Docs for unreachable provenance source commit (#672)
npm will now show a warning when the npm provenance source commit or repository cannot be found. Signed-off-by: Philip Harrison <philip@mailharrison.com>
Philip Harrison committed
Jul 11, 2023 at 18:10 UTC
95d9700aadcb7f3617c6d7249d81f51ef6a85b7a
2 files changed
+9
-1
content/packages-and-modules/getting-packages-from-the-registry/searching-for-and-choosing-packages-to-download.mdx
+9
-1
@@ -48,7 +48,7 @@ You can use this information to audit packages and determine whether or not you
48
49
To view provenance information for a package in the npm registry:
50
51
-1. In the npm registry, navigate to a package.
51
+1. In the npm registry, navigate to a package.
52
53
2. On the package's page, in the **Version** field to the right of the README, look for a green check mark. If there is a green check mark, this means the package was published with provenance.
54
@@ -66,6 +66,14 @@ To view provenance information for a package in the npm registry:
66
67
<Screenshot src="packages-and-modules/getting-packages-from-the-registry/npm-provenance.png" alt="Screenshot showing npm provenance information for a published package" />
68
69
+<Note>
70
+
71
+**Note:** Whenever you access a package's provenance information on npmjs.com, the linked source commit and repository are checked by npm. If the linked source commit or repository cannot be found, an error message will appear at the top of the page and alongside the provenance information. This is to inform you that the provenance for this package can no longer be established, which may occur when a repository is deleted or made private.
72
+
73
+</Note>
74
+
75
+<Screenshot src="packages-and-modules/getting-packages-from-the-registry/npm-provenance-unreachable-source-commit@2x.png" alt="Screenshot showing a warning when the provenance source commit or repository cannot be found." />
76
+
77
### Verifying provenance attestations
78
79
When you download a package from the registry, you can verify the provenance of a package with the following CLI command:
static/packages-and-modules/getting-packages-from-the-registry/npm-provenance-unreachable-source-commit@2x.png
Binary files /dev/null and b/static/packages-and-modules/getting-packages-from-the-registry/npm-provenance-unreachable-source-commit@2x.png differ