[Epic] Package Quality/Trust

[albarry4]

Although package quality is a somewhat subjective idea, we have seen a few important commonalities across our customer base as far as aspects of a package that help to determine its quality.

This epic tracks the work to improve the quality and quality-related requirements of packages in the NuGet ecosystem. Through customer development, we determined some key common themes:

1. Community -- Our customers often leverage other external resources to find out a variety of different information about NuGet packages, most notably being opinions/experiences with a certain package from the larger developer community. We heard a strong desire from our customers for more of these capabilities to be built into NuGet itself.
2. Security and Legality -- SBOMS and licensing were key components for money of our customers in determining the quality of a package. We heard a desire for this information to be made more available, and more easily discoverable.
3. Maintenance -- How well/frequently a package is maintained was an important indicator of package quality for many customers. Again, we heard a desire for this information to be made more easily discoverable within NuGet.
4. Tooling -- Many customers expressed frustrations with limitations in NuGet tooling that inhibited them from determining the quality of a package easily. An example of a tooling limitation is limited search functionality and limited documentation.

Affordances of trust 🤝

• Swap authors for owners in Visual Studio Package Manager UI #12501
• Warn package consumers when a package might automatically run code #12505
• [Feature]: Add a security banner for any package that might automatically run code. NuGetGallery#9435
• Further differentiate official Microsoft packages from packages with similar IDs and metadata NuGetGallery#8037

Verification of package owners ✅

• [Feature]: Add a verified domain adornment similar to VS Marketplace  NuGetGallery#9437
• Better protection for verified packages. NuGetGallery#5574

Please 👍 or 👎 this comment to help us with the direction of this epic & leave as much feedback/questions/concerns as you'd like on this issue itself and we will get back to you shortly.

Further tracking issues will be created shortly as requirements are gathered and planned.