Administered by:
Google was able to pin directly to main because they had very strong internal contracts with all of the code they used.
The vast majority of companies do not have these contracts in place. They leverage OSS code that they're not paying for. For which there is no explicit contract.
As this post highlights [www.softwaremaxims.com]: "I am not your supplier".
Package Managers help regulate these contracts by at least providing you with a consistent copy of code../7
Musings about software · I am not a supplierFor the past few years, we have seen a lot of discussions around the concept of the Software Supply Chain. These discussions started around the time of LeftPad and escalated with multiple incidents in the past few years. The problem of all the work in this domain is that it forgets a fundamental point.