4 ms·

> The NPM has yet to support mechanisms like package signing. Yes, but actually no. "To increase confidence in the npm public registry, we add our PGP signatu

> The NPM has yet to support mechanisms like package signing. Yes, but actually no. "To increase confidence in the npm public registry, we add our PGP signature to package metadata and publicize our public PGP key on Keybase."[0] Unfortunately (and perhaps unsurprisingly), this means NPM is still a single point of failure, and this doesn't add any defence in depth. I guess what you want is signatures by the package maintainers themselves, but key management is hard for both signers and verifiers. [0] https://docs.npmjs.com/about-pgp-signatures-for-packages-in-the-public-registry/ https://docs.npmjs.com/about-pgp-signatures-for-packages-in-...

d4mi3n 4y ago
IIRC when I examined this a couple years ago—it doesn’t seem to have changed—this is about NPM signing packages submitted to it’s registry. This can give confidence they packages are not tampered with when one downloads them from NPM. What this is not is support for package maintainers or CI/CD systems to sign artifacts they upload to NPM. Supporting this would give consumers of said packages the ability to detect if a package maintainer was compromised—the signature on a new version would either be invalid or different.