diff options
| author | Divy Srivastava <dj.srivastava23@gmail.com> | 2024-02-28 07:58:02 +0530 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-02-28 07:58:02 +0530 |
| commit | 9b5d2f8c1bae498d78400c8e9263bcae6e521adf (patch) | |
| tree | 69453f9be9fc65774f3087bb986409aadee5acb4 /cli/Cargo.toml | |
| parent | e9fe71acb53c8856754ef892c463253cb96087ce (diff) | |
feat(publish): provenance attestation (#22573)
Supply chain security for JSR.
```
$ deno publish --provenance
Successfully published @divy/test_provenance@0.0.3
Provenance transparency log available at https://search.sigstore.dev/?logIndex=73657418
```
0. Package has been published.
1. Fetches the version manifest and verifies it's matching with uploaded
files and exports.
2. Builds the attestation SLSA payload using Github actions env.
3. Creates an ephemeral key pair for signing the github token
(aud=sigstore) and DSSE pre authentication tag.
4. Requests a X.509 signing certificate from Fulcio using the challenge
and ephemeral public key PEM.
5. Prepares a DSSE envelop for Rekor to witness. Posts an intoto entry
to Rekor and gets back the transparency log index.
6. Builds the provenance bundle and posts it to JSR.
Diffstat (limited to 'cli/Cargo.toml')
| -rw-r--r-- | cli/Cargo.toml | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/cli/Cargo.toml b/cli/Cargo.toml index 18bafb77e..494658bb8 100644 --- a/cli/Cargo.toml +++ b/cli/Cargo.toml @@ -120,12 +120,14 @@ notify.workspace = true once_cell.workspace = true open = "5.0.1" os_pipe.workspace = true +p256.workspace = true percent-encoding.workspace = true phf.workspace = true pin-project.workspace = true quick-junit = "^0.3.5" rand = { workspace = true, features = ["small_rng"] } regex.workspace = true +reqwest.workspace = true ring.workspace = true rustyline.workspace = true rustyline-derive = "=0.7.0" @@ -133,6 +135,7 @@ serde.workspace = true serde_repr.workspace = true sha2.workspace = true shell-escape = "=0.1.5" +spki = { version = "0.7", features = ["pem"] } tar.workspace = true tempfile.workspace = true text-size = "=1.1.0" |