[FEATURE] Allow provenance generated by CI to be published with a package.
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
Currently npm only allows publishing SLSA provenance that was generated by the npm CLI itself.
npm publish --provenance
It would be useful for CI systems to be able to generate provenance themselves and use the npm cli to publish the provenance.
Expected Behavior
The npm cli --provenance flag could take an argument that is a path to a sigstore bundle file in JSON format.
npm publish --provenance=/path/to/bundle.sigstore
This bundle could then be added as provenance metadata when publishing instead of generating provenance itself.
Steps To Reproduce
N/A
Environment
N/A
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the npm CLI's --provenance option and publishing flow, then review the linked Sigstore bundle specification for the expected JSON format. Done means npm can accept a CI-generated bundle path and publish that bundle as provenance metadata instead of generating provenance itself.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- cli, devtools
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100