Skip to content

feat(runtime): verify Node.js downloads with PGP signatures #1848

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fengmk2 merged 27 commits into from
Jun 23, 2026
Merged

feat(runtime): verify Node.js downloads with PGP signatures #1848

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
27 commits
Select commit Hold shift + click to select a range
4c72473
feat(runtime): verify SHASUMS256.txt PGP signature before installing …
fengmk2 Jun 15, 2026
a0274d9
ci(typos): exclude vendored PGP key blobs and fix unparsable typo
fengmk2 Jun 15, 2026
b0a3fad
refactor(runtime): address code review on PGP verification
fengmk2 Jun 15, 2026
48df908
fix(runtime): keep custom-mirror Node installs working without a sign…
fengmk2 Jun 15, 2026
1ed93d2
fix(runtime): enforce key policy and host-based signature requirement
fengmk2 Jun 15, 2026
c967de5
fix(runtime): validate subkey signing policy and effective key expiry
fengmk2 Jun 15, 2026
d53128a
fix(runtime): tighten primary-key policy; document expiry/keyring limits
fengmk2 Jun 15, 2026
4d33cb1
fix(runtime): use the latest self-signature for key expiry
fengmk2 Jun 16, 2026
7226d2d
fix(runtime): match gpgv and stop enforcing key expiry
fengmk2 Jun 16, 2026
580aed8
docs(rfcs): add RFC for Node SHASUMS PGP signature verification
fengmk2 Jun 16, 2026
c29124d
ci(runtime): auto-refresh vendored Node release keyring
fengmk2 Jun 16, 2026
0b95069
test(ci): temporarily trigger keyring workflow on PR branch
fengmk2 Jun 16, 2026
9d99a61
test(ci): remove temporary keyring workflow PR-branch trigger
fengmk2 Jun 16, 2026
05ae7c8
fix(runtime): address code review on keyring tooling and host check
fengmk2 Jun 16, 2026
cd8e29d
refactor(runtime): simplify SHASUMS resolution and drop redundant test
fengmk2 Jun 16, 2026
dfba53f
docs(rfcs): sync js-runtime RFC with SHASUMS PGP verification
fengmk2 Jun 16, 2026
48dd87b
feat(runtime): warn when a Node download is verified by checksum only
fengmk2 Jun 16, 2026
57a0ff0
refactor(runtime): use output::warn for the checksum-only notice, ski…
fengmk2 Jun 16, 2026
c3b82e2
refactor(runtime): log checksum-only fallback at debug, not as a warning
fengmk2 Jun 16, 2026
7c7a9fb
docs(rfcs): compare signature verification across Node version managers
fengmk2 Jun 16, 2026
5790e24
feat(runtime): add VP_NODE_SKIP_SIGNATURE_VERIFY escape hatch
fengmk2 Jun 16, 2026
8eb25f8
ci(security): temporarily use fork of security-action with rsa adviso…
fengmk2 Jun 16, 2026
1dc307a
ci(security): restore upstream security-action pin
fengmk2 Jun 16, 2026
0776757
Merge remote-tracking branch 'origin/main' into feat/verify-node-shas…
fengmk2 Jun 17, 2026
7de0581
Merge branch 'main' into feat/verify-node-shasums-pgp
fengmk2 Jun 21, 2026
bff6b48
Merge branch 'main' into feat/verify-node-shasums-pgp
fengmk2 Jun 22, 2026
4edcc60
Merge branch 'main' into feat/verify-node-shasums-pgp
fengmk2 Jun 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .typos.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,4 +10,6 @@ extend-exclude = [
"crates/fspy_detours_sys/detours",
"crates/fspy_detours_sys/src/generated_bindings.rs",
"packages/cli/src/oxfmt-config.ts",
# Vendored PGP key/signature blobs: base64 armor trips the spell checker.
"crates/vite_js_runtime/src/assets/**/*.asc",
]
Loading
Loading