Enable supply chain security through npm provenance attestation - Githubissues

twbs / icons

Official open source SVG icon library for Bootstrap.

https://icons.getbootstrap.com

MIT License

7.43k stars 1.07k forks source link

Enable supply chain security through npm provenance attestation #2077

Open pupapaik opened 2 weeks ago

pupapaik commented 2 weeks ago

Configure GitHub Actions workflow for secure publishing
Enable automatic provenance generation during npm publish
Add integrity verification through Sigstore transparency logs

Following the recent Lottie-Player supply chain attack, it's crucial to enhance package security. NPM provenance provides cryptographic proof that this package was built from this repository using GitHub Actions, making supply chain attacks significantly harder. More info in my blog post https://medium.com/exaforce/npm-provenance-the-missing-security-layer-in-popular-javascript-libraries-b50107927008