Trusted Publishing Badge #11559

Activity

1. PyvesB commented on Dec 13, 2025

   

   PyvesB

   on Dec 13, 2025

   Member

   More actions

   Hello @targetlucked69 👋🏻

   What would be the use case for this? Which API would we be able to hit to get the OpenID Connect information?
2. PyvesB

   added

   service-badgeNew or updated service badgeNew or updated service badge

   on Dec 13, 2025
3. targetlucked69 commented on Dec 14, 2025

   

   targetlucked69

   on Dec 14, 2025

   Last edited by targetlucked69

   Author

   More actions

   Hi! Hmm there is no direct one, but we can hit the npm API and check the _npmUser property. The _npmUser property will have a trustedPublisher property that confirms a package is published via OIDC.

   Example: https://registry.npmjs.org/vue/latest

   

   "_npmUser": {
     "name": "GitHub Actions",
     "email": "npm-oidc-no-reply@github.com",
     "trustedPublisher": {
       "id": "github", // can be github or gitlab
       "oidcConfigId": "oidc:d56cba3e-2e34-4b01-9442-d2f0981e3993"
     }
   },
4. LitoMore commented on Jan 8, 2026

   

   LitoMore

   on Jan 8, 2026

   Last edited by LitoMore

   Member

   More actions

   This one?
   https://www.npmjs.com/package/simple-icons/v/16.0.0/provenance

   nvm, this endpoint has a Cloudflare captcha guard.
5. LitoMore commented on Jan 8, 2026

   

   LitoMore

   on Jan 8, 2026

   Member

   More actions

   Hi! Hmm there is no direct one, but we can hit the npm API and check the _npmUser property. The _npmUser property will have a trustedPublisher property that confirms a package is published via OIDC.

   The _npmUser is internal/implementation metadata. Underscore-prefixed fields in npm Registry responses (for example ⁠_id, ⁠_rev, ⁠_attachments) come from the registry's CouchDB-style storage layer and are not part of the public, stable API contract. We shouldn't rely on them for long-term use.
6. jNullj commented on Jan 10, 2026

   

   jNullj

   on Jan 10, 2026

   Member

   More actions

   We might be able to use the attestations field in the registry, see example at https://registry.npmjs.org/sigstore/2.3.1
   npm doc claims it's used as part of the cryptographic proof, the URL points at the location to fetch a Sigstore Bundle to verify build by the OIDC.

   While this is used to cryptographic verify the supply chain, I think that for our use we can use npm as the source of truth, correct me if im wrong as the docs say only supported providers are allowed, i assume they will not allow metadata without a verify.
   We could in theory verify provenance attestations but that would take too much resources and does not align with shield's goals.

   btw, we could add tursted publishing support to badge-maker
7. targetlucked69 commented on Jan 15, 2026

   

   targetlucked69

   on Jan 15, 2026

   Author

   More actions

   Hi! Hmm there is no direct one, but we can hit the npm API and check the _npmUser property. The _npmUser property will have a trustedPublisher property that confirms a package is published via OIDC.

   The _npmUser is internal/implementation metadata. Underscore-prefixed fields in npm Registry responses (for example ⁠_id, ⁠_rev, ⁠_attachments) come from the registry's CouchDB-style storage layer and are not part of the public, stable API contract. We shouldn't rely on them for long-term use.

   agree here
8. targetlucked69 commented on Jan 15, 2026

   

   targetlucked69

   on Jan 15, 2026

   Author

   More actions

   I think the dist.attestations field here like @jNullj said is the way to go for now. What do you think @LitoMore ?
9. heliocarlitos commented on Feb 15, 2026

   

   heliocarlitos

   on Feb 15, 2026 · Hidden as spam

   show commentMore actions