pxcloud/pkg-fetch
6
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

README: add a "Security" section (#198)

Browse Source
This commit is contained in:
Jesse Chan 2021-06-06 23:03:33 +01:00 committed by GitHub
parent 5bbafb7e09
commit dbebb23edc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 28 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
README.md
View File

@ -19,3 +19,31 @@ A utility to fetch or build patched Node binaries used by [pkg](https://github.c
<em id="fn2">[2]</em>: best-effort basis, not semver-protected.
<em id="fn3">[3]</em>: [mandatory code signing](https://developer.apple.com/documentation/macos-release-notes/macos-big-sur-11_0_1-universal-apps-release-notes) is enforced by Apple.
## Security
We do not expect this project to have vulnerabilities of its own. Nonetheless, as this project distributes prebuilt Node.js binaries,
**Node.js security vulnerabilities affect binaries distributed by this project, as well.**
Like most of you, this project does not have access to advance/private disclosures of Node.js security vulnerabilities. We can only closely monitor the **public** security advisories from the Node.js team. It takes time to build and release a new set of binaries, once a new Node.js version has been released.
We aim to complete the full cycle within a day, when there is a security update. Please [open an issue](https://github.com/vercel/pkg-fetch/issues/new) if there is no action for a while.
**It is possible for this project to fall victim to a supply chain attack.**
This project deploys multiple defense measures to ensure that the safe binaries are delivered to users:
- Binaries are compiled by [Github Actions](https://github.com/vercel/pkg-fetch/actions)
- Workflows and build logs are transparent and auditable.
- Artifacts are the source of truth. Even repository/organization administrators can't tamper them.
- Hashes of binaries are hardcoded in [source](https://github.com/vercel/pkg-fetch/blob/HEAD/lib/expected.ts)
- Origins of the binaries are documented.
- Changes to the binaries are logged by VCS (Git) and are publicly visible.
- `pkg-fetch` rejects the binary if it does not match the hardcoded hash.
- GPG-signed hashes are available in [Releases](https://github.com/vercel/pkg-fetch/releases)
- Easy to spot a compromise.
- `pkg-fetch` package on npm is strictly permission-controlled
- Only authorized Vercel employees can push new revisions to npm.
Report to [security@vercel.com](mailto:security@vercel.com), if you noticed a disparity between (hashes of) binaries.