Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: add npm audit signatures #4827

Merged
merged 2 commits into from Jul 11, 2022
+2,086 −13
Merged

feat: add npm audit signatures #4827

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3ae53e4
feat: add npm audit signatures
feelepxyz Apr 29, 2022
cd9c4f4
docs: update docs for audit signatures
wraithgar Jul 11, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
13 changes: 12 additions & 1 deletion docs/content/commands/npm-audit.md
View file
Open in desktop
Expand Up @@ -11,7 +11,7 @@ description: Run a security audit
<!-- see lib/commands/audit.js -->

```bash
npm audit [fix]
npm audit [fix|signatures]
```

<!-- automatically generated, do not edit manually -->
Expand Down Expand Up @@ -41,6 +41,17 @@ vulnerability is found. It may be useful in CI environments to include the
will cause the command to fail. This option does not filter the report
output, it simply changes the command's failure threshold.

### Audit Signatures

This command can also audit the integrity values of the packages in your
tree against any signatures present in the registry they were downloaded
from. npm will attempt to download the keys from `/-/npm/v1/keys` on
each the registry used to download any given package. It will then
check the `dist.signatures` object in the package itself, and verify the
`sig` present there using the `keyid` there, matching it with a key
returned from the registry. The command for this is `npm audit
signatures`

### Audit Endpoints

There are two audit endpoints that npm may use to fetch vulnerability
Expand Down