@stacksjs/registry 0.11.5 → 0.11.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +29 -0
- package/dist/index.js +497 -496
- package/dist/server.js +497 -496
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -14,6 +14,7 @@ critical claims directly against the route handlers.
|
|
|
14
14
|
- **S3 storage** - Tarball storage via S3 (or local filesystem for development)
|
|
15
15
|
- **Analytics** - Track download counts and package statistics
|
|
16
16
|
- **Portable metadata** - Local/in-memory stores for development and an object-storage snapshot for production
|
|
17
|
+
- **Publish-time malware scanning** - Fail-closed ClamAV scanning before any package becomes installable
|
|
17
18
|
- **Zero config** - Works out of the box for local development
|
|
18
19
|
|
|
19
20
|
## Quick Start
|
|
@@ -93,8 +94,36 @@ DYNAMODB_ANALYTICS_TABLE=registry-analytics
|
|
|
93
94
|
AWS_ACCESS_KEY_ID=your-key
|
|
94
95
|
AWS_SECRET_ACCESS_KEY=your-secret
|
|
95
96
|
AWS_REGION=us-east-1
|
|
97
|
+
|
|
98
|
+
# Required in production (defaults to required when NODE_ENV=production)
|
|
99
|
+
PANTRY_MALWARE_SCANNING=required
|
|
100
|
+
CLAMD_SOCKET=/run/clamav/clamd.ctl
|
|
101
|
+
CLAMD_HOST=127.0.0.1
|
|
102
|
+
CLAMD_PORT=3310
|
|
103
|
+
PANTRY_BINARY_STAGING_SECRET=replace-with-openssl-rand-hex-32
|
|
104
|
+
PANTRY_REQUIRE_BINARY_SCAN_ATTESTATION=true
|
|
96
105
|
```
|
|
97
106
|
|
|
107
|
+
See [publish-time malware scanning](../../docs/registry-malware-scanning.md) for
|
|
108
|
+
the verdict contract, dual-use `contentPolicy`/`DISCLOSURE` requirements, clamd
|
|
109
|
+
deployment, EICAR rehearsal, monitoring, and incident runbook.
|
|
110
|
+
`CLAMD_SOCKET` takes precedence over `CLAMD_HOST`/`CLAMD_PORT`; use the socket
|
|
111
|
+
for a local systemd-managed daemon and TCP for containers or remote scanners.
|
|
112
|
+
|
|
113
|
+
### Native binary publication
|
|
114
|
+
|
|
115
|
+
Native artifacts use an authenticated scan-before-promote API:
|
|
116
|
+
|
|
117
|
+
| Method | Endpoint | Description |
|
|
118
|
+
|--------|----------|-------------|
|
|
119
|
+
| POST | `/api/v1/binaries/uploads` | Create a short-lived, untrusted staged upload |
|
|
120
|
+
| POST | `/api/v1/binaries/uploads/complete` | Seal, stream-scan, verify, and promote the artifact |
|
|
121
|
+
| POST | `/api/v1/binaries/rescan` | Stream-scan and attest or quarantine an existing artifact (operator only) |
|
|
122
|
+
|
|
123
|
+
Use `packages/ts-pantry/scripts/upload-to-s3.ts` or
|
|
124
|
+
`pantry publish:binary`; both clients implement the protocol and never receive
|
|
125
|
+
an installable object key.
|
|
126
|
+
|
|
98
127
|
## Publishing npm Packages
|
|
99
128
|
|
|
100
129
|
To publish a package, send a `POST` request to `/publish` with:
|