Security: reject 3rd unsigned party binaries
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 1.2k
- Forks
- 271
- Avg merge
- 23h 40m
- Merged PRs (30d)
- 2
Description
It seems like this would be a nice feature if the binaries were signed by red hat etc, but unsigned or nobody-i-know signed 3rd party binaries are generally unacceptable.
perhaps we could honor a global npm config option to make "--build-from-source" default behavior?
It seems to make normal nodejs development inherently insecure when any npm library can suddenly start shipping black boxes... and only a matter of time before it gets widely exploited...
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named. Start by tracing how node-pre-gyp handles downloaded binaries and the --build-from-source option, then define the supported policy for rejecting unsigned or untrusted third-party binaries and the global npm configuration needed to enforce it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- build-system, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100