Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SLSA v1.0 verification support for npm packages built by the npm cli #450

Open
ianlewis opened this issue Jan 18, 2023 · 3 comments
Open

SLSA v1.0 verification support for npm packages built by the npm cli #450

ianlewis opened this issue Jan 18, 2023 · 3 comments
Assignees
@laurentsimon
Labels
area:npm An issue with verification of npm packages type:feature New feature request

Comments

@ianlewis
Copy link
Member

Verification support for the npm CLI as defined by RFC-0049
@ianlewis ianlewis added this to the Verification of npm Packages milestone Jan 18, 2023
@ianlewis ianlewis added area:npm An issue with verification of npm packages type:feature New feature request labels Jan 18, 2023
@asraa
Copy link
Contributor

asraa commented Feb 9, 2023

Should we be able to do this? They are not SLSA 3, so it complicates the logic we have for detecting a trusted builder.

@ianlewis
Copy link
Member Author

@asraa I think you're right. I think it was (perhaps mistakenly) listed in one of our meeting docs and that's why I created the issue.

Though I think we may need to do some detection of SLSA levels in the future (supporting builders capable of SLSA 3 but not necessarily always SLSA 3). In npm CLI's case, it's never SLSA 3 so I'll just go ahead and close.

@laurentsimon
Copy link
Contributor

re-opening based on today's discussion. We will support the trusted builder.

@laurentsimon laurentsimon reopened this Feb 16, 2023
@mlieberman85 mlieberman85 mentioned this issue Mar 3, 2023
Open
@ianlewis ianlewis removed this from the Verification of npm packages GA milestone Jun 27, 2023
This was referenced Jul 3, 2024
Merged
Closed
ramonpetgrave64 added a commit that referenced this issue Jul 30, 2024
@ramonpetgrave64
feat: support npm cli provenance v1 attestations (#776)
7f3db92 
Fixes #614, #450, #449, #515

Adds support for NPM CLIs build provenances, generated when running `npm
publish --provenance --access public` from a [GitHub Actions
workflow](https://github.com/ramonpetgrave64/gundam-visor/blob/599500821344b070902a7a5666064bfdaba715df/.github/workflows/npm-publish.yml#L21).

## Testing

- added unit tests for some new helper functions
- added regression test cases

## Future work

- #493, so we can
do `--print-provenance`
- implemented in
#768 (comment)

---------

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@laurentsimon laurentsimon

Labels
area:npm An issue with verification of npm packages type:feature New feature request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@ianlewis @asraa @laurentsimon