Feature: Improve Signed-release for npm package #3038

laurentsimon · 2023-05-18T20:10:01Z

Npm has support for SLSA provenance. We should improve the check to check for provenance for the corresponding package, if possible - rather than only looking at GitHub releases.

I think this requires a way to search provenance from a repo, rather than from a package. Note, package is attestations_url=$(npm view "$package_name" --json | jq -r '.dist.attestations.url').

So we can either find the right API on the registry; or use a deps.dev API

An alternative is to search for workflow files npm publish --provenance. Another is to search for use of the OpenSSF npm buider.

The text was updated successfully, but these errors were encountered:

laurentsimon · 2023-05-31T15:06:28Z

deps.dev API https://github.com/google/deps.dev/blob/main/api/v3alpha/api.proto

naveensrinivasan · 2023-05-31T17:26:47Z

deps.dev API https://github.com/google/deps.dev/blob/main/api/v3alpha/api.proto

Is there an API for it?

spencerschrock · 2023-05-31T18:04:59Z

A better link might be https://docs.deps.dev/api/v3alpha/, which has the example API url

slugclub · 2023-06-01T02:42:02Z

This should be possible with the deps.dev API in the near future.

We're planning to surface packages associated with a GitHub repository from the GetProject endpoint soon.

You could then use the GetVersion endpoint to discover whether any of these versions have SLSA attestations. Specifically, npm versions with SLSA attestations will include the attestation link in the links field. Note that these attestations are not verified by deps.dev at the moment, though we plan to do so in the future.

naveensrinivasan · 2023-06-01T16:05:33Z

This should be possible with the deps.dev API in the near future.

We're planning to surface packages associated with a GitHub repository from the GetProject endpoint soon.

You could then use the GetVersion endpoint to discover whether any of these versions have SLSA attestations. Specifically, npm versions with SLSA attestations will include the attestation link in the links field. Note that these attestations are not verified by deps.dev at the moment, though we plan to do so in the future.

Am I right?

Short Summary

Deps.dev plans to add a feature to their API to allow users to discover whether any packages associated with a GitHub repository have SLSA attestations. Attestations for npm versions will be included in the links field.

Key takeaways

Deps.dev is adding a new feature to their API to allow users to discover SLSA attestations for packages associated with a GitHub repository.
The GetProject endpoint will be used to surface packages associated with a GitHub repository.
The GetVersion endpoint will be used to discover whether these versions have SLSA attestations.
Attestations for npm versions will be included in the links field.
Deps.dev is planning to verify these attestations in the future.

slugclub · 2023-06-02T01:23:41Z

Yep that's right.

The npm attestation links are already available via the GetVersion endpoint (for package versions that have attestations). For example, curl 'https://api.deps.dev/v3alpha/systems/npm/packages/semver/versions/7.5.1'.

The main thing we need to add is a way for API users to get the packages associated with a GitHub repository. This may be via the GetProject endpoint (or we may also add a new endpoint). I will post more details here as we design and implement.

naveensrinivasan · 2023-06-02T13:43:47Z

Yep that's right.

The npm attestation links are already available via the GetVersion endpoint (for package versions that have attestations). For example, curl 'https://api.deps.dev/v3alpha/systems/npm/packages/semver/versions/7.5.1'.

The main thing we need to add is a way for API users to get the packages associated with a GitHub repository. This may be via the GetProject endpoint (or we may also add a new endpoint). I will post more details here as we design and implement.

Do you have some kind of timeline for this feature?

naveensrinivasan · 2023-06-02T13:46:02Z

Yep that's right.

The npm attestation links are already available via the GetVersion endpoint (for package versions that have attestations). For example, curl 'https://api.deps.dev/v3alpha/systems/npm/packages/semver/versions/7.5.1'.

The main thing we need to add is a way for API users to get the packages associated with a GitHub repository. This may be via the GetProject endpoint (or we may also add a new endpoint). I will post more details here as we design and implement.

I don't see it.

{
  "versionKey": {
    "system": "NPM",
    "name": "semver",
    "version": "7.5.1"
  },
  "isDefault": true,
  "licenses": [
    "ISC"
  ],
  "advisoryKeys": [],
  "links": [
    {
      "label": "HOMEPAGE",
      "url": "https://github.com/npm/node-semver#readme"
    },
    {
      "label": "ISSUE_TRACKER",
      "url": "https://github.com/npm/node-semver/issues"
    },
    {
      "label": "ATTESTATION",
      "url": "https://registry.npmjs.org/-/npm/v1/attestations/semver@7.5.1"
    },
    {
      "label": "ORIGIN",
      "url": "https://registry.npmjs.org/semver/7.5.1"
    },
    {
      "label": "SOURCE_REPO",
      "url": "git+https://github.com/npm/node-semver.git"
    }
  ],
  "publishedAt": "2023-05-12T16:39:41Z"
}

slugclub · 2023-10-11T06:53:32Z

Sorry for the delayed response.

From the GetVersion endpoint: If there is an attestation, a link to the attestation is available in the links field with the label ATTESTATION. We have also added a slsaProvenances field which contains more detailed information extracted from any SLSA provenance attestations attached to the version. For example, https://api.deps.dev/v3alpha/systems/npm/packages/semver/versions/7.5.1:

{
  "versionKey": {
    "system": "NPM",
    "name": "semver",
    "version": "7.5.1"
  },
  "isDefault": false,
  "licenses": [
    "ISC"
  ],
  "advisoryKeys": [
    {
      "id": "GHSA-c2qf-rxjj-qqgw"
    }
  ],
  "links": [
    {
      "label": "HOMEPAGE",
      "url": "https://github.com/npm/node-semver#readme"
    },
    {
      "label": "ISSUE_TRACKER",
      "url": "https://github.com/npm/node-semver/issues"
    },
    {
      "label": "ATTESTATION",
      "url": "https://registry.npmjs.org/-/npm/v1/attestations/semver@7.5.1"
    },
    {
      "label": "ORIGIN",
      "url": "https://registry.npmjs.org/semver/7.5.1"
    },
    {
      "label": "SOURCE_REPO",
      "url": "https://github.com/npm/node-semver"
    }
  ],
  "slsaProvenances": [
    {
      "sourceRepository": "https://github.com/npm/node-semver",
      "commit": "aa016a67162c195938f7873ea29a73dac47ff9ba",
      "url": "https://registry.npmjs.org/-/npm/v1/attestations/semver@7.5.1"
    }
  ],
  "publishedAt": "2023-05-12T16:39:41Z"
}

The new GetProjectPackageVersions endpoint provides a mapping from a repository to the package versions whose SLSA provenance attestations refer to that repository. For example, https://api.deps.dev/v3alpha/projects/github.com%2Fnpm%2Fnode-semver:packageversions:

{
  "versions": [
    {
      "versionKey": {
        "system": "NPM",
        "name": "semver",
        "version": "7.5.1"
      },
      "slsaProvenances": [
        {
          "sourceRepository": "https://github.com/npm/node-semver",
          "commit": "aa016a67162c195938f7873ea29a73dac47ff9ba",
          "url": "https://registry.npmjs.org/-/npm/v1/attestations/semver@7.5.1"
        }
      ]
    },
    {
      "versionKey": {
        "system": "NPM",
        "name": "semver",
        "version": "7.5.2"
      },
      "slsaProvenances": [
        {
          "sourceRepository": "https://github.com/npm/node-semver",
          "commit": "e7b78de06eb14a7fa2075cedf9f167040d8d31af",
          "url": "https://registry.npmjs.org/-/npm/v1/attestations/semver@7.5.2"
        }
      ]
    },
    {
      "versionKey": {
        "system": "NPM",
        "name": "semver",
        "version": "7.5.3"
      },
      "slsaProvenances": [
        {
          "sourceRepository": "https://github.com/npm/node-semver",
          "commit": "7fdf1ef223826b428d7f8aaf906e9eeefa9469f9",
          "url": "https://registry.npmjs.org/-/npm/v1/attestations/semver@7.5.3"
        }
      ]
    },
    {
      "versionKey": {
        "system": "NPM",
        "name": "semver",
        "version": "7.5.4"
      },
      "slsaProvenances": [
        {
          "sourceRepository": "https://github.com/npm/node-semver",
          "commit": "36cd334708ec1f85a71445622fb1864bceee0f4e",
          "url": "https://registry.npmjs.org/-/npm/v1/attestations/semver@7.5.4"
        }
      ]
    }
  ]
}

deps.dev does not currently verify the attestations though it's on the roadmap for us to do so in the future.

github-actions · 2023-12-11T01:47:22Z

This issue is stale because it has been open for 60 days with no activity.

raghavkaul · 2024-03-21T20:41:09Z

A proposed update to the Signed-Releases check was discussed in the community meeting (Doc). PTAL, feedback welcome!

laurentsimon added kind/enhancement New feature or request check/Signed-Releases labels May 18, 2023

github-actions bot added the no-issue-activity label Sep 20, 2023

ossf deleted a comment from github-actions bot Sep 20, 2023

laurentsimon removed the no-issue-activity label Sep 20, 2023

github-actions bot added the Stale label Dec 11, 2023

github-actions bot removed the Stale label Mar 22, 2024

raghavkaul mentioned this issue Jun 4, 2024

✨ probe: releases with verified provenance #4141

Merged

raghavkaul closed this as completed in #4141 Jun 7, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature: Improve Signed-release for npm package #3038

Feature: Improve Signed-release for npm package #3038

laurentsimon commented May 18, 2023 •

edited

Loading

laurentsimon commented May 31, 2023

naveensrinivasan commented May 31, 2023

spencerschrock commented May 31, 2023

slugclub commented Jun 1, 2023

naveensrinivasan commented Jun 1, 2023

slugclub commented Jun 2, 2023

naveensrinivasan commented Jun 2, 2023

naveensrinivasan commented Jun 2, 2023

slugclub commented Oct 11, 2023 •

edited

Loading

github-actions bot commented Dec 11, 2023

raghavkaul commented Mar 21, 2024

Feature: Improve Signed-release for npm package #3038

Feature: Improve Signed-release for npm package #3038

Comments

laurentsimon commented May 18, 2023 • edited Loading

laurentsimon commented May 31, 2023

naveensrinivasan commented May 31, 2023

spencerschrock commented May 31, 2023

slugclub commented Jun 1, 2023

naveensrinivasan commented Jun 1, 2023

Short Summary

Key takeaways

slugclub commented Jun 2, 2023

naveensrinivasan commented Jun 2, 2023

naveensrinivasan commented Jun 2, 2023

slugclub commented Oct 11, 2023 • edited Loading

github-actions bot commented Dec 11, 2023

raghavkaul commented Mar 21, 2024

laurentsimon commented May 18, 2023 •

edited

Loading

slugclub commented Oct 11, 2023 •

edited

Loading