feat: support npm cli provenance v1 attestations

README.md

@@ -315,6 +315,8 @@ PASSED: Verified SLSA provenance
 
 Verification of npm packages is currently an experimental feature.
 
+More deetails about npm attestations are in [docs/npm.md](./docs/npm.md)
+
 #### The verify-npm-package command
 
 ```bash

cli/slsa-verifier/main_regression_test.go

@@ -1519,6 +1519,14 @@ func Test_runVerifyNpmPackage(t *testing.T) {
 			pkgName:    PointerTo("@trishankatdatadog/supreme-goggles"),
 			builderID:  PointerTo("https://github.com/actions/runner/github-hosted"),
 		},
+		{
+			name:       "valid npm CLI builder v1",
+			artifact:   "gundam-visor-cli-v1-tag.tgz",
+			source:     "github.com/ramonpetgrave64/gundam-visor",
+			pkgVersion: PointerTo("1.0.1"),
+			pkgName:    PointerTo("gundam-visor"),
+			builderID:  PointerTo("https://github.com/actions/runner/github-hosted"),
+		},
 		{
 			name:       "valid npm CLI builder short runner name",
 			artifact:   "supreme-googles-cli-v02-tag.tgz",
@@ -1527,6 +1535,17 @@ func Test_runVerifyNpmPackage(t *testing.T) {
 			pkgName:    PointerTo("@trishankatdatadog/supreme-goggles"),
 			builderID:  PointerTo("https://github.com/actions/runner"),
 		},
+		{
+			// The builderID for v1 should never be the "shortname".
+			// https://github.com/npm/cli/blob/93883bb6459208a916584cad8c6c72a315cf32af/workspaces/libnpmpublish/lib/provenance.js#L58.
+			name:       "valid npm CLI builder v1 short runner name",
+			artifact:   "gundam-visor-cli-v1-tag.tgz",
+			source:     "github.com/ramonpetgrave64/gundam-visor",
+			pkgVersion: PointerTo("1.0.1"),
+			pkgName:    PointerTo("gundam-visor"),
+			builderID:  PointerTo("https://github.com/actions/runner"),
+			err:        serrors.ErrorInvalidBuilderID,
+		},
 		{
 			name:       "valid npm CLI builder no builder",
 			artifact:   "supreme-googles-cli-v02-tag.tgz",
@@ -1535,6 +1554,14 @@ func Test_runVerifyNpmPackage(t *testing.T) {
 			pkgName:    PointerTo("@trishankatdatadog/supreme-goggles"),
 			err:        serrors.ErrorInvalidBuilderID,
 		},
+		{
+			name:       "valid npm CLI builder v1 no builder",
+			artifact:   "gundam-visor-cli-v1-tag.tgz",
+			source:     "github.com/ramonpetgrave64/gundam-visor",
+			pkgVersion: PointerTo("1.0.5"),
+			pkgName:    PointerTo("gundam-visor"),
+			err:        serrors.ErrorInvalidBuilderID,
+		},
 		{
 			name:       "valid npm CLI builder mismatch builder",
 			artifact:   "supreme-googles-cli-v02-tag.tgz",
@@ -1544,20 +1571,43 @@ func Test_runVerifyNpmPackage(t *testing.T) {
 			builderID:  PointerTo("https://github.com/actions/runner2"),
 			err:        serrors.ErrorNotSupported,
 		},
+		{
+			name:       "valid npm CLI builder v1 mismatch builder",
+			artifact:   "gundam-visor-cli-v1-tag.tgz",
+			source:     "github.com/ramonpetgrave64/gundam-visor",
+			pkgVersion: PointerTo("1.0.1"),
+			pkgName:    PointerTo("gundam-visor"),
+			builderID:  PointerTo("https://github.com/actions/runner/github-hosted2"),
+			err:        serrors.ErrorNotSupported,
+		},
 		{
 			name:       "valid npm CLI builder no package name",
 			artifact:   "supreme-googles-cli-v02-tag.tgz",
 			source:     "github.com/trishankatdatadog/supreme-goggles",
 			pkgVersion: PointerTo("1.0.5"),
 			builderID:  PointerTo("https://github.com/actions/runner/github-hosted"),
 		},
+		{
+			name:       "valid npm CLI builder v1 no package name",
+			artifact:   "gundam-visor-cli-v1-tag.tgz",
+			source:     "github.com/ramonpetgrave64/gundam-visor",
+			pkgVersion: PointerTo("1.0.1"),
+			builderID:  PointerTo("https://github.com/actions/runner/github-hosted"),
+		},
 		{
 			name:      "valid npm CLI builder no package version",
 			artifact:  "supreme-googles-cli-v02-tag.tgz",
 			source:    "github.com/trishankatdatadog/supreme-goggles",
 			pkgName:   PointerTo("@trishankatdatadog/supreme-goggles"),
 			builderID: PointerTo("https://github.com/actions/runner/github-hosted"),
 		},
+		{
+			name:      "valid npm CLI builder v1 no package version",
+			artifact:  "gundam-visor-cli-v1-tag.tgz",
+			source:    "github.com/ramonpetgrave64/gundam-visor",
+			pkgName:   PointerTo("gundam-visor"),
+			builderID: PointerTo("https://github.com/actions/runner/github-hosted"),
+		},
 		{
 			name:       "valid npm CLI builder mismatch source",
 			artifact:   "supreme-googles-cli-v02-tag.tgz",
@@ -1567,6 +1617,15 @@ func Test_runVerifyNpmPackage(t *testing.T) {
 			builderID:  PointerTo("https://github.com/actions/runner/github-hosted"),
 			err:        serrors.ErrorMismatchSource,
 		},
+		{
+			name:       "valid npm CLI builder v1 mismatch source",
+			artifact:   "gundam-visor-cli-v1-tag.tgz",
+			source:     "github.com/ramonpetgrave64/gundam-visorS",
+			pkgVersion: PointerTo("1.0.1"),
+			pkgName:    PointerTo("gundam-visor"),
+			builderID:  PointerTo("https://github.com/actions/runner/github-hosted"),
+			err:        serrors.ErrorMismatchSource,
+		},
 		{
 			name:       "valid npm CLI builder mismatch package version",
 			artifact:   "supreme-googles-cli-v02-tag.tgz",
@@ -1575,6 +1634,15 @@ func Test_runVerifyNpmPackage(t *testing.T) {
 			builderID:  PointerTo("https://github.com/actions/runner/github-hosted"),
 			err:        serrors.ErrorMismatchPackageVersion,
 		},
+		{
+			name:       "valid npm CLI builder v1 mismatch package version",
+			artifact:   "gundam-visor-cli-v1-tag.tgz",
+			source:     "github.com/ramonpetgrave64/gundam-visor",
+			pkgVersion: PointerTo("1.0.2"),
+			pkgName:    PointerTo("gundam-visor"),
+			builderID:  PointerTo("https://github.com/actions/runner/github-hosted"),
+			err:        serrors.ErrorMismatchPackageVersion,
+		},
 		{
 			name:      "valid npm CLI builder mismatch package name",
 			artifact:  "supreme-googles-cli-v02-tag.tgz",
@@ -1583,6 +1651,15 @@ func Test_runVerifyNpmPackage(t *testing.T) {
 			builderID: PointerTo("https://github.com/actions/runner/github-hosted"),
 			err:       serrors.ErrorMismatchPackageName,
 		},
+		{
+			name:       "valid npm CLI builder v1 mismatch package name",
+			artifact:   "gundam-visor-cli-v1-tag.tgz",
+			source:     "github.com/ramonpetgrave64/gundam-visor",
+			pkgVersion: PointerTo("1.0.1"),
+			pkgName:    PointerTo("gundam-visorS"),
+			builderID:  PointerTo("https://github.com/actions/runner/github-hosted"),
+			err:        serrors.ErrorMismatchPackageName,
+		},
 		{
 			name:      "invalid signature provenance npm CLI",
 			artifact:  "supreme-googles-cli-v02-tag-invalidsigprov.tgz",
@@ -1592,13 +1669,31 @@ func Test_runVerifyNpmPackage(t *testing.T) {
 			err:       serrors.ErrorInvalidSignature,
 		},
 		{
-			name:      "invalid signature provenance npm CLI",
+			name:       "invalid signature provenance npm CLI v1",
+			artifact:   "gundam-visor-cli-v1-tag-invalidsigprov.tgz",
+			source:     "github.com/ramonpetgrave64/gundam-visor",
+			pkgVersion: PointerTo("1.0.1"),
+			pkgName:    PointerTo("gundam-visor"),
+			builderID:  PointerTo("https://github.com/actions/runner/github-hosted"),
+			err:        serrors.ErrorInvalidSignature,
+		},
+		{
+			name:      "invalid signature publish npm CLI",
 			artifact:  "supreme-googles-cli-v02-tag-invalidsigpub.tgz",
 			source:    "github.com/trishankatdatadog/supreme-goggles",
 			pkgName:   PointerTo("@trishankatdatadog/supreme-goggles"),
 			builderID: PointerTo("https://github.com/actions/runner/github-hosted"),
 			err:       serrors.ErrorInvalidSignature,
 		},
+		{
+			name:       "invalid signature publish npm CLI v1",
+			artifact:   "gundam-visor-cli-v1-tag-invalidsigpub.tgz",
+			source:     "github.com/ramonpetgrave64/gundam-visor",
+			pkgVersion: PointerTo("1.0.1"),
+			pkgName:    PointerTo("gundam-visor"),
+			builderID:  PointerTo("https://github.com/actions/runner/github-hosted"),
+			err:        serrors.ErrorInvalidSignature,
+		},
 		// npm CLI with main branch.
 		{
 			name:       "valid npm CLI builder",
@@ -1608,6 +1703,14 @@ func Test_runVerifyNpmPackage(t *testing.T) {
 			pkgName:    PointerTo("@laurentsimon/provenance-npm-test"),
 			builderID:  PointerTo("https://github.com/actions/runner/github-hosted"),
 		},
+		{
+			name:       "valid npm CLI builder v1",
+			artifact:   "provenance-npm-test-cli-v1-prega.tgz",
+			source:     "github.com/sigstore/sigstore-js",
+			pkgVersion: PointerTo("2.3.1"),
+			pkgName:    PointerTo("sigstore"),
+			builderID:  PointerTo("https://github.com/actions/runner/github-hosted"),
+		},
 		{
 			name:       "valid npm CLI builder short runner name",
 			artifact:   "provenance-npm-test-cli-v02-prega.tgz",
@@ -1616,6 +1719,17 @@ func Test_runVerifyNpmPackage(t *testing.T) {
 			pkgName:    PointerTo("@laurentsimon/provenance-npm-test"),
 			builderID:  PointerTo("https://github.com/actions/runner"),
 		},
+		{
+			// The builderID for v1 should never be the "shortname".
+			// https://github.com/npm/cli/blob/93883bb6459208a916584cad8c6c72a315cf32af/workspaces/libnpmpublish/lib/provenance.js#L58.
+			name:       "valid npm CLI builder v1 short runner name",
+			artifact:   "provenance-npm-test-cli-v1-prega.tgz",
+			source:     "github.com/sigstore/sigstore-js",
+			pkgVersion: PointerTo("2.3.1"),
+			pkgName:    PointerTo("sigstore"),
+			builderID:  PointerTo("https://github.com/actions/runner"),
+			err:        serrors.ErrorInvalidBuilderID,
+		},
 		{
 			name:       "valid npm CLI builder no builder",
 			artifact:   "provenance-npm-test-cli-v02-prega.tgz",
@@ -1624,6 +1738,14 @@ func Test_runVerifyNpmPackage(t *testing.T) {
 			pkgName:    PointerTo("@laurentsimon/provenance-npm-test"),
 			err:        serrors.ErrorInvalidBuilderID,
 		},
+		{
+			name:       "valid npm CLI builder v1 no builder",
+			artifact:   "provenance-npm-test-cli-v1-prega.tgz",
+			source:     "github.com/sigstore/sigstore-js",
+			pkgVersion: PointerTo("2.3.1"),
+			pkgName:    PointerTo("sigstore"),
+			err:        serrors.ErrorInvalidBuilderID,
+		},
 		{
 			name:       "valid npm CLI builder mismatch builder",
 			artifact:   "provenance-npm-test-cli-v02-prega.tgz",
@@ -1633,27 +1755,58 @@ func Test_runVerifyNpmPackage(t *testing.T) {
 			builderID:  PointerTo("https://github.com/actions/runner2"),
 			err:        serrors.ErrorNotSupported,
 		},
+		{
+			name:       "valid npm CLI builder v1 mismatch builder",
+			artifact:   "provenance-npm-test-cli-v1-prega.tgz",
+			source:     "github.com/sigstore/sigstore-js",
+			pkgVersion: PointerTo("2.3.1"),
+			pkgName:    PointerTo("sigstore"),
+			builderID:  PointerTo("https://github.com/actions/runner/github-hosted2"),
+			err:        serrors.ErrorNotSupported,
+		},
 		{
 			name:       "valid npm CLI builder no package name",
 			artifact:   "provenance-npm-test-cli-v02-prega.tgz",
 			pkgVersion: PointerTo("1.0.3"),
 			source:     "github.com/laurentsimon/provenance-npm-test",
 			builderID:  PointerTo("https://github.com/actions/runner/github-hosted"),
 		},
+		{
+			name:       "valid npm CLI builder v1 no package name",
+			artifact:   "provenance-npm-test-cli-v1-prega.tgz",
+			pkgVersion: PointerTo("2.3.1"),
+			source:     "github.com/sigstore/sigstore-js",
+			builderID:  PointerTo("https://github.com/actions/runner/github-hosted"),
+		},
 		{
 			name:      "valid npm CLI builder no package version",
 			artifact:  "provenance-npm-test-cli-v02-prega.tgz",
 			source:    "github.com/laurentsimon/provenance-npm-test",
 			pkgName:   PointerTo("@laurentsimon/provenance-npm-test"),
 			builderID: PointerTo("https://github.com/actions/runner/github-hosted"),
 		},
+		{
+			name:      "valid npm CLI builder v1 no package version",
+			artifact:  "provenance-npm-test-cli-v1-prega.tgz",
+			source:    "github.com/sigstore/sigstore-js",
+			pkgName:   PointerTo("sigstore"),
+			builderID: PointerTo("https://github.com/actions/runner/github-hosted"),
+		},
 		{
 			name:      "valid npm CLI builder mismatch source",
 			artifact:  "provenance-npm-test-cli-v02-prega.tgz",
 			source:    "github.com/laurentsimon/provenance-npm-test2",
 			builderID: PointerTo("https://github.com/actions/runner/github-hosted"),
 			err:       serrors.ErrorMismatchSource,
 		},
+		{
+			name:      "valid npm CLI builder v1 mismatch source",
+			artifact:  "provenance-npm-test-cli-v1-prega.tgz",
+			source:    "github.com/sigstore/sigstore-js2",
+			pkgName:   PointerTo("sigstore"),
+			builderID: PointerTo("https://github.com/actions/runner/github-hosted"),
+			err:       serrors.ErrorMismatchSource,
+		},
 		{
 			name:       "valid npm CLI builder mismatch package version",
 			artifact:   "provenance-npm-test-cli-v02-prega.tgz",
@@ -1662,6 +1815,14 @@ func Test_runVerifyNpmPackage(t *testing.T) {
 			builderID:  PointerTo("https://github.com/actions/runner/github-hosted"),
 			err:        serrors.ErrorMismatchPackageVersion,
 		},
+		{
+			name:       "valid npm CLI builder v1 mismatch package version",
+			artifact:   "provenance-npm-test-cli-v1-prega.tgz",
+			source:     "github.com/sigstore/sigstore-js",
+			pkgVersion: PointerTo("2.3.2"),
+			builderID:  PointerTo("https://github.com/actions/runner/github-hosted"),
+			err:        serrors.ErrorMismatchPackageVersion,
+		},
 		{
 			name:      "valid npm CLI builder mismatch package name",
 			artifact:  "provenance-npm-test-cli-v02-prega.tgz",
@@ -1670,6 +1831,14 @@ func Test_runVerifyNpmPackage(t *testing.T) {
 			builderID: PointerTo("https://github.com/actions/runner/github-hosted"),
 			err:       serrors.ErrorMismatchPackageName,
 		},
+		{
+			name:      "valid npm CLI builder v1 mismatch package name",
+			artifact:  "provenance-npm-test-cli-v1-prega.tgz",
+			source:    "github.com/sigstore/sigstore-js",
+			pkgName:   PointerTo("sigstore2"),
+			builderID: PointerTo("https://github.com/actions/runner/github-hosted"),
+			err:       serrors.ErrorMismatchPackageName,
+		},
 		{
 			name:      "invalid signature provenance npm CLI",
 			artifact:  "provenance-npm-test-cli-v02-prega-invalidsigprov.tgz",
@@ -1678,6 +1847,14 @@ func Test_runVerifyNpmPackage(t *testing.T) {
 			builderID: PointerTo("https://github.com/actions/runner/github-hosted"),
 			err:       serrors.ErrorInvalidSignature,
 		},
+		{
+			name:      "invalid signature provenance npm CLI v1",
+			artifact:  "provenance-npm-test-cli-v1-prega-invalidsigprov.tgz",
+			source:    "github.com/sigstore/sigstore-js",
+			pkgName:   PointerTo("sigstore"),
+			builderID: PointerTo("https://github.com/actions/runner/github-hosted"),
+			err:       serrors.ErrorInvalidSignature,
+		},
 		{
 			name:      "invalid signature publish npm CLI",
 			artifact:  "provenance-npm-test-cli-v02-prega-invalidsigpub.tgz",
@@ -1686,6 +1863,14 @@ func Test_runVerifyNpmPackage(t *testing.T) {
 			builderID: PointerTo("https://github.com/actions/runner/github-hosted"),
 			err:       serrors.ErrorInvalidSignature,
 		},
+		{
+			name:      "invalid signature publish npm CLI v1",
+			artifact:  "provenance-npm-test-cli-v1-prega-invalidsigpub.tgz",
+			source:    "github.com/sigstore/sigstore-js",
+			pkgName:   PointerTo("sigstore"),
+			builderID: PointerTo("https://github.com/actions/runner/github-hosted"),
+			err:       serrors.ErrorInvalidSignature,
+		},
 		// OSSF builder.
 		{
 			name:       "valid npm OSSF builder",