getsentry / getsentry/sentry-javascript
Please add trusted publishing to npm packages to improve security
- 主要语言
- TypeScript
- 星标
- 8.7k
- 派生
- 1.8k
- 平均合并
- 1 天 17 小时
- 30 天内合并 PR
- 523
描述
### Problem Statement
Following recent hacks on npm packages, it would be greatly appreciated if you could increase the trust level of the npm packages.
### Solution Brainstorm
- A first and easy step would be generating provenance statements [docs.npmjs.com/generating-provenance-statements](https://docs.npmjs.com/generating-provenance-statements)
- The best case would be adding trusted publishing [docs.npmjs.com/trusted-publishers](https://docs.npmjs.com/trusted-publishers), as this would allow you to get rid of npm tokens, making token compromises not a risk anymore
### Additional Context
Would have opened a PR, but for trusted publishing, the changes mostly need to happen in the npm config of the packages.
### Priority
React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding `+1` or `me too`, to help us triage it.
贡献指南
评估
这个 Issue 还没有评估数据。