Trusted Publishing Badge

[targetlucked69]

📋 Description

Add badge that states that a npm package is published using OpenID Connect - https://docs.npmjs.com/trusted-publishers

[PyvesB]

Hello @targetlucked69 👋🏻

What would be the use case for this? Which API would we be able to hit to get the OpenID Connect information?

[targetlucked69]

Hi! Hmm there is no direct one, but we can hit the npm API and check the _npmUser property. The _npmUser property will have a trustedPublisher property that confirms a package is published via OIDC.

Example: https://registry.npmjs.org/vue/latest

"_npmUser": {
  "name": "GitHub Actions",
  "email": "npm-oidc-no-reply@github.com",
  "trustedPublisher": {
    "id": "github", // can be github or gitlab
    "oidcConfigId": "oidc:d56cba3e-2e34-4b01-9442-d2f0981e3993"
  }
},

[LitoMore]

This one?
https://www.npmjs.com/package/simple-icons/v/16.0.0/provenance

nvm, this endpoint has a Cloudflare captcha guard.

[LitoMore]

Hi! Hmm there is no direct one, but we can hit the npm API and check the _npmUser property. The _npmUser property will have a trustedPublisher property that confirms a package is published via OIDC.

The _npmUser is internal/implementation metadata. Underscore-prefixed fields in npm Registry responses (for example ⁠_id, ⁠_rev, ⁠_attachments) come from the registry's CouchDB-style storage layer and are not part of the public, stable API contract. We shouldn't rely on them for long-term use.

[jNullj]

We might be able to use the attestations field in the registry, see example at https://registry.npmjs.org/sigstore/2.3.1
npm doc claims it's used as part of the cryptographic proof, the URL points at the location to fetch a Sigstore Bundle to verify build by the OIDC.

While this is used to cryptographic verify the supply chain, I think that for our use we can use npm as the source of truth, correct me if im wrong as the docs say only supported providers are allowed, i assume they will not allow metadata without a verify.
We could in theory verify provenance attestations but that would take too much resources and does not align with shield's goals.

btw, we could add tursted publishing support to badge-maker

[targetlucked69]

Hi! Hmm there is no direct one, but we can hit the npm API and check the _npmUser property. The _npmUser property will have a trustedPublisher property that confirms a package is published via OIDC.

The _npmUser is internal/implementation metadata. Underscore-prefixed fields in npm Registry responses (for example ⁠_id, ⁠_rev, ⁠_attachments) come from the registry's CouchDB-style storage layer and are not part of the public, stable API contract. We shouldn't rely on them for long-term use.

agree here

[targetlucked69]

I think the dist.attestations field here like @jNullj said is the way to go for now. What do you think @LitoMore ?

[heliocarlitos]

I created a web version based on this library that allows you to create and customize GitHub statistics for a clean, organized, and professional README, without needing to write any code.

This tool is especially useful for those starting on GitHub or who have difficulty understanding documentation but want to improve their profile presentation.

Access the Application

https://nice-readme.vercel.app/

Main Features

1. Readme Streak Stats

Displays daily contribution streaks on GitHub, promoting consistency, discipline, and visual motivation directly in the public README.
https://nice-readme.vercel.app/streak-stats

2. Git Readme Stats

Shows general GitHub statistics, such as the number of commits, repositories, and most-used languages, allowing quick analysis of user activity.
https://nice-readme.vercel.app/github-stats

3. Pins

Allows you to pin relevant projects in the README, highlighting priority repositories and facilitating access to important work.
https://nice-readme.vercel.app/repo-pins

4. Badges

Provides informative and customizable badges for technologies, statuses, and metrics, improving visual communication and the credibility of your GitHub profile.
https://nice-readme.vercel.app/badges