fix(install): require npm provenance for platform packages - #2440
fix(install): require npm provenance for platform packages#2440kazupon wants to merge 3 commits into
Conversation
✅ Deploy Preview for viteplus-preview canceled.
|
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3c8979569f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| fail_json("expected colon in JSON object") | ||
| } | ||
| json_pos++ | ||
| child_path = path == "" ? key : path "." key |
There was a problem hiding this comment.
When a platform package is published outside the trusted release flow, it can include a top-level package field named dist.attestations.provenance.predicateType with an accepted value. Because this parser represents paths by concatenating raw keys with ., that field is indistinguishable from the genuine nested npm provenance field; combined with the registry-supplied dist.tarball, install.sh passes the gate and downloads an unprovenanced binary. Track path segments or structural depth separately so dots inside package-defined keys cannot satisfy the provenance check.
Useful? React with 👍 / 👎.
1 participant
Summary
Closes #1826.
Vite+ previously accepted platform package metadata without requiring npm provenance, allowing an unverified release binary to reach the download path.
Require supported SLSA provenance before downloading standard release binaries through the standalone installers,
vp upgrade, andvp-setup.exe.Changes
dist.attestations.provenance.predicateTypeagainst SLSA v1 and v0.2 in the shared Rust resolver.Testing
cargo test -p vp_setup registry: provenance parsing, error classification, and download ordering.just check,just test,just lint: workspace compilation, tests, and Clippy.