Local VS Code Extensions

Posit Package Manager supports distributing internally-managed VS Code extensions through local-vsx sources. This page provides an overview of the options and configurations available. The quick start guide also includes a section for getting started quickly.

Local VSX Sources

Posit Package Manager has a local-vsx source type that can be used for uploading your own VS Code extension files (VSIX). Any repositories of the vsx type can subscribe to local-vsx sources, enabling you to create combined repos that subscribe to both Open VSX and your internally-managed extensions. For example:

Terminal
# Create a local VSX source:
$ rspm create source --name=local-vsx-src --type=local-vsx
Source 'local-vsx-src':
 Type:  Local VSX

# Create a VSX repository:
$ rspm create repo --name=extensions --type=vsx --description='VS Code extensions'
Repository: extensions - VSX

# Subscribe the repository to the local VSX source:
$ rspm subscribe --repo=extensions --source=local-vsx-src
Repository: extensions
Sources:
--local-vsx-src (Local VSX)

# Subscribe the repository to the Open VSX source:
$ rspm subscribe --repo=extensions --source=openvsx
Repository: extensions
Sources:
--local-vsx-src (Local VSX)
--openvsx (Open VSX)

# Upload a single extension:
$ rspm add --source=local-vsx-src --path=/path/to/extension.vsix

# Upload multiple extensions from a directory:
$ rspm add --source=local-vsx-src --path=/path/to/directory
Note

Priority order of sources in a repository is important. If an extension exists in both Open VSX and the local VSX source and the repository is subscribed to both, the source that was subscribed to the repo first takes precedence by default. You can rearrange the order using the rspm reorder command.

Verified publishers

In VS Code-based editors, a verified badge next to a publisher’s name means a registry confirmed that the publisher owns the domain it claims. Package Manager only presents an extension from a local VSX source as verified when the source declares that it owns the extension’s publisher namespace. By default a local VSX source declares no namespaces, so it serves no verified extensions. Package Manager continues to serve and list these extensions; only the badge is withheld.

Declare the publisher namespaces a source owns with the --publisher-namespaces flag, as a comma-separated list. It can be set when creating a source and changed later with rspm edit source:

Terminal
# Serve extensions published by "posit" or "my-company" as verified:
$ rspm create source --name=local-vsx-src --type=local-vsx --publisher-namespaces=posit,my-company

# Add or change the declaration on an existing source:
$ rspm edit source --name=local-vsx-src --publisher-namespaces=posit,my-company

# Clear the declaration (nothing served from this source is verified):
$ rspm edit source --name=local-vsx-src --publisher-namespaces=

Package Manager serves an extension as verified when its publisher matches one of the declared namespaces. It serves an extension whose publisher does not match normally, but unverified. Each namespace must be a valid publisher name (lowercase letters, digits, and hyphens); a comma-separated list and the * wildcard cannot be combined.

Warning

The * wildcard verifies every extension served from the source, whatever publisher name it declares. This reinstates the behavior that existed before per-source namespaces: anyone who can upload to the source can publish an extension under any publisher name and have it served as verified. Use * only on a source where every writer is trusted to choose publisher names honestly — typically an admin-only source, not one a CI pipeline can write to.

Important

Declaring a namespace on a source means Package Manager will vouch for any extension uploaded to that source in that namespace (or, with *, in any namespace). Because uploading requires only sources:write on the source, granting that scope to a non-administrative token (for example, a CI pipeline) lets that token publish verified content in the declared namespaces. This is a deliberate “this pipeline publishes as us” grant, but make sure it is intended. Only grant sources:write on a namespace-declaring source to identities you trust to publish as those publishers. Each time Package Manager starts, it logs the local VSX sources that declare a namespace so you can review their write access.

Note

Mirrored Open VSX extensions are unaffected by this setting. Their verified status comes from upstream Open VSX data, and Package Manager preserves it regardless of any local namespace declarations.

Authentication Limitations

VS Code-based editors (Positron, VS Code) do not support authenticated extensions galleries, so users will not be able to install extensions from authenticated VSX repositories using standard editor workflows. The Authentication.NewReposAuthByDefault setting excludes VSX repositories for this reason.

If you need to restrict access to your VSX repository, consider network-level controls (firewall rules, VPN, etc.) instead of repository authentication.

Back to top