@cryptotaxi247 / documentation-1
Code Commits Issues Pulls Sessions CI/CD
jpg619/version-bump-tar-2
@reggi/path-to-regexp dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2 dependabot/npm_and_yarn/main/eslint-10.4.0 dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0 dependabot/npm_and_yarn/main/proc-log-7.0.0 dependabot/npm_and_yarn/npm_and_yarn-826852524d dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2 deprecate-totp-2fa dhei/classic-tokens gat-bypass-2fa-docs jpg619/fix-accessibility-content-flow jpg619/version-bump-tar-2 kartykp/gat-bypass-2fa-docs kartykp/upgrade-path-to-regex main maitxn/version-bump-tar patch-1 reggi/cache-based-on-version reggi/dev-engines reggi/fix-transform-prettier reggi/overrides update-search-sensitivity
mdx 68 lines 2.89 KB
Raw
1 ---
2 title: About ECDSA registry signatures
3 ---
4
5 Packages published to the public npm registry are signed to make it possible to detect if the package content has been tampered with.
6
7 Signing and verifying published packages protects against an attacker controlling a registry mirror or proxy where they attempt to intercept and tamper with the package tarball content.
8
9 ## Migrating from PGP to ECDSA signatures
10
11 <Note>
12
13 **Note:** PGP-based registry signatures were deprecated on **April 25th 2023** and replaced by ECDSA registry signatures.
14
15 </Note>
16
17 The public npm registry is migrating away from the existing PGP signatures to ECDSA signatures that are more compact and can be verified without extra dependencies in the npm CLI.
18
19 Signature verification was previously a multi-step process involving the Keybase CLI, as well as manually retrieving and parsing the signature from the package metadata.
20
21 Read more about [migrating and verifying signatures](/verifying-registry-signatures) using the npm CLI.
22
23 ## Supporting signatures on third-party registries
24
25 The npm CLI supports registry signatures and signing keys provided by any registry if the following conventions are followed:
26
27 **1. Signatures are provided in the package's `packument` in each published version within the `dist` object:**
28
29 ```
30 "dist":{
31 ..omitted..,
32 "signatures": [{
33 "keyid": "SHA256:{{SHA256_PUBLIC_KEY}}",
34 "sig": "a312b9c3cb4a1b693e8ebac5ee1ca9cc01f2661c14391917dcb111517f72370809..."
35 }],
36 ```
37
38 See this [example of a signed package from the public npm registry](https://registry.npmjs.org/light-cycle/1.4.3).
39
40 To generate the signature, sign the package name, version and tarball sha integrity: `${package.name}@${package.version}:${package.dist.integrity}`.
41
42 The current best practice is to use a [Key Management System](https://en.wikipedia.org/wiki/Key_management#Key_management_system) that does the signing operation on a [Hardware Security Module (HSM)](https://en.wikipedia.org/wiki/Hardware_security_module) in order to not directly handle the private key part, which reduces the attack surface.
43
44 The `keyid` must match one of the public signing keys below.
45
46 **2. Public signing keys are provided at `registry-host.tld/-/npm/v1/keys` in the following format:**
47
48 ```
49 {
50 "keys": [{
51 "expires": null,
52 "keyid": "SHA256:{{SHA256_PUBLIC_KEY}}",
53 "keytype": "ecdsa-sha2-nistp256",
54 "scheme": "ecdsa-sha2-nistp256",
55 "key": "{{B64_PUBLIC_KEY}}"
56 }]
57 }
58 ```
59
60 Keys response:
61
62 - `expires`: null or a simplified extended [ISO 8601 format](https://en.wikipedia.org/wiki/ISO_8601): `YYYY-MM-DDTHH:mm:ss.sssZ`
63 - `keyid`: sha256 fingerprint of the public key
64 - `keytype`: only `ecdsa-sha2-nistp256` is currently supported by the npm CLI
65 - `scheme`: only `ecdsa-sha2-nistp256` is currently supported by the npm CLI
66 - `key`: base64 encoded public key
67
68 See this [example key's response from the public npm registry](https://registry.npmjs.org/-/npm/v1/keys).