npmpackage.info

@sigstore/bundle

Code-signing for npm packages

3.0.0

157

Apache-2.0

TypeScript

7.10 kB

251,137,842 8.7

Installations

npm install @sigstore/bundle

Pull Requests

Open

1

Total

1,289

Closed

246

Merged

1,042

Issues

Open

4

Total

32

Closed

28

Releases

129

@sigstore/mock@0.9.0

Published on 26 Nov 2024

@sigstore/verify@2.0.0

Published on 14 Oct 2024

@sigstore/tuf@3.0.0

Published on 14 Oct 2024

@sigstore/sign@3.0.0

Published on 14 Oct 2024

@sigstore/rekor-types@3.0.0

Published on 14 Oct 2024

@sigstore/oci@0.4.0

Published on 14 Oct 2024

View all 129 releases

Developer

sigstore

Developer Guide

BETA

Module System

CommonJS

Min. Node Version

^18.17.0 || >=20.5.0

Typescript Support

Yes

Node Version

18.17.0

NPM Version

10.9.0 Statistics

157 Stars

1,084 Commits

23 Forks

7 Watching

23 Branches

43 Contributors

Updated on 28 Nov 2024

Bundle Size

38.07 kB

Minified

7.10 kB

Minified + Gzipped

Bundlephobia

Languages

TypeScript (97.99%)

JavaScript (1.26%)

Makefile (0.67%)

Shell (0.08%)

Batchfile (0.01%)

Total Downloads

Cumulative downloads

Total Downloads

251,137,842

Last day

-4.7%

928,014

Compared to previous day

Last week

5.8%

5,307,120

Compared to previous week

Last month

7.7%

21,696,476

Compared to previous month

Last year

536.2%

217,023,975

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

@sigstore/protobuf-specs

Versions

sigstore-js ·

JavaScript libraries for interacting with Sigstore services.

Packages

sigstore - Client library implementing Sigstore signing/verification workflows.
@sigstore/bundle - TypeScript types and utility functions for working with Sigstore bundles.
@sigstore/cli - Command line interface for signing/verifying artifacts with Sigstore.
@sigstore/sign - Library for generating Sigstore signatures.
@sigstore/tuf - Library for interacting with the Sigstore TUF repository.
@sigstore/rekor-types - TypeScript types for the Sigstore Rekor REST API.
@sigstore/mock - Mocking library for Sigstore services.

Development

Changesets

If you are contributing a user-facing or noteworthy change that should be added to the changelog, you should include a changeset with your PR by running the following command:

1npx changeset add

Follow the prompts to specify whether the change is a major, minor or patch change. This will create a file in the .changesets directory of the repo. This change should be committed and included with your PR.

Release Steps

Whenever a new changeset is merged to the "main" branch, the release workflow will open a PR (or append to the existing PR if one is already open) with the all of the pending changesets.

Publishing a release simply requires that you approve/merge this PR. This will trigger the publishing of the package to the npm registry and the creation of the GitHub release.

Licensing

sigstore-js is licensed under the Apache 2.0 License.

Contributing

See the contributing docs for details.

Code of Conduct

Everyone interacting with this project is expected to follow the sigstore Code of Conduct.

Security

Should you discover any security issues, please refer to sigstore's security process.

Info

sigstore-js is developed as part of the sigstore project.

We also use a slack channel! Click here for the invite link.

No vulnerabilities found.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Dependency-Update-Tool

Determines if the project uses a dependency update tool.

10

License

Determines if the project has defined a license.

10

Maintained

Determines if the project is "actively maintained".

10

Security-Policy

Determines if the project has published a security policy.

10

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

8

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

8

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

6

Contributors

Determines if the project has a set of contributors from multiple organizations (e.g., companies).

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Fuzzing

Determines if the project uses fuzzing.

Score

8.7

/10

Last Scanned on 2024-11-26T20:54:57Z

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More