Hi, Setting up trusted publishing where the registry supports it is the right move, and pinning it to the apache/* repo is also the right way to do this.
On official accounts: no, there is no ASF account on crates.io or nuget.org <http://nuget.org/> that I’m aware of. The Incubator's Distribution Guidelines [1] specifically cover Maven, GitHub, Docker, NPM, and PyPI, so for other registries, the generic guidelines at the top of that page apply. The relevant points here are that all PPMC members must have access to administer the platform, and that the credentials must be recorded in a location accessible to any PPMC member. So rather than a foundation account, the obligation sits with the PPMC: registry owner/admin roles should be held by multiple PPMC members, not by a single person's personal account, with the details recorded somewhere all PPMC members can access (private@ works). Kind regards, Justin [1] https://incubator.apache.org/guides/distribution.html
