getsentry / getsentry/sentry-javascript

Please add trusted publishing to npm packages to improve security

Offen
#18,421 2 Kommentare 1 Reaktion 0 zugewiesene Personen Auf GitHub ansehen
Feature
Vorherrschende Sprache
TypeScript
Sterne
8.7k
Forks
1.8k
Ø Merge
1 T. 17 Std.
Gemergte PRs (30 T.)
515

Beschreibung

### Problem Statement

Following recent hacks on npm packages, it would be greatly appreciated if you could increase the trust level of the npm packages.

### Solution Brainstorm

- A first and easy step would be generating provenance statements [docs.npmjs.com/generating-provenance-statements](https://docs.npmjs.com/generating-provenance-statements)
- The best case would be adding trusted publishing [docs.npmjs.com/trusted-publishers](https://docs.npmjs.com/trusted-publishers), as this would allow you to get rid of npm tokens, making token compromises not a risk anymore

### Additional Context

Would have opened a PR, but for trusted publishing, the changes mostly need to happen in the npm config of the packages.

### Priority

React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding `+1` or `me too`, to help us triage it.

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.