fix(install): require npm provenance for platform packages - #2440
fix(install): require npm provenance for platform packages#2440kazupon wants to merge 10 commits into
Conversation
✅ Deploy Preview for viteplus-preview canceled.
|
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3c8979569f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@kazupon can you update install.ps1 too? |
|
@fengmk2 If you're referring to the Codex path-spoofing finding, it was specific to install.sh, whose AWK parser previously flattened JSON paths into dot-joined strings. install.ps1 uses nested property access ($Metadata.dist.attestations.provenance.predicateType), so a dotted top-level key cannot satisfy the check. I also added the dotted-top-level-key regression case to both installer test suites, and the PowerShell case rejects it. Please let me know if you had a different PowerShell concern in mind 🙏 |
…ackage-provenance # Conflicts: # .github/workflows/test-standalone-install.yml
…ackage-provenance # Conflicts: # crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/shim_package_manager_first_use/snapshots/non_interactive_use_defaults_to_managed_without_deciding.md
|
@kazupon Thanks, I will verify it once, and if there are no issues, I will merge it. |
|
@kazupon I think we should wait for #2611 finish, the install flow will have a big refactor after that. cc @liangmiQwQ |
2 participants
Summary
Closes #1826.
Vite+ previously accepted platform package metadata without requiring npm provenance, allowing an unverified release binary to reach the download path.
Require supported SLSA provenance before downloading standard release binaries through the standalone installers,
vp upgrade, andvp-setup.exe.Changes
dist.attestations.provenance.predicateTypeagainst SLSA v1 and v0.2 in the shared Rust resolver.Testing
cargo test -p vp_setup registry: provenance parsing, error classification, and download ordering.just check,just test,just lint: workspace compilation, tests, and Clippy.