Add Gauge to alternative VS Code marketplace

[sschulz92]

Since a couple of weeks Microsoft is pushing the AI features without asking the users if they want to use them. In a corporate environment this might not be wanted/accepted and therefore other VS Code IDEs might be used instead.

One of the popular alternatives is VS Codium. Unfortunately, they are using the marketplace open-vsx.org which does not include Gauge as of yet.

Would it be possible to publish the Gauge extension in this open-source marketplace too?

I have tested the manual installation via VSIX file and it seems to work as expected.

[chadlwilson]

Can you point me to examples of some of the "AI stuff" that is affecting VSCode?

OpenVSX has what seems like a pretty major malware and squatting problem at the moment so it feels a bit dodgy right now e.g. https://www.aikido.dev/blog/invisible-unicode-malware-strikes-openvsx-again

Maintaining a trusted package repository is pretty serious business when you're distributing executable code to devs, and im not sure whether OpenVSX is positioned well enough or not.

In Gauge itself we need to do more to improve our own supply chain security too - the more places we distribute, the bigger the risk of compromise to publishing credentials especially for places that don't support a "trusted publishing" methodology. There are some things here that make me quite uncomfortable (but haven't talked to the other maintainers yet).

[sschulz92]

In general I am worried about not being asked if I want to use such a powerful feature. For open source projects like Gauge this helps a lot to achieve something easier (in most cases). Though, I am facing corporate issues when "someone" simply add AI to a tool which may or may not send data, including code snippets, to their servers. One example is the code completion, which obviously needs to understand the context of the code.

Thank you for the hint regarding OpenVSX, I have not hard feelings about this marketplace. It is just the one highlighted by VSCodium. Since Eclipse Foundation is behind this marketplace, I thought it's safe ... I might be wrong 😬

[chadlwilson]

In general I am worried about not being asked if I want to use such a powerful feature. For open source projects like Gauge this helps a lot to achieve something easier (in most cases). Though, I am facing corporate issues when "someone" simply add AI to a tool which may or may not send data, including code snippets, to their servers. One example is the code completion, which obviously needs to understand the context of the code.

My understanding is that you can opt-out/disable all the LLM/copilot stuff.

At the end of the day, if enough people want this and OpenVSX is sufficiently in-demand we can probably publish there. Maybe by then there'll be higher levels of trust to the publishing...

Thank you for the hint regarding OpenVSX, I have not hard feelings about this marketplace. It is just the one highlighted by VSCodium. Since Eclipse Foundation is behind this marketplace, I thought it's safe ... I might be wrong 😬

Unfortunately all package ecosystems have one problem or another these days, and most suffer with more problems than something funded by the Eclipse Foundation, so hopefully they get things improved.

[zabil]

Like it's been discussed, security issues.

Every new marketplace is now a vector for supply chain attacks. I prefer a 'build-from-source' (vsce package) approach or publishing vsix to releases page.

[chadlwilson]

Unfortunately GitHub releases are a huge vector as well due to default mutability (see ongoing catastrophic Trivy compromise as the most recent) - unless all the publishing flows are tightened up and GH's newish immutable releases feature is enabled (with risk to older versions persisting I believe). But that still won't stop the main attack vector now, which is GitHub Actions and broad persistent tokens with lifetime beyond an actions run (for either GitHub or marketplaces which don't support federated identity/trusted publishing).

The official marketplace at least signs the releases once they are there, IIRC.