feat(publish): staff ship support --provenance flag

[darcyclarke]

Summary

Support for the new build attestation generation/uploading when the --provenance flag is configured (ref. npm/rfcs#626).

Exit Criteria

• create warning this is experimental
• pull in work from POC branch by Package Security team
• sync up with Package Security team on launch

[darcyclarke]

@ljharb apologies - was still flushing out the issue when you commented - this is a tracking issue for the team. What may be notable here is that this is likely to be a branch/pr for staff ship purposes.

[saquibkhan]

@steiza can you help us here what is the warning and privacy message to be added here?

[steiza]

The Linux Foundation privacy statement isn't published yet. When it is, we'll definitely want to reference it, although I'm not sure we need to show it every time someone calls npm publish --provenance?

Here's the draft language that is likely to be similar to what the Linux Foundation will publish .

And we're tracking the publishing on the Sigstore side at sigstore/community#192

[wraithgar]

What about the experimental logging message?

[steiza]

Maybe something along the lines of "support for this feature is not yet public"?

To clarify, is this something we're thinking of adding to the npm CLI provenance branch? To use this feature you have to use that branch, and for the data to be accepted by the npm registry you have to be on an allow list that's just GitHub employees. With that scoping I'm not sure what additionally we'd want to convey, other than this isn't for public use yet.

The private beta (targeting mid-January) is a different story - although for that we'll have a 1.x release of https://www.npmjs.com/package/sigstore and (I believe we agreed on!) then that the functionality would then be included in the npm CLI latest. But at that point, I don't think we'd consider it experimental? Although I suppose "support for this feature is not yet public" would still make sense, until the public beta (targeting mid-March).

Does that make sense? Are there things I'm not thinking about here?

[saquibkhan]

@steiza this make sense

[wraithgar]

Makes sense. I'll strike out that item and consider this task done.