feat: update pgp examples to use npm commands
Luke Karrys committed
Feb 24, 2022 at 18:00 UTC
41a0e7cf631cd3d6fbc63351caba4ca00af05d29
1 file changed
+8
-9
content/packages-and-modules/securing-your-code/verifying-the-pgp-signature-for-a-package-from-the-npm-public-registry.mdx
+8
-9
@@ -28,13 +28,13 @@ To ensure the integrity of a package version you download from the npm public re
28
1. On the command line, fetch the signature for the package version you want and save it in a file:
29
30
```
31
- $ http GET https://registry.npmjs.org/light-cycle | json "versions['1.4.3'].dist.npm-signature" > sig-to-check
31
+ npm view light-cycle@1.4.3 --json | npm exec json ".dist.npm-signature" > sig-to-check
32
```
33
34
2. Get the integrity field for that version (example below includes response):
35
36
```
37
- $ http GET https://registry.npmjs.org/light-cycle | json "versions['1.4.3'].dist.integrity"
37
+ npm view light-cycle@1.4.3 --json | npm exec json ".dist.integrity"
38
```
39
40
Example response:
@@ -46,19 +46,18 @@ To ensure the integrity of a package version you download from the npm public re
46
3. Construct the string that ties the unique package name and version to the integrity string (example below includes response):
47
48
```
49
- $ keybase pgp verify --signed-by npmregistry -d sig-to-check -m 'light-cycle@1.4.3:sha512-sFcuivsDZ99fY0TbvuRC6CDXB8r/ylafjJAMnbSF0y4EMM1/1DtQo40G2WKz1rBbyiz4SLAc3Wa6yZyC4XSGOQ=='
49
+ keybase pgp verify --signed-by npmregistry -d sig-to-check -m 'light-cycle@1.4.3:sha512-sFcuivsDZ99fY0TbvuRC6CDXB8r/ylafjJAMnbSF0y4EMM1/1DtQo40G2WKz1rBbyiz4SLAc3Wa6yZyC4XSGOQ=='
50
```
51
52
Example response:
53
54
```
55
▶ INFO Identifying npmregistry
56
- ✔ <tracked> public key fingerprint: 0963 1802 8A2B 58C8 4929 D8E1 3D4D 5B12 0276 566A
57
- You last followed npmregistry on 2018-04-10 21:21:57 PDT
58
- ✔ <tracked> admin of DNS zone npmjs.com: found TXT entry keybase-site-verification=iK3pjpRBkv-CIJ4PHtWL4TTcFXMpPiwPynatKl3oWO4
59
- ✔ <tracked> "npmjs" on twitter: https://twitter.com/npmjs/status/981288548845240320 [cached 2018-04-12 13:18:31 PDT; but got a retryable error (API network error: Get https://twitter.com/npmjs/status/981288548845240320: net/http: request canceled (Client.Timeout exceeded while awaiting headers) (code=170)) this time around]
60
- ✔ <tracked> admin of DNS zone npmjs.org: found TXT entry keybase-site-verification=Ls8jN55i6KesjiX91Ck79bUZ17eA-iohmw2jJFM16xc
61
- Signature verified. Signed by npmregistry 7 minutes ago (2018-04-13 15:00:37 -0700 PDT).
56
+ ✔ public key fingerprint: 0963 1802 8A2B 58C8 4929 D8E1 3D4D 5B12 0276 566A
57
+ ✔ admin of DNS zone npmjs.org: found TXT entry keybase-site-verification=Ls8jN55i6KesjiX91Ck79bUZ17eA-iohmw2jJFM16xc
58
+ ✔ admin of DNS zone npmjs.com: found TXT entry keybase-site-verification=iK3pjpRBkv-CIJ4PHtWL4TTcFXMpPiwPynatKl3oWO4
59
+ ✔ "npmjs" on twitter: https://twitter.com/npmjs/status/981288548845240320
60
+ Signature verified. Signed by npmregistry 3 years ago (2018-04-13 15:00:37 -0700 MST).
61
PGP Fingerprint: 096318028a2b58c84929d8e13d4d5b120276566a.
62
```
63