[GH-ISSUE #1408] Publish npm Package with Provenance Statement #677

New issue

Closed

opened 2026-03-03 01:28:59 +03:00 by kerem · 3 comments

kerem commented

2026-03-03 01:28:59 +03:00

Owner

Originally created by @dsanders11 on GitHub (Nov 7, 2024).
Original GitHub issue: https://github.com/DavidAnson/markdownlint/issues/1408

Provenance statements are a nice way to increase confidence in the integrity of published npm packages. It would be great if this package adopted the practice.

A prerequisite to publishing with provenance statements would be to move the publish step to GitHub Actions. Happy to help with guidance there if you'd like any (regarding the workflow or setting up the npm token secret for publishing).

Originally created by @dsanders11 on GitHub (Nov 7, 2024). Original GitHub issue: https://github.com/DavidAnson/markdownlint/issues/1408  [Provenance statements](https://github.blog/security/supply-chain-security/introducing-npm-package-provenance/) are a nice way to increase confidence in the integrity of published npm packages. It would be great if this package adopted the practice. A prerequisite to publishing with provenance statements would be to move the publish step to GitHub Actions. Happy to help with guidance there if you'd like any (regarding the workflow or setting up the npm token secret for publishing).

kerem

2026-03-03 01:28:59 +03:00

closed this issue
added the
question
label

kerem commented

2026-03-03 01:29:00 +03:00

Author

Owner

@DavidAnson commented on GitHub (Nov 8, 2024):

https://dlaa.me/blog/post/npmprovenance

@DavidAnson commented on GitHub (Nov 8, 2024): https://dlaa.me/blog/post/npmprovenance

kerem commented

2026-03-03 01:29:00 +03:00

Author

Owner

@dsanders11 commented on GitHub (Nov 8, 2024):

Thanks for linking your blog post! Nice to see that you've considered it and shared your thoughts on it. Personally, I still believe there's value in it, so I hope you'll reconsider your stance in the future. 🙂

For what it's worth, regarding the bypassing 2FA concerns (very valid) Electron has been using a solution for that problem for quite some time now with Continuous Factor Auth (CFA). It's not a good fit for every project, but it has worked well for us and allows us to publish with a 2FA enabled account while also allowing a number of maintainers to provide the 2FA token without any of them having credentials for the publishing account.

@dsanders11 commented on GitHub (Nov 8, 2024): Thanks for linking your blog post! Nice to see that you've considered it and shared your thoughts on it. Personally, I still believe there's value in it, so I hope you'll reconsider your stance in the future. 🙂 For what it's worth, regarding the bypassing 2FA concerns (very valid) Electron has been using a solution for that problem for quite some time now with [Continuous Factor Auth (CFA)](https://github.com/continuousauth/web). It's not a good fit for every project, but it has worked well for us and allows us to publish with a 2FA enabled account while also allowing a number of maintainers to provide the 2FA token without any of them having credentials for the publishing account.

kerem commented

2026-03-03 01:29:00 +03:00

Author

Owner

@DavidAnson commented on GitHub (Nov 8, 2024):

If any of the claims I make are wrong, I am happy to learn why and reevaluate. :) But if they're right, what's the value of doing this?

@DavidAnson commented on GitHub (Nov 8, 2024): If any of the claims I make are wrong, I am happy to learn why and reevaluate. :) But if they're right, what's the value of doing this?

kerem referenced this issue

2026-03-07 20:06:57 +03:00

[GH-ISSUE #677] MD029 False Positive #2350