3 ms·
From https://docs.npmjs.com/generating-provenance-statements https://docs.npmjs.com/generating-provenance-statements In order to publish a package with pro
by zdragnar 4y ago
From https://docs.npmjs.com/generating-provenance-statements https://docs.npmjs.com/generating-provenance-statements
In order to publish a package with provenance, you must build your package with a supported cloud CI/CD provider. Today this includes GitHub Actions, and we are collaborating with additional providers to expand support.
I really hope that's not an empty statement. I enjoy some aspects of Github, but would hate to see it become the only trusted source for an entire language's ecosystem.
- 9dev 4y agonpm is GitHub is Microsoft.
- johnnypangs 4y agoIf you look at the GitHub announcement in the looking ahead section it says this: > Working with other cloud CI/CD providers to add support for provenance signing So hopefully they make good on that point. https://github.blog/2023-04-19-introducing-npm-package-provenance/ https://github.blog/2023-04-19-introducing-npm-package-prove...
- deleted 4y ago[deleted]
- bin_bash 4y ago> entire language FYI, sigstore is not js-specific