"To publish provenance for a package, you must publish the package from a GitHub Actions workflow." Read as: "We wish to uphold NPM tradition of not allowing t

"To publish provenance for a package, you must publish the package from a GitHub Actions workflow." Read as: "We wish to uphold NPM tradition of not allowing the authors of code to sign their own code, but as an alternative we will increase your package trust score if you build your package with a heavily censored, centralized, and proprietary build system owned by Microsoft" How is it that STILL the only source for signed javascript packages are Debian apt-get repos. NPM and JSR still have dramatically worse JS supply chain security than a -terrible- 30yo package manager which still requires a lot of custom tooling overhead in every project for reproducible builds (docker, apt package hash pinning, apt-archive, etc). Oh right, because the NPM team was worried even having -optional- support for package signing would scare off people from publishing javascript packages. https://github.com/npm/npm/pull/4016 https://github.com/npm/npm/pull/4016