isaacs/npm — pull request #4016 by rlidwka (2013-10-20 15:33:52+00:00)
Title: Package verification using gpg

It's a step towards package signing that was in roadmap for a quite long time. Since nobody seems to be doing that, I started to implement it myself, so...

For all current packages behaviour of npm is not changed.

However, if there's a `dist.signature` field near a `dist.tarball` field we're downloading (i.e. with `npm install`), npm will assume that `dist.signature` is a url pointing to a detached pgp signature, will download it and verify a tarball with it using external `gpg` program.

Web of trust is not used, all keys in the default public keyring are treated equally.

I also uploaded a [test package](http://registry.npmjs.org/test-package-signing/valid) you can use to check if npm behaves correctly in different cases. That's how you can test it:

```perl
# Add a public key to your keyring, it can be a bad idea to add pgp
# keys this way, but it looks good enough for testing purposes
gpg --keyserver pgp.mit.edu --recv-key 0x7FC5D0F9888C20BC

# This is a only one correctly signed package, should be installed without issues
npm install test-package-signing@valid

# This package has an incorrect signature belonging to another file
npm install test-package-signing@badsig

# This is a package signed with a different key you don't have
npm install test-package-signing@diffkey

# This package has an garbage instead of signature
npm install test-package-signing@invalid

# This package has a wrong signature url (no sig uploaded)
npm install test-package-signing@nosig
```

It's a verification only. npm is still unable to sign anything, and it would require another few weeks to implement properly and a couple of pull requests to different npm dependencies. So I'd rather see your feedback to this one before continuing.