feat: add support for npm package trust evidence check via a new trustPolicy setting #10103
Conversation
|
Hi @zkochan, When you have a moment, could you review this PR? |
|
I have left a comment in the related issue: #8889 (comment) |
|
When attestation check is set to true, the full metadata should be requested. Similar to how it is done when minimumReleaseAge is set. Otherwise, the "time" field will not be present in the metadata. |
zkochan
changed the title
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 22 out of 22 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 23 out of 23 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…tPolicy setting (#10103) close #8889 --------- Co-authored-by: Zoltan Kochan <[email protected]>
2 participants
Fixes #8889
Added support for npm package attestation check.
When
trustPolicyis set tono-downgrade, installation will fail if provenance downgrade is detected.Detect provenance downgrading:
References
provenancefield antfu/fast-npm-meta#20