@cryptotaxi247 / documentation-1 / commits / 015c720

npm provenance updates for GA

Signed-off-by: Philip Harrison <philip@mailharrison.com>

SiaraMist committed Jun 29, 2023 at 11:05 UTC 015c720e2a9c0130402fa466bf65fe1949bcfcd0
4 files changed +13 -5
content/packages-and-modules/getting-packages-from-the-registry/searching-for-and-choosing-packages-to-download.mdx
+2 -2
@@ -70,10 +70,10 @@ To view provenance information for a package in the npm registry:
70
71 **Note:** Whenever you access a package's provenance information on npmjs.com, the linked source commit and repository are checked by npm. If the linked source commit or repository cannot be found, an error message will appear at the top of the page and alongside the provenance information. This is to inform you that the provenance for this package can no longer be established, which may occur when a repository is deleted or made private.
72
73 -</Note>
74 -
73 <Screenshot src="packages-and-modules/getting-packages-from-the-registry/npm-provenance-unreachable-source-commit@2x.png" alt="Screenshot showing a warning when the provenance source commit or repository cannot be found." />
74
75 +</Note>
76 +
77 ### Verifying provenance attestations
78
79 When you download a package from the registry, you can verify the provenance of a package with the following CLI command:
content/packages-and-modules/securing-your-code/generating-provenance-statements.mdx
+11 -3
@@ -26,7 +26,7 @@ The transparency log service provides a public, verifiable, tamper-evident ledge
26
27 ## Provenance limitations
28
29 -- In order to publish a package with provenance, you must build your package with a supported cloud CI/CD provider using a cloud-hosted runner from a public source repository. Today this includes GitHub Actions and GitLab CI, and we are collaborating with additional providers to expand support. For more information on how to establish provenance using GitHub Actions, see "[Publishing packages with provenance via GitHub Actions][publishing-with-provenance]."
29 +- To publish a package with provenance, you must build your package with a supported cloud CI/CD provider using a cloud-hosted runner. Today this includes GitHub Actions and GitLab CI/CD.
30 - When a package in the npm registry has established provenance, it does not guarantee the package has no malicious code. Instead, npm provenance provides a verifiable link to the package's source code and build instructions, which developers can then audit and determine whether to trust it or not. For more information, see "[Searching for and choosing packages to download][provenance-info]."
31
32 ## Prerequisites
@@ -39,7 +39,9 @@ Before you can publish your packages with provenance, you must:
39
40 - Ensure your `package.json` is configured with a public `repository` that matches where you are publishing with provenance from.
41
42 -- Set up a GitHub Actions workflow to publish your packages to the npm registry. For more information, see [Understanding GitHub Actions][understand-actions] in the GitHub documentation.
42 +- Set up automation with a supported CI/CD provider to publish your packages to the npm registry. The following providers are supported:
43 + - GitHub Actions. For more information, see "[Publishing packages with provenance via GitHub Actions][github-provenance]."
44 + - GitLab CI/CD. For more information, see "[Publishing packages with provenance via GitLab CI/CD][gitlab-provenance]."
45
46 ## Publishing packages with provenance via GitHub Actions
47
@@ -140,8 +142,14 @@ If you publish your packages with tools that do not directly invoke the `npm pub
142 </Note>
143
144
145 +## Publishing packages with provenance via GitLab CI/CD
146 +
147 +In order to establish provenance, you must use a supported cloud CI/CD provider and a cloud-hosted runner to publish your packages. GitLab CI/CD is a supported CI/CD platform that allows you to automate software development tasks. For more information, see [Generating provenance in GitLab CI/CD][gitlab-ci-cd-docs] in the GitLab documentation.
148 +
149 [provenance-info]: /searching-for-and-choosing-packages-to-download#package-provenance
144 -[publishing-with-provenance]: #publishing-packages-with-provenance
150 [update-npm]: /try-the-latest-stable-version-of-npm
151 +[github-provenance]: #publishing-packages-with-provenance-via-github-actions
152 +[gitlab-provenance]: #publishing-packages-with-provenance-via-gitlab-cicd
153 [github-actions]: https://docs.github.com/en/actions
154 [understand-actions]: https://docs.github.com/en/actions/learn-github-actions/understanding-github-actions
155 +[gitlab-ci-cd-docs]: https://docs.gitlab.com/ee/ci/yaml/signing_examples.html#use-sigstore-and-npm-to-generate-keyless-provenance
static/packages-and-modules/getting-packages-from-the-registry/npm-provenance-unreachable-source-commit@2x.png
Binary files a/static/packages-and-modules/getting-packages-from-the-registry/npm-provenance-unreachable-source-commit@2x.png and b/static/packages-and-modules/getting-packages-from-the-registry/npm-provenance-unreachable-source-commit@2x.png differ
static/packages-and-modules/getting-packages-from-the-registry/npm-provenance.png
Binary files a/static/packages-and-modules/getting-packages-from-the-registry/npm-provenance.png and b/static/packages-and-modules/getting-packages-from-the-registry/npm-provenance.png differ