New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

NPM Provenance - a build signature badge #893

Open

vmasek opened this issue Dec 17, 2024 · 1 comment

Labels

Collaborator

vmasek commented Dec 17, 2024 •

edited

Loading

As an user,
I want to be assured that all released packages are coming from notable source,
to be able to trust the package I'm adopting into my project.

Setup an NPM provenance for CI that will mark all of our release packages as "✅ Build & signed on GitHub Actions".

https://www.npmjs.com/package/sigstore#provenance

Collaborator Author

vmasek commented Dec 17, 2024

Blocked until we move all our releases to GitHub Actions

vmasek added the 🚧 blocked label

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment