jangobot / pkg-fetch Goto Github PK

A utility to fetch or build patched Node binaries used by pkg to generate executables. This repo hosts prebuilt binaries in Releases.

[1]: end-of-life, may be removed in the next major release.

[2]: best-effort basis, not semver-protected.

[3]: mandatory code signing is enforced by Apple.

We do not expect this project to have vulnerabilities of its own. Nonetheless, as this project distributes prebuilt Node.js binaries,

Node.js security vulnerabilities affect binaries distributed by this project, as well.

Like most of you, this project does not have access to advance/private disclosures of Node.js security vulnerabilities. We can only closely monitor the public security advisories from the Node.js team. It takes time to build and release a new set of binaries, once a new Node.js version has been released.

We aim to complete the full cycle within a day, when there is a security update. Please open an issue if there is no action for a while.

It is possible for this project to fall victim to a supply chain attack.

This project deploys multiple defense measures to ensure that the safe binaries are delivered to users:

• Binaries are compiled by Github Actions
  • Workflows and build logs are transparent and auditable.
  • Artifacts are the source of truth. Even repository/organization administrators can't tamper them.
• Hashes of binaries are hardcoded in source
  • Origins of the binaries are documented.
  • Changes to the binaries are logged by VCS (Git) and are publicly visible.
  • pkg-fetch rejects the binary if it does not match the hardcoded hash.
• GPG-signed hashes are available in Releases
  • Easy to spot a compromise.
• pkg-fetch package on npm is strictly permission-controlled
  • Only authorized Vercel employees can push new revisions to npm.

Report to [email protected], if you noticed a disparity between (hashes of) binaries.