Deprecate PGP signatures (#715)
Signed-off-by: Philip Harrison <philip@mailharrison.com>
Philip Harrison committed
Sep 27, 2023 at 14:54 UTC
a47a82d2272c4f9fae650bf162667c96963873a1
5 files changed
+7
-119
cli/lib/redirects.js
+6
@@ -85,4 +85,10 @@ module.exports = {
85
'using-npm/scope': ({ section }) => [
86
join(section, 'npm-scope'),
87
],
88
+ 'about-pgp-signatures-for-packages-in-the-public-registry': () => [
89
+ '/about-registry-signatures',
90
+ ],
91
+ 'verifying-the-pgp-signature-for-a-package-from-the-npm-public-registry': () => [
92
+ '/verifying-registry-signatures',
93
+ ],
94
}
content/packages-and-modules/securing-your-code/about-pgp-signatures-for-packages-in-the-public-registry.mdx
deleted
-41
@@ -1,41 +0,0 @@
1
----
2
-title: About PGP registry signatures (deprecated)
3
----
4
-<Note>
5
-
6
-**Note:** PGP based registry signatures will be deprecated on **April 25th 2023** in favour of [ECDSA registry signatures](/about-registry-signatures). This means no new packages will be signed with PGP keys from this date onwards and the [public key hosted on Keybase](https://keybase.io/npmregistry) will expire.
7
-
8
-</Note>
9
-
10
-To increase confidence in the npm public registry, we add our [PGP][pgp-wiki] signature to package metadata and publicize our public PGP key on [Keybase][keybase]. Our Keybase account is "[npmregistry][npmregistry]" and our public PGP key can be found at https://keybase.io/npmregistry/pgp_keys.asc
11
-
12
-You can use the package PGP signature and our public PGP key to verify that the same entity who published the key (npm) also signed the package you downloaded from the npm public registry. For more information, see "[Verifying the PGP signature of a package from the npm public registry][verify-pgp]".
13
-
14
-## Tools we use
15
-
16
-### openpgpjs
17
-
18
-To generate PGP signatures, we use [openpgpjs][openpgpjs-repo], a pure JavaScript implementation of OpenPGP. To learn more about openpgpjs, see https://openpgpjs.org/.
19
-
20
-### Keybase
21
-
22
-We use Keybase to publicize our PGP key and give you confidence that the npm registry you install from is the same registry that signs packages.
23
-
24
-Keybase offers two advantages over the core OpenPGP experience that move us to recommend it to you:
25
-
26
-- The Keybase application and CLI provide an excellent user experience for PGP, which can be intimidating for newcomers.
27
-- Keybase manages and displays social proofs that the entity that controls a specific PGP key also controls accounts on social media and other places. These proofs help you determine whether you can trust an account.
28
-
29
-We’ve established proofs on Keybase that we control [@npmjs][npmjs-twitter] on Twitter, the domain [npmjs.com][npmjs-com], and the domain [npmjs.org][npmjs-org]. Verifying these proofs won’t tell you who owns those domains, but it does establish that the same entity controls them, and the PGP key advertised on Keybase.
30
-
31
-If you install Keybase and create an account, you can follow npmregistry yourself and obtain a local copy of the registry’s public key. For more information, and to verify the PGP signature of a specific package version from the npm public registry, see "[Verifying the PGP signature for a package from the npm public registry][verify-pgp]".
32
-
33
-
34
-[keybase]: https://keybase.io
35
-[pgp-wiki]: https://en.wikipedia.org/wiki/Pretty_Good_Privacy
36
-[npmregistry]: https://keybase.io/npmregistry
37
-[openpgpjs-repo]: https://github.com/openpgpjs/openpgpjs
38
-[npmjs-twitter]: https://twitter.com/npmjs
39
-[npmjs-com]: https://npmjs.com
40
-[npmjs-org]: https://npmjs.org
41
-[verify-pgp]: verifying-the-pgp-signature-for-a-package-from-the-npm-public-registry
content/packages-and-modules/securing-your-code/about-registry-signatures.mdx
+1
-1
@@ -10,7 +10,7 @@ Signing and verifying published packages protects against an attacker controllin
10
11
<Note>
12
13
-**Note:** PGP based registry signatures will be deprecated on **April 25th 2023** in favour of ECDSA registry signatures. This means no new packages will be signed with PGP keys from this date onwards and the [public key hosted on Keybase](https://keybase.io/npmregistry) will expire.
13
+**Note:** PGP-based registry signatures were deprecated on **April 25th 2023** and replaced by ECDSA registry signatures.
14
15
</Note>
16
content/packages-and-modules/securing-your-code/verifying-the-pgp-signature-for-a-package-from-the-npm-public-registry.mdx
deleted
-73
@@ -1,73 +0,0 @@
1
----
2
-title: Verifying the PGP registry signature of a package from the npm public registry (deprecated)
3
----
4
-
5
-<Note>
6
-
7
-**Note:** PGP based registry signatures will be deprecated on **April 25th 2023** in favour of [ECDSA registry signatures](/about-registry-signatures). This means no new packages will be signed with PGP keys from this date onwards and the [public key hosted on Keybase](https://keybase.io/npmregistry) will expire.
8
-
9
-</Note>
10
-
11
-To ensure the integrity of a package version you download from the npm public registry, you can manually verify the [PGP signature][about-pgp-sig] of the package.
12
-
13
-<Note>
14
-
15
-**Note:** Since fully verifying signatures on Keybase requires rechecking proofs (which requires network activity) and is therefore expensive, we recommend only verifying signatures if it is necessary -- for example, when verifying a deploy artifact, or when initially storing a package in your cache.
16
-
17
-</Note>
18
-
19
-## Prerequisites
20
-
21
-1. Install Keybase from https://keybase.io/download
22
-2. Create a Keybase account on https://keybase.io
23
-3. Follow "[npmregistry][npmregistry]" on Keybase.
24
-4. Download a local copy of the npm public registry's [public PGP key][npm-key].
25
-
26
-## Verifying npm signatures for the public registry
27
-
28
-<Note>
29
-
30
-**Note:** The following steps use version 1.4.3 of the `light-cycle` package as an example.
31
-
32
-</Note>
33
-
34
-1. On the command line, fetch the signature for the package version you want and save it in a file:
35
-
36
- ```
37
- npm view light-cycle@1.4.3 dist.npm-signature > sig-to-check
38
- ```
39
-
40
-2. Get the integrity field for that version (example below includes response):
41
-
42
- ```
43
- npm view light-cycle@1.4.3 dist.integrity
44
- ```
45
-
46
- Example response:
47
-
48
- ```
49
- sha512-sFcuivsDZ99fY0TbvuRC6CDXB8r/ylafjJAMnbSF0y4EMM1/1DtQo40G2WKz1rBbyiz4SLAc3Wa6yZyC4XSGOQ==
50
- ```
51
-
52
-3. Construct the string that ties the unique package name and version to the integrity string (example below includes response):
53
-
54
- ```
55
- keybase pgp verify --signed-by npmregistry -d sig-to-check -m 'light-cycle@1.4.3:sha512-sFcuivsDZ99fY0TbvuRC6CDXB8r/ylafjJAMnbSF0y4EMM1/1DtQo40G2WKz1rBbyiz4SLAc3Wa6yZyC4XSGOQ=='
56
- ```
57
-
58
- Example response:
59
-
60
- ```
61
- ▶ INFO Identifying npmregistry
62
- ✔ public key fingerprint: 0963 1802 8A2B 58C8 4929 D8E1 3D4D 5B12 0276 566A
63
- ✔ admin of DNS zone npmjs.org: found TXT entry keybase-site-verification=Ls8jN55i6KesjiX91Ck79bUZ17eA-iohmw2jJFM16xc
64
- ✔ admin of DNS zone npmjs.com: found TXT entry keybase-site-verification=iK3pjpRBkv-CIJ4PHtWL4TTcFXMpPiwPynatKl3oWO4
65
- ✔ "npmjs" on twitter: https://twitter.com/npmjs/status/981288548845240320
66
- Signature verified. Signed by npmregistry 3 years ago (2018-04-13 15:00:37 -0700 MST).
67
- PGP Fingerprint: 096318028a2b58c84929d8e13d4d5b120276566a.
68
- ```
69
-
70
-[about-pgp-sig]: about-pgp-signatures-for-packages-in-the-public-registry
71
-[keybase]: https://keybase.io
72
-[npmregistry]: https://keybase.io/npmregistry
73
-[npm-key]: https://keybase.io/npmregistry/pgp_keys.asc
src/theme/nav.yml
-4
@@ -160,10 +160,6 @@
160
url: /about-registry-signatures
161
- title: Verifying ECDSA registry signatures
162
url: /verifying-registry-signatures
163
- - title: About PGP registry signatures (deprecated)
164
- url: /about-pgp-signatures-for-packages-in-the-public-registry
165
- - title: Verifying PGP registry signatures (deprecated)
166
- url: /verifying-the-pgp-signature-for-a-package-from-the-npm-public-registry
163
- title: Requiring 2FA for package publishing and settings modification
164
url: /requiring-2fa-for-package-publishing-and-settings-modification
165
- title: Reporting malware in an npm package