Curated VS Code Extension Sources

EnhancedAdvanced

This section provides an overview of what curated-vsx sources are, why they are useful, and how to use them.

Overview

Curated VSX sources allow administrators to define an allowlist of VS Code extensions from the Open VSX registry. The curated VSX source makes only the explicitly listed extensions available to users. This is useful in regulated environments where only approved extensions should be installable from Positron or VS Code.

Unlike local-vsx sources (which require you to upload .vsix files), curated VSX sources pull extension data from the Open VSX registry automatically. Administrators only need to maintain a list of approved extension identifiers.

Creating a Curated VSX Source

Terminal
rspm create source --name=approved-extensions --type=curated-vsx
Source 'approved-extensions':
  Type:  Curated VSX

Once the source has been created, subscribe a repository to make the extensions available to users:

Terminal
# Create a VSX repository:
rspm create repo --name=extensions --type=vsx --description='Approved VS Code extensions'

# Subscribe the repository to the curated VSX source:
rspm subscribe --repo=extensions --source=approved-extensions

You can also subscribe the repository to both a curated VSX source and the Open VSX source. The curated source takes priority when subscribed first:

Terminal
# Curated source first (higher priority):
rspm subscribe --repo=extensions --source=approved-extensions

# Open VSX as fallback:
rspm subscribe --repo=extensions --source=openvsx

When both sources provide the same extension, the curated source’s version constraints are used.

Requirements Files

Extensions are included in a curated-vsx source by uploading a requirements file with rspm update. Each line specifies an extension identifier in namespace.name format, optionally followed by version constraints.

extensions.txt
# Approved VS Code extensions
golang.go
ms-python.python>=2024.1.0
redhat.java>=1.28.0,<2.0.0
esbenp.prettier-vscode~=10.1.0

Supported Syntax

Format Meaning
golang.go All versions of the extension
golang.go==0.41.0 Only version 0.41.0
golang.go>=0.40.0,<0.42.0 Versions in range [0.40.0, 0.42.0)
golang.go~=0.41.0 Compatible release (>=0.41.0, <0.42.0)
# comment Ignored
-r other-file.txt Include extensions from another file

Version constraints follow the PEP 440 specification. Supported operators: ==, !=, >=, <=, >, <, ~=.

Note

Extension identifiers use the format namespace.name (e.g., golang.go, ms-python.python). You can find the identifier for an extension on its Open VSX page.

Updating a Curated VSX Source

To make extensions available, run rspm update with a requirements file. Posit recommends doing a dry-run first:

Terminal
# Dry-run to preview changes:
rspm update --source=approved-extensions --file-in=extensions.txt

Extensions from 'extensions.txt' to update source 'approved-extensions' at snapshot date '2026-05-22':

Name               Version
golang.go          0.41.0
ms-python.python   2024.1.0, 2024.2.0
redhat.java        1.30.0

Changes:
  + golang.go
  + ms-python.python
  + redhat.java

If the output above looks correct, execute this command again with the --commit and --snapshot=2026-05-22 flags to update the source with the new set of extensions.

After verifying the output, commit the changes:

Terminal
# Commit the update:
rspm update --source=approved-extensions --file-in=extensions.txt --snapshot=2026-05-22 --commit

Snapshot Dates

The --snapshot flag specifies which date to use for filtering extension versions. Package Manager serves only versions published on or before the snapshot date to clients. Use latest (the default for dry-runs) to include all available versions.

Removing Extensions

To remove an extension from a curated source, remove it from the requirements file and commit again. The activity page shows the removed extensions.

Output Formats

Terminal
# JSON output:
rspm update --source=approved-extensions --file-in=extensions.txt --output-format=json

# CSV output:
rspm update --source=approved-extensions --file-in=extensions.txt --csv-out=extensions.csv

Error Handling

If any extension in the requirements file is not found in the Open VSX registry, the update fails with a clear error listing all missing extensions:

Error output
Error: The following extensions were not found: nonexistent.fakepkg, another.missing

If a version constraint cannot be satisfied (no versions match), the extension is also reported as missing:

Error output
Error: The following extensions were not found: golang.go>=99.0.0 (no matching versions)

All extensions in the requirements file must be resolvable for the update to succeed.

License Requirements

Curated VSX sources require an Enhanced or Advanced license with the “Curated Repositories” and “VSX Extensions” entitlements.

Back to top