One issue here is that NIST are trying to push SBOMs [2] but NPM is not providing them as part of the provenance I think.
Another thing is a push to use new types of signature envelopes like DSSE [3] instead of something like COSE [4]
[1] https://datatracker.ietf.org/group/scitt/about/
[2] https://www.nist.gov/itl/executive-order-14028-improving-nat...
[3] https://github.com/secure-systems-lab/dsse
Not entirely sure what this sentence means (some executables?), NPM generates lockfiles and, while lockfiles are not SPDX/CycloneDX equivalent, the overlap in intent and content is strong. SBOM makes just as much sense at this level as the existing lockfile generation mechanism.
> and logs it in Google's provided append only log
This is false. The entire sigstore effort is under the OpenSSF and the production systems are operated by volunteers from multiple companies.
The Root CA is generated by the sigstore community (five folks, two from academia). Right now github exchanges an OIDC token for a sigstore root chained cert.
GitLab are currently adding themselves, to have the same capability (several other providers are there as well).
In order to publish a package with provenance, you must build your package with a supported cloud CI/CD provider. Today this includes GitHub Actions, and we are collaborating with additional providers to expand support.
> Working with other cloud CI/CD providers to add support for provenance signing
So hopefully they make good on that point.
https://github.blog/2023-04-19-introducing-npm-package-prove...
FYI, sigstore is not js-specific
Edit: Oh, realize now that npmjs.com doesn't even have it's own blog/news anymore, it's been absorbed by github.blog already and link on npmjs.com redirects there. Oh well, I'll leave my comment so you all can laugh about how wrong I was.
1. https://github.com/ossillate-inc/packj flags risky/malicious NPM/PyPI/Ruby dependencies
A more sane way for npm publish would be if the registry would just git checkout your repo during publish and strongly tie the package version to a commit hash.