Open a repo for the Package Registry

[luanpiegas]

Hi, I would like to suggest to open a package registry repo so the community can contribuite to.

In my use case, commercial plugins are not going to work with wpm. What if we implement an authentication flow that commercial plugins can connect to and authorize downloads? See this example from ACF Pro using Composer:

{ "bearer": { "connect.advancedcustomfields.com": "YOUR_ACF_PRO_LICENSE_KEY" } }

[thelovekesh]

Yes, I am planning that in near future.

In my use case, commercial plugins are not going to work with wpm.

Just curious, what made you come to that conclusion?

[luanpiegas]

A few things from going through the docs and the CLI:

• The model only has public/private visibility + token auth — there's no concept of license keys, entitlements, or per-purchaser access. So a vendor has no way to gate a package by who's actually licensed it.
• Third-party commercial vendors (ACF Pro, Gravity Forms, AIOSEO, etc.) don't publish to the registry and have no incentive/mechanism to — they distribute through their own licensed channels.
• The only workaround is re-publishing a licensed plugin into our own private namespace, which (a) brushes against the vendors' EULAs (redistribution), and (b) means manually re-publishing on every vendor update. That's fine for our own private plugins, but not for paid third-party ones.

So for my use case (shipping paid plugins like ACF Pro / Gravity Forms and more) wpm would have us hosting licensed code ourselves rather than wpm brokering entitlement, which isn't really a fit. I'm planning to use wpm for the free + custom plugins and handle the commercial ones separately.