Package Security and Integrity

[bnonni]

• Make it possible for devs to have confidence in the packages they are installing
• Use DIDs for signing packages
• dpm.software website can show reputation and trust metrics such as:
  • who published it
  • number of installs
  • signatures on each package published
  • verification of that signature (✅)
  • instructions for self verifying signature against downloaded code
  • integrity hash that version is locked to
  • display publisher did and did doc containing dwn url
  • link to the GitHub repo to see commit history, stars, tests, etc.
• features to ensure confidence:
  • signature verification on package updates at time of install / resolution
  • ability to check signatures on package record contents via cli tool (dpm verify did:dht:web5/api/0.1.0 <signature>)
  • protocol rules to disable the ability to republish to the same version number
  • way to check integrity of the protocol installed to user dwn