Package Registry Security
Package registry security protects the services that store and distribute software packages. It controls who can publish, what clients install, and which evidence you check before trusting a release.
itSoftware supply chain security | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
Package Registry Security
A package registry sits between software producers and consumers. Producers publish packages. The registry stores versions and metadata. Package managers resolve names and versions, download files, and may run package code during installation.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://repos.openssf.org/principles-for-package-repository-security.html
Supports
- Package-registry taxonomy and the operator, publisher, client trust boundary
- Authentication, authorization, immutability, reporting, malware detection, advisory, and client controls
- Four maturity levels across authentication, authorization, general capabilities, and client tooling
- https://repos.openssf.org/trusted-publishers-for-all-package-repositories
Supports
- OpenID Connect workload identity exchanged for short-lived, scoped publishing authority
- Trust policies, identity-provider assumptions, token sensitivity, and workflow-security limits
- Removal of long-lived publishing secrets from supported automated workflows
- https://repos.openssf.org/build-provenance-for-all-package-registries
Supports
- Verifiable links among an artifact, source code, and build instructions
- Digest, workload identity, signature, trust, and transparency verification
- Provenance as transparency evidence rather than proof of package safety
- https://docs.npmjs.com/trusted-publishers/
Supports
- npm trusted-publisher configuration and short-lived credentials
- Restriction of traditional token publishing after migration
- Automatic provenance for supported public trusted-publishing workflows
- https://docs.npmjs.com/using-npm/scope.html
Supports
- Organization-controlled package namespaces
- Mapping a package scope to a registry
- https://docs.pypi.org/trusted-publishers/
Supports
- PyPI verification of continuous-integration identity
- Short-lived, project-scoped upload tokens
- https://pip.pypa.io/en/stable/topics/secure-installs/
Supports
- Pinned requirements and local hash checking for exact package bytes
- Limits of registry-provided download hashes
- Binary-only installation as an additional consumer restriction
- https://docs.github.com/en/packages/learn-github-packages/about-permissions-for-github-packages
Supports
- Read, write, and administration permissions for package registries
- Package scopes, inherited permissions, and workflow access
- https://github.com/sindresorhus/awesome
Supports
- Starting point for curated awesome-list discovery
- https://github.com/bureado/awesome-software-supply-chain-security
Supports
- Curated discovery of OpenSSF Package Analysis, Open Source Insights, OSV-Scanner, and Socket
- https://openssf.org/package-analysis/
Supports
- Analysis of package file, network, and command behavior
- Tracking behavior changes to help detect suspicious packages
- https://deps.dev/
Supports
- Package version, dependency, advisory, license, and project metadata
- Web, application programming interface, and dataset access
- https://google.github.io/osv-scanner/
Supports
- Vulnerability checks for source trees, lockfiles, and software bills of materials
- Open Source Vulnerability data as the advisory source
- https://docs.socket.dev/docs/getting-started
Supports
- Dependency-change review through pull requests
- Command-line and application programming interface access to package-risk analysis