{"action":"created","issue":{"url":"https://api.github.com/repos/npm/npm-registry-client/issues/43","labels_url":"https://api.github.com/repos/npm/npm-registry-client/issues/43/labels{/name}","comments_url":"https://api.github.com/repos/npm/npm-registry-client/issues/43/comments","events_url":"https://api.github.com/repos/npm/npm-registry-client/issues/43/events","html_url":"https://github.com/npm/npm-registry-client/pull/43","id":31819588,"number":43,"title":"public: support `gpg-sign` and `gpg-key` options","user":{"login":"indutny","id":238531,"avatar_url":"https://avatars.githubusercontent.com/u/238531?v=3","gravatar_id":"","url":"https://api.github.com/users/indutny","html_url":"https://github.com/indutny","followers_url":"https://api.github.com/users/indutny/followers","following_url":"https://api.github.com/users/indutny/following{/other_user}","gists_url":"https://api.github.com/users/indutny/gists{/gist_id}","starred_url":"https://api.github.com/users/indutny/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/indutny/subscriptions","organizations_url":"https://api.github.com/users/indutny/orgs","repos_url":"https://api.github.com/users/indutny/repos","events_url":"https://api.github.com/users/indutny/events{/privacy}","received_events_url":"https://api.github.com/users/indutny/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2014-04-18T19:32:31Z","updated_at":"2015-03-16T21:16:55Z","closed_at":"2015-03-16T21:16:55Z","pull_request":{"url":"https://api.github.com/repos/npm/npm-registry-client/pulls/43","html_url":"https://github.com/npm/npm-registry-client/pull/43","diff_url":"https://github.com/npm/npm-registry-client/pull/43.diff","patch_url":"https://github.com/npm/npm-registry-client/pull/43.patch"},"body":"This is a WIP for adding signatures to the npm packages. Fully enabling it will require server changes too.\r\n\r\nLet's discuss the approach here:\r\n\r\n* Does GPG seems a good idea for you?\r\n* How will that work on server-side? Will server store all user's public keys and be a PGP endpoint by itself?\r\n  Or should users upload their public keys to their accounts manually with `npm`?\r\n\r\nI did not do much, so hopefully you won't be biased to this because of me implementing part of it without approaching consensus. This is mostly a proof of concept."},"comment":{"url":"https://api.github.com/repos/npm/npm-registry-client/issues/comments/81945834","html_url":"https://github.com/npm/npm-registry-client/pull/43#issuecomment-81945834","issue_url":"https://api.github.com/repos/npm/npm-registry-client/issues/43","id":81945834,"user":{"login":"othiym23","id":418097,"avatar_url":"https://avatars.githubusercontent.com/u/418097?v=3","gravatar_id":"","url":"https://api.github.com/users/othiym23","html_url":"https://github.com/othiym23","followers_url":"https://api.github.com/users/othiym23/followers","following_url":"https://api.github.com/users/othiym23/following{/other_user}","gists_url":"https://api.github.com/users/othiym23/gists{/gist_id}","starred_url":"https://api.github.com/users/othiym23/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/othiym23/subscriptions","organizations_url":"https://api.github.com/users/othiym23/orgs","repos_url":"https://api.github.com/users/othiym23/repos","events_url":"https://api.github.com/users/othiym23/events{/privacy}","received_events_url":"https://api.github.com/users/othiym23/received_events","type":"User","site_admin":false},"created_at":"2015-03-16T21:16:55Z","updated_at":"2015-03-16T21:16:55Z","body":"See the discussion on npm/npm#4016, and also node-forward/discussions#29. I definitely want to get to package authentication / a better chain of custody for establishing package provenance, but don't think that GnuPG is the way to get us there. It's pretty unwieldy to make work in a cross-platform way, and then the npm community is obligated either to build its own web of trust or depend on somebody else's. We'd like to see something simpler, probably based on ssh keys and a very lightweight PKI tied to each registry in a very straightforward, explicit way (i.e. so private registries could have their own trust relationships and nobody's dependent on npm, Inc. for their PKI).\r\n\r\nAlso, this absolutely shouldn't be happening in the registry client, which should be a pure network client that doesn't know anything about how the packages are cached or built on disk."}}