feat: verify sourceURI for npm packages #521
Conversation
Signed-off-by: laurentsimon <[email protected]>
Signed-off-by: laurentsimon <[email protected]>
Signed-off-by: laurentsimon <[email protected]>
| @@ -123,13 +125,17 @@ func verifySourceURI(prov slsaprovenance.Provenance, expectedSourceURI string, v | |||
| return nil | |||
| } | |||
|
|
|||
| func sourceFromURI(uri string) (string, error) { | |||
| // NOTE: `allowNoRef` is to allow for verification of npm packages | |||
There was a problem hiding this comment.
should we set a tracking issue to remove this after GA?
There was a problem hiding this comment.
good idea. I was hesitant because I don't know that we'll be able to remove it right away, since some provenance will have been generated with this code. Unless all the provenance generated before GA is considered "no prod ready" and the npm teams removes it. Created #524
There was a problem hiding this comment.
We can maybe only allow it for provenance created before a certain date? or something like that?
There was a problem hiding this comment.
Yeah, I wonder about the #524, and we can ask them when they go GA - i expect that is when they will stabilize
Signed-off-by: laurentsimon <[email protected]>
| @@ -123,13 +125,17 @@ func verifySourceURI(prov slsaprovenance.Provenance, expectedSourceURI string, v | |||
| return nil | |||
| } | |||
|
|
|||
| func sourceFromURI(uri string) (string, error) { | |||
| // NOTE: `allowNoRef` is to allow for verification of npm packages | |||
There was a problem hiding this comment.
We can maybe only allow it for provenance created before a certain date? or something like that?
| @@ -123,13 +125,17 @@ func verifySourceURI(prov slsaprovenance.Provenance, expectedSourceURI string, v | |||
| return nil | |||
| } | |||
|
|
|||
| func sourceFromURI(uri string) (string, error) { | |||
| // NOTE: `allowNoRef` is to allow for verification of npm packages | |||
There was a problem hiding this comment.
Yeah, I wonder about the #524, and we can ask them when they go GA - i expect that is when they will stabilize
Co-authored-by: Ian Lewis <[email protected]> Signed-off-by: laurentsimon <[email protected]>
Signed-off-by: laurentsimon <[email protected]>
Signed-off-by: laurentsimon <[email protected]>
closes #492