🔑 Insights from checking the top 5k npm packages:
- only 3.72% (186) have "provenance" (which launched ~2yrs ago)
- 5.78% (289) are reproducible today & - with additional strategies (ex. yarn/pnpm etc.) - that # will only grow with no additional work by maintainers
Now if I wanted to target people using this tool, I'd create a dangling commit in my repo and push a valid package from main but point to that commit hash. Then npx reproduce will run my malicious build script that I didn't need to risk publishing to npm.
We'll likely fast-follow this with a GHA to spin up the envs for you & run the test (making it easy to quasi-"sandbox"). You'll want to control your own env if you're truly security conscious & don't trust someone else's CI/config to lock down the env.
If I understand your hypothetical, you're saying any git ref could potentially have malware that was not published into the npm package, which is valid no matter what but reproducible check **shouldn't** pass if building+packing fails to produce the same integrity as exists in the registry.
Comments
- only 3.72% (186) have "provenance" (which launched ~2yrs ago)
- 5.78% (289) are reproducible today & - with additional strategies (ex. yarn/pnpm etc.) - that # will only grow with no additional work by maintainers
Does it support monorepos? Depending on implementation details, monorepos could be pretty damn tricky.
but im working on it for the CLI right now, so I think it should be supported.
basic idea is the manifest points to the git directory and are you able to run `npm pack|publish` from there
What may interest you is just the actual cached set of metadata from that run, so I just threw that into a gist for you:
https://gist.github.com/darcyclarke/11be63ad9b855507d08247405e8b945e
`$ reproduce semver@>=6`
`$ reproduce [email protected]`
Now if I wanted to target people using this tool, I'd create a dangling commit in my repo and push a valid package from main but point to that commit hash. Then npx reproduce will run my malicious build script that I didn't need to risk publishing to npm.