Hi @dnakov — first, thanks for building and maintaining litter/kittylitter. It's a useful project and we appreciate the active release cadence.
We're a downstream consumer that pins dependencies by cryptographic signature as part of our supply-chain verification process. We noticed that all release tags in this repo (including v0.3.2) are lightweight tags, which means they cannot carry a GPG or SSH signature. This makes it impossible for downstream users to cryptographically verify that a given release artifact originated from you rather than from a compromised tag or a GitHub account takeover.
We'd like to request that future release tags be created as signed annotated tags (e.g. git tag -s v0.3.3 -m "v0.3.3" with your GPG key, or GitHub's built-in SSH signing). If releases are cut via GitHub Actions, the workflow can be updated to use actions/create-release with a signing step, or simply configured to produce annotated tags. Signing the npm tarball via npm publish --provenance (npm provenance attestation) would also be welcome as a complementary measure.
GitHub's documentation on setting up commit and tag signature verification is here if helpful:
https://docs.github.com/en/authentication/managing-commit-signature-verification
We're happy to help draft a workflow change if that would be useful. Thanks for considering this — it's a small step that meaningfully improves the security posture for everyone depending on this package.
Hi @dnakov — first, thanks for building and maintaining litter/kittylitter. It's a useful project and we appreciate the active release cadence.
We're a downstream consumer that pins dependencies by cryptographic signature as part of our supply-chain verification process. We noticed that all release tags in this repo (including v0.3.2) are lightweight tags, which means they cannot carry a GPG or SSH signature. This makes it impossible for downstream users to cryptographically verify that a given release artifact originated from you rather than from a compromised tag or a GitHub account takeover.
We'd like to request that future release tags be created as signed annotated tags (e.g.
git tag -s v0.3.3 -m "v0.3.3"with your GPG key, or GitHub's built-in SSH signing). If releases are cut via GitHub Actions, the workflow can be updated to useactions/create-releasewith a signing step, or simply configured to produce annotated tags. Signing the npm tarball vianpm publish --provenance(npm provenance attestation) would also be welcome as a complementary measure.GitHub's documentation on setting up commit and tag signature verification is here if helpful:
https://docs.github.com/en/authentication/managing-commit-signature-verification
We're happy to help draft a workflow change if that would be useful. Thanks for considering this — it's a small step that meaningfully improves the security posture for everyone depending on this package.