Consider allowing signing of manifests using Ethereum addresses.
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 853
- Forks
- 662
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 8
Description
Allowing signing the manifest (which includes the shashum of the code source), would increase security of Snaps by allowing to claim ownership of a Snap and ensure that further updates to a Snap would also be done by the same team.
We could then also use ENS reverse records to show a true author of the Snap.
While we can trust NPM security for now, this might become a bigger issue when we support other sources of Snaps than just NPM.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or entry points are identified. Start by scoping how manifest signing, Ethereum addresses, ownership of updates, and ENS reverse records should work together, including sources beyond NPM. Done means the signing and verification requirements are agreed and implementable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- blockchain, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100