Support pnpm publish --provenance

[himself65]

• I'd be willing to implement this feature (contributing guide)

Describe the user story

https://docs.npmjs.com/generating-provenance-statements
https://github.blog/2023-04-19-introducing-npm-package-provenance/

[styfle]

The linked blog also mentions npm audit signatures so that will likely need to be implemented too

[dominikg]

according to https://docs.npmjs.com/generating-provenance-statements#using-third-party-package-publishing-tools adding provenance=true to .npmrc could already enable it with current pnpm even without support for the cli flag.

[styfle]

Also setting the env var export NPM_CONFIG_PROVENANCE=true should work too

[filiptammergard]

according to https://docs.npmjs.com/generating-provenance-statements#using-third-party-package-publishing-tools adding provenance=true to .npmrc could already enable it with current pnpm even without support for the cli flag.

Anyone tried?

The same page says "Note: At this time, lerna and yarn are not supported tools for publishing your packages with provenance."

I wonder if pnpm is excluded from the "list" because it is supported or for other reasons.

[danielroe]

To confirm, pnpm works with setting NPM_CONFIG_PROVENANCE=true. Working commit: nuxt/nuxt@ec15037.

[himself65]

To confirm, pnpm works with setting NPM_CONFIG_PROVENANCE=true. Working commit: nuxt/nuxt@ec15037.

This works for me, see toeverything/blocksuite@b6cb911