[npm] Verify publish attestations from npm package signing keys

[asraa]

The npm package signing key will be distributed through Sigstore's TUF root as of next week.

The target will be found at registry.npmjs.org/keys.json and has a format like this:https://raw.githubusercontent.com/sigstore/root-signing/f3ebf7f951e021d2b1ad94735d33af7f7834793f/repository/staged/targets/registry.npmjs.org/keys.json

where there is a signatures key and an attestations key.

To get this file in bytes, you can use the sigstore/sigstore TUF client like this:

	tufClient, err := tuf.NewFromEnv(context.Background())
	if err != nil {
		check(err)
	}
       keysFileBytes, err := tufClient.GetTarget(registry.npmjs.org/keys.json)
	if err != nil {
		check(err)
	}

The format of this file is defined loosely from the protobufs, at least the PublicKeys are from this proto

[laurentsimon]

Thanks @asraa

So this is for the provenance signing, correct? Or the publish attestation?

In terms of backward compatibility, does this mean we can drop support for previously-generated attestations entirely?

[asraa]

This is the publish attestation - the provenance signing is still always happening with GitHub OIDC.

[asraa]

Ah! Clarified offline - the keys in the tuf root are the same as the ones that were hard-coded

slsa-verifier/verifiers/internal/gha/npm.go

Line 29 in b01cb9d

NOTE: key available at https://registry.npmjs.org/-/npm/v1/keys

So it will be compatible :)

[ianlewis]

This is needed by the time npm updates their cert