209-every-registry-package-carries-provenance

Every npm package carries provenance, and npm and crates.io publish through trusted publishing first

Lifecycle approvedImplementation completeVerification unknownQualification unknown

Spec 201 put the registry channels out of scope on the claim that "npm publishes with provenance". It does not: `publish-npm` publishes with a long-lived `NPM_TOKEN`, without `--provenance` and without an OIDC token, and `spec-spine@0.32.0` carries registry signatures but no attestation. This spec makes npm provenance required on every package the release publishes, moves npm and crates.io to trusted publishing (OIDC) with the stored token kept only as a fallback, and makes a version that is already public without provenance fail the run instead of being skipped.

Read the full pinned specification ↗

Relationships

depends on

amends

201-a-release-proves-itself-after-it-publishes

Claimed units

extends

{
  "nature": "additive",
  "spec": "006-distribution",
  "unit": {
    "kind": "file",
    "path": ".github/workflows/release.yml"
  }
}

extends

{
  "nature": "additive",
  "spec": "006-distribution",
  "unit": {
    "kind": "file",
    "path": "docs/releasing.md"
  }
}

Source headings

209: Every npm package carries provenance, and npm and crates.io publish through trusted publishing first
1. Purpose
2. Territory
3. Behavior
3.1 npm: trusted publishing first, provenance always
3.2 npm: present means attested
3.3 crates.io: trusted publishing first
3.4 Pinned like the rest
4. Out of scope
5. Resolved decisions
Verification

Frozen anchors

No frozen anchors declared.