Repository navigation
Provide release commit when publishing to NPM #36960
Description
Search Terms
npm, commit, githead
Suggestion
In order to participate in a secure software supply chain, TypeScript should provide the release commit in the package.json's githead property for releases made to npmjs.org.
Use Cases
This field is used to establish the provenance of artifacts downloaded from NPM and can be used to validate the received artifact matches the original sources. This field also enables other ecosystem tools such as sourcegraph and clearlydefined.io.
Checklist
My suggestion meets these guidelines:
- This wouldn't be a breaking change in existing TypeScript/JavaScript code
- This wouldn't change the runtime behavior of existing JavaScript code
- This could be implemented without emitting different JS based on the types of the expressions
- This isn't a runtime feature (e.g. library functionality, non-ECMAScript syntax with JavaScript output, etc.)
- This feature would agree with the rest of TypeScript's Design Goals.
Activity
orta commentedon Feb 22, 2020
We deploy in a separate vm from one with access to the git repo for security - is there a way to set this commit without fs git access?
RyanCavanaugh commentedon Feb 24, 2020
I think we could have the
gulp LKGscript modifypackage.jsonaccording to the current git HEAD, since the things we publish to npm are solely outputs of that processcc Wesley Wigham (@weswigham) for npm opinions
weswigham commentedon Feb 24, 2020
This is one of the fields that npm generates on publish, right; if we're missing it, it's an
npmbug, afaik, sincenpm packis supposed to add all the generated fields to the package.json in the tarball it packs.