feat: Add --provenance-bundle flag to npm publish #6300
Conversation
This updates the `--provenance` flag to also take a string path to a sigstore bundle in JSON format that can be uploaded with a package by `npm publish`. Previous functionality of specifying `--provenance` as a boolean is preserved. Signed-off-by: Ian Lewis <ianlewis@google.com>
Signed-off-by: Ian Lewis <ianlewis@google.com>
Signed-off-by: Ian Lewis <ianlewis@google.com>
Signed-off-by: Ian Lewis <ianlewis@google.com>
| if (provenance === true && provenanceBundle) { | ||
| throw Object.assign( | ||
| new Error('--provenance and --provenance-bundle cannot be specified at the same time.'), | ||
| { code: 'EUSAGE' } | ||
| ) | ||
| } |
There was a problem hiding this comment.
this seems confusing - if they're mutually exclusive, why not --provenance=path/to/bundle?
There was a problem hiding this comment.
I did try this. However, I wanted to preserve the existing --provenance boolean, and npm seems finicky about its flags. If I create a flag that can be a boolean or string then npm publish --provenance package-name will no longer work and parse package-name as the argument to --provenance.
|
This is not the direction we are going w/ this flag. We need to fix the bug where we can't configure a flag to be either a boolean or a string, and use that flag for this purpose. The fix is in #6020 (I think? Someone used copilot to "fix" the PR and now it's pretty unreadable). |
|
The original provenance PR did have this functionality and that is how we found the config bug, so it was paused till we can fix it. |
Just to be clear, Is it fair to say we still want to add the functionality once the config bug is fixed and we just don't want it to be a separate flag? |
Yes the end goal is for you to be able to go |
I created #6313 to explain the flag parsing issue. This is unfortunately blocking me from adding publishing support to https://github.com/slsa-framework/slsa-github-generator. I think this will also require changes to |
4 participants
This PR adds a new
--provenance-bundleflag alongside the--provenanceflag fornpm publish. The flag takes a file path to a file in sigstore bundle format (JSON encoded).This allows CI builders to generate signed provenance external to the npm CLI and upload it to the npm registry along with the created package.