package-trust

KO | EN

gitlite — search

#javascript #hacktoberfest #react #llm #android #docker #java #windows #kubernetes #vue #awesome-list #security #ios #open-source

(★ 113)

Proof of concept: let's audit npm!

파일 탐색기

최종 버전 다운로드 (.zip)

- eiriksletteberg@gmail.com.asc
.gitignore
fetch-pkg.sh
LICENSE.md
make-message.js
README.md
sign.sh
verify.sh

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Package Trust

A proof-of-concept for distributed security audits of npm packages.

The setup is based on people publishing their public GPG key,
downloading an npm package from the registry, manually auditing it, and then
creating a GPG signature stating that they have audited it.

These signatures are collected and stored in a repository. One can then
later on verify that all packages that are used in a project (by parsing package-lock.json)
are properly security-audited, by people you trust.

This repository is a minimum viable product; one could imagine creating
a web application of sorts, with a database, to store the signatures and
make a more user-friendly workflow.

### How to inspect a package

1) Find out which package you want to inspect.
2) Check package metadata: `npm view left-pad` (you will get a list of versions)
3) Fetch the package: `PACKAGE="left-pad" VERSION="1.3.0" ./fetch-pkg.sh`
   The package will be downloaded and end up in the "packages" directory.
4) Do the manual inspection.
5) Create a signature

### How to sign an inspected package

1) Run the sign script: `PACKAGE="left-pad" VERSION="1.3.0" SENDER="[email]" ./sign.sh`
   ("sender" should be your e-mail address)
2) Create a pull request to this repository

### Verifying signatures for a package

1) Run the verify script: 1) Run the sign script: `PACKAGE="left-pad" VERSION="1.3.0" ./verify.sh`

This will verify all the signatures. (Based on which GPG signatures you trust)

### Exporting a key

Export your public GPG key, put it in the "keys" folder and create a pull request.

`gpg --armor --export [email] > keys/[email].asc`

Then, create a pull request to this repository.

#### Manual inspection tips

Make sure you look at every file.
Check package.json, it should not contain anything malicious in the "scripts" section.

##### Tips for inspecting a package that contains minified files

- Try git-cloning the source code for the package.
- Do an audit of the source code.
- Run the build/minification step for the source code and generate a .tgz package.
- Verify that the checksum of your built artifact is the same as the upstream one.

package-trust

파일 탐색기

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

package-trust

파일 탐색기

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README