Keep bad packages out
Sigstore provenance verification for npm and PyPI
Every cached file gets a provenance status: verified, unverified, none, or INVALID. The same four for npm and PyPI.
- verified: a Sigstore attestation checks out and names these exact bytes. For npm that is the SLSA build provenance
npm publish --provenanceattaches, for PyPI the PEP 740 attestation a trusted publisher uploads. - unverified: provenance is advertised but could not be checked. Asked again daily.
- none: the release was published without provenance.
- INVALID: provenance is published but does not hold up. The signature fails, it names different bytes, or on PyPI the certificate does not belong to the trusted publisher PyPI names.
Verification is done on the box with Node's own crypto against a Sigstore trusted root pinned in the repository, never with keys the registry hands over. It checks the Fulcio certificate chain, the signing time inside the certificate's lifetime, the DSSE signature, the Rekor log entry, and that the statement's subject digest matches the cached file.
A verified file shows where it was built: repository, commit, ref, workflow, builder and identity issuer. When provenance is INVALID is warn by default, which records it and sends a policy.violation event, and hold puts the file in quarantine too.
In short
- npm SLSA provenance and PyPI PEP 740 attestations
- Pinned Sigstore trusted root and npm registry keys, no trust in what the registry sends
- Fulcio chain, Rekor entry, DSSE signature and subject digest all checked
- Repository, commit, workflow and builder shown for verified files
- Warn or hold on INVALID
In the documentation
- Licenses, lookalikes and provenance Administrator Guide
Goes well with
- Integrity alerts and quarantine A file that changes after it was first seen is held. The original keeps being served.
- Artifacts, SBOMs and lifecycle Every file stored once by SHA-256, CycloneDX and SPDX out, properties and promotion stages.
- Malware scanning ClamAV, a hash blocklist, your own scanner and the OpenSSF known malicious feed, on every cached file. Optionally before the first download.
One container, about two minutes
A Linux box with Docker, or one without it, and a reverse proxy for TLS. The installer does the rest and it is safe to run twice. Free, MIT licensed, nothing to sign up for.