re-index it from the FAIR repo. Only problem with that is if dot-org strips it out of the package meta.

[Ipstenu]

Honest question: do we need to solve plugin name squatting? If it's a brand or trademark, it would violate the existing policy. If it's a more generic term, I don't think we want to police that.

"Solve" is a broad term, but basically we solve it by making a way to flag things as official.

So if you see wp-org/hello-dolly and you have fake-org/hello-dolly, we know that wp-org is 'truth'

It's tied into DIDs.

[toderash]

Potentially blocked by #49