Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Support verification for npm SLSA v1.0 #614

Closed
laurentsimon opened this issue May 24, 2023 · 4 comments · Fixed by #776
Closed

Support verification for npm SLSA v1.0 #614

laurentsimon opened this issue May 24, 2023 · 4 comments · Fixed by #776
Labels
specs:v1.0

Comments

@laurentsimon
Copy link
Contributor

No description provided.

@ianlewis
Copy link
Member

What is "npm v1.0"?

@laurentsimon laurentsimon changed the title Support verification for npm v1.0 Support verification for npm SLSA v1.0 Jun 21, 2023
@laurentsimon
Copy link
Contributor Author

Updated the title.. I meant npm SLSA v1.0 format

@ianlewis ianlewis removed this from the Verification of npm packages GA milestone Jun 26, 2023
@laurentsimon
Copy link
Contributor Author

npm CLI is close to having support for v1 format npm/cli#6613

@laurentsimon laurentsimon mentioned this issue Sep 27, 2023
Closed
@ramonpetgrave64 ramonpetgrave64 mentioned this issue May 17, 2024
Open
@ramonpetgrave64 ramonpetgrave64 mentioned this issue Jun 4, 2024
Merged
@ramonpetgrave64
Copy link
Contributor

Duplicate to #450

ramonpetgrave64 added a commit that referenced this issue Jul 30, 2024
@ramonpetgrave64
feat: support npm cli provenance v1 attestations (#776)
7f3db92 
Fixes #614, #450, #449, #515

Adds support for NPM CLIs build provenances, generated when running `npm
publish --provenance --access public` from a [GitHub Actions
workflow](https://github.com/ramonpetgrave64/gundam-visor/blob/599500821344b070902a7a5666064bfdaba715df/.github/workflows/npm-publish.yml#L21).

## Testing

- added unit tests for some new helper functions
- added regression test cases

## Future work

- #493, so we can
do `--print-provenance`
- implemented in
#768 (comment)

---------

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
specs:v1.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat: support npm cli provenance v1 attestations ramonpetgrave64/slsa-verifier
3 participants
@ianlewis @ramonpetgrave64 @laurentsimon