Is it normal for Extensions to not show Publishers as Verified?

[xcpn]

I installed VSCodium and the Ansible extension, I'm paranoid if there is something wrong.

This is what I see inside VSCodium Extension Page

This is what I see on Visual Studio Marketplace

As you can see, there is no "Verified" badge besides the Publisher name in VSCodium and the Downloads/Last Released values are different.

Is this to be expected, how can I always verify that I'm installing a legitimate extension.

[daiyam]

Downloads/Last Released values are different since they are different stores.

The verified domain name isn't available on OpenVSX (eclipse-openvsx/openvsx#453)

[xcpn]

@daiyam could you explain a little bit more, I'll make sure to read the discussion linked.

So I assume the extension is legitimate then, right? How do you go about verifying that an extension is legitimate (at least when it comes to official ones from big names)? If the Publisher Name and Extension Identifier are same as in the Visual Studio Marketplace, it's assumed legitimate and cannot be manipulated to show Identifier as redhat.ansible and be fake?

[daiyam]

Yes, the extension is from RedHat. You have more informations at https://open-vsx.org/extension/redhat/ansible.

A verified publisher on Visual Studio Marketplace is done by validating that the publisher own a domain name. Said domain name is then shown to you. This is why the linked issue is related to this discussion.

The identifiers can be different since they are different stores.
But, I think, most developers will use the same identifier for the same extension.
And the open source extensions which aren't published by their devs on OpenVSX, are published by the OpenVSX team and use the same identifiers.

[xcpn]

Got it now, thank you for the explanation!

Will read the links to learn more about the topic. Thanks a lot again!