npm

type AttestationRef ¶

type AttestationRef struct {
	URL        string `json:"url"`
	Provenance struct {
		PredicateType string `json:"predicateType"`
	} `json:"provenance"`
}

AttestationRef is the npm dist.attestations pointer published alongside a version when the publisher used trusted publishing. The URL points at a separate endpoint that returns the signed sigstore bundle(s); Provenance.PredicateType hints at the in-toto predicate type living there (typically https://slsa.dev/provenance/v1).

type ContentPolicy ¶

type ContentPolicy struct {
	Class string `json:"class"` // "dual-use" is the only value npm defines today
}

ContentPolicy is the npm package.json "contentPolicy" field, propagated into the packument version object. Maintainers set it to declare dual-use content (security-relevant capabilities that automated scanning could otherwise flag as malicious). See https://docs.npmjs.com/policies/dual-use.

type Registry ¶

type Registry struct {
	// contains filtered or unexported fields
}

func New(baseURL string, client *core.Client) *Registry

func (r *Registry) Ecosystem() string

func (r *Registry) FetchDependencies(ctx context.Context, name, version string) ([]core.Dependency, error)

func (r *Registry) FetchMaintainers(ctx context.Context, name string) ([]core.Maintainer, error)

func (r *Registry) FetchPackage(ctx context.Context, name string) (*core.Package, error)

func (r *Registry) FetchVersion(ctx context.Context, name, version string) (*core.Version, error)

func (r *Registry) FetchVersions(ctx context.Context, name string) ([]core.Version, error)

func (r *Registry) URLs() core.URLBuilder

type Signature ¶

type Signature struct {
	Sig   string `json:"sig"`
	Keyid string `json:"keyid"`
}

Signature is one entry from a version's dist.signatures array — an ECDSA P-256 signature over "{name}@{version}:{integrity}" produced by the registry's signing key. Keyid identifies which key in /-/npm/v1/keys to verify against.

type URLs ¶

type URLs struct {
	// contains filtered or unexported fields
}

func (u *URLs) Documentation(name, version string) string

func (u *URLs) Download(name, version string) string

func (u *URLs) PURL(name, version string) string

func (u *URLs) Registry(name, version string) string