Eric Hanson

> To me it feels like if you know which registry you want (you know the correct URL) why not just add it via that URL? Isn’t that also true...

> Not because of the interactive selector in the rare case of a name collision though? Yeah, because of that. > That should probably be removed as well and be...

Ok, well I've pushed a commit to remove the interactive stuff and instead choose the repo based on where the latest version of the code lives-- since adding by branch...

When I've seen it on my machine, it might've been during git clone yeah. (I get very annoyed by Pkg server registry delays so I usually switch to the git...

> I'm not sure if there's much we can do about this I was imagining a try-catch around the problematic libgit operations to try to safely handle interrupts or print...

Yeah... was hoping that one could get solved too 😄. But if there is not much hope there and git will continue to be the path for active developers who...

@josephsdavid just ran into this with our private registry (we don't have a package server), so I'll bump this :).

Sorry, apparently I assumed it was this issue too soon- @josephsdavid can probably say more but apparently it was an unrelated issue, something about some crazy interaction between git worktrees...

I think they could just both put `shadowable=true`, and then opt-out of this safety check. I don't think that case is really an issue because both packages are controlled by...

I think a package “should” have only one trusted group allowed to issue versions (org/committer/company/whatever), so if there’s any “untrusted” versions showing up in a registry that’s a big security...