你可以为你发布的软件包生成来源声明。这可以让你公开确定软件包的构建地点和发布者，从而提高你软件包的供应链安全性。
🌐 You can generate provenance statements for the packages you publish. This allows you to publicly establish where a package was built and who published a package, which can increase supply-chain security for your packages.
🌐 About npm provenance
npm 出处包括两种类型的证明：
🌐 npm provenance includes two types of attestations:
来源证明是通过公开提供软件包源代码和构建环境的构建说明的链接来建立的。这使开发者能够在下载软件包之前验证其构建的地点和方法。
🌐 The provenance attestation is established by publicly providing a link to a package's source code and build instructions from the build environment. This allows developers to verify where and how your package was built before they download it.
当由授权用户发布软件包时，注册中心会生成发布证明。当使用来源证明发布 npm 软件包时，它会由 Sigstore 公共服务服务器进行签名，并记录在公共透明度账本中，用户可以查看这些信息。
🌐 Publish attestations are generated by the registry when a package is published by an authorized user. When an npm package is published with provenance, it is signed by Sigstore public good servers and logged in a public transparency ledger, where users can view this information.
🌐 About Sigstore
Sigstore 是一套工具和服务，旨在简化使用短期、临时证书对软件进行签名的过程。它的三个主要组件是一个命令行工具、一个证书颁发机构和一个时间戳透明日志。
🌐 Sigstore is a collection of tools and services aimed at making it easy to use short-lived, ephemeral certificates to sign software. Its three main components are a CLI tool, a certificate authority, and a time-stamping transparency log.
证书机构与任何包含可验证构建信息的 OIDC 提供者进行联合。它作为构建系统和软件包注册中心之间的中介，通过验证 OIDC 令牌的完整性，颁发包含该构建信息的签名证书，然后将签名证书记录到不可篡改的账本中。
🌐 The certificate authority federates with any OIDC provider that includes verifiable build information. It acts as an intermediary between build systems and package registries by verifying the integrity of the OIDC token, issues a signing certificate that contains that build information, and then logging the signing certificate to an immutable ledger.
透明度日志服务提供了一个公开、可验证、防篡改的签署证明帐本。这确保了公共服务的透明性，同时也提供了一种方法，可以在软件包注册表受到破坏时检测篡改软件包的尝试。
🌐 The transparency log service provides a public, verifiable, tamper-evident ledger of signed attestations. This ensures transparency of the public service, as well as providing a way to detect attempts to tamper with a package if a package registry were to be compromised.
🌐 Provenance limitations
🌐 Prerequisites
在你可以发布带有出处的包之前，你必须：
🌐 Before you can publish your packages with provenance, you must:
9.5.0+，因为旧版本不支持 npm 来源）。更多信息，请参阅 "尝试最新稳定版 npm"。package.json 配置了一个公共 repository，并且与你发布来源的地方匹配（区分大小写）。注意： 如果你使用 受信任的发布，系统会自动为你的软件包生成来源证明，无需使用 --provenance 标志。这提供了更高的安全性，并消除了在 CI/CD 工作流中使用访问令牌的需求。
🌐 Publishing packages with provenance via GitHub Actions
为了建立来源证明，你必须使用受支持的云 CI/CD 提供商和云托管的运行器来发布你的软件包。GitHub Actions 是一个受支持的 CI/CD 平台，允许你自动化软件开发任务。更多信息，请参见 GitHub 文档中的 GitHub 操作。
🌐 In order to establish provenance, you must use a supported cloud CI/CD provider and a cloud-hosted runner to publish your packages. GitHub Actions is a supported CI/CD platform that allows you to automate software development tasks. For more information, see GitHub Actions in the GitHub documentation.
要更新 GitHub Actions 工作流程以发布带有来源的包，你必须：
🌐 To update your GitHub Actions workflow to publish your packages with provenance, you must:
授予铸造 ID 令牌的权限：
permissions:id-token: write
在 GitHub 托管的运行器 上运行：
runs-on: ubuntu-latest
在你的发布命令中添加 --provenance 标志：
npm publish --provenance
如果你是第一次发布包，你还需要显式设置对公共的访问：
npm publish --provenance --access public
🌐 Example GitHub Actions workflow
此示例工作流将包发布到 npm 注册表，并附上出处。
🌐 This example workflow publishes a package to the npm registry with provenance.
name: Publish Package to npmjson:release:types: [published]jobs:build:runs-on: ubuntu-latestpermissions:contents: readid-token: writesteps:- uses: actions/checkout@v4- uses: actions/setup-node@v4with:node-version: '20.x'registry-url: 'https://registry.npmjs.org'- run: npm ci- run: npm publish --provenance --access publicenv:NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
🌐 Using third-party package publishing tools
如果你使用不直接调用 npm publish 命令的工具发布你的软件包，你可以在 GitHub Actions 工作流中执行以下操作之一，以带来源信息发布你的软件包。
🌐 If you publish your packages with tools that do not directly invoke the npm publish command, you can do one of the following in your GitHub Actions workflow to publish your packages with provenance.
配置环境变量： 在你的 GitHub Actions 工作流中，你可以使用一个名为 NPM_CONFIG_PROVENANCE 的环境变量，并将其设置为 true。
配置你的 package.json 文件： 你可以在 package.json 文件中添加一个 publishConfig 块：
"publishConfig": {"provenance": true},
添加 .npmrc 文件： 你可以通过以下条目将 .npmrc 文件添加到你的项目中：
provenance=true
注意： 要使用 Yarn 发布带有来源信息的包，需要 v4.9.0 或更高版本。
🌐 Publishing packages with provenance via GitLab CI/CD
为了建立来源证明，你必须使用受支持的云端 CI/CD 提供商和云托管的运行器来发布你的软件包。GitLab CI/CD 是受支持的 CI/CD 平台，它允许你自动化软件开发任务。更多信息，请参见 GitLab 文档中的 在 GitLab CI/CD 中生成来源信息。
🌐 In order to establish provenance, you must use a supported cloud CI/CD provider and a cloud-hosted runner to publish your packages. GitLab CI/CD is a supported CI/CD platform that allows you to automate software development tasks. For more information, see Generating provenance in GitLab CI/CD in the GitLab documentation.
🌐 Example GitLab CI job
此示例作业在推送 git 标签时会将带有来源信息的包发布到 npm 注册表。别忘了在你的 GitLab 项目设置中定义 NPM_TOKEN 变量。
🌐 This example job publishes a package to the npm registry with provenance when a git tag is pushed. Don't forget to define the NPM_TOKEN variable in your GitLab project settings.
publish:image: 'node:20'rules:- if: $CI_COMMIT_TAGid_tokens:SIGSTORE_ID_TOKEN:aud: sigstorescript:- npm config set //registry.npmjs.org/:_authToken "$NPM_TOKEN"- npm publish --provenance --access public
🌐 Verifying provenance attestations
你可以使用以下 audit 命令验证已下载软件包的来源声明：
🌐 You can verify the provenance attestations of downloaded packages with the following audit command:
npm audit signatures
显示项目中所有包的已验证注册表签名和已验证证明的计数的示例响应：
🌐 Example response showing the count of verified registry signatures and verified attestations for all of the packages in a project:
audited 1267 packages in 6s1267 packages have verified registry signatures74 packages have verified attestations
由于来源证明是一项全新的功能，安全特性可能会随着时间的推移被添加到证明格式中（或在其中更改）。为了确保你始终能够验证证明签名，请检查你是否运行的是最新版本的 npm CLI。请注意，这通常意味着需要将 npm 更新到高于随 Node.js 一起提供的版本。
🌐 Because provenance attestations are such a new feature, security features may be added to (or changed in) the attestation format over time. To ensure that you're always able to verify attestation signatures check that you're running the latest version of the npm CLI. Please note this often means updating npm beyond the version that ships with Node.js.