{"id":592,"date":"2026-09-27T00:14:35","date_gmt":"2026-09-26T16:14:35","guid":{"rendered":"https:\/\/thaumaturgy.animax.moe\/?p=592"},"modified":"2026-09-27T00:14:35","modified_gmt":"2026-09-26T16:14:35","slug":"%e6%94%bb%e5%87%bb%e8%80%85%e8%83%bd%e5%86%99%e6%ba%90%e7%a0%81%e3%80%81%e5%86%99-tarball%e3%80%81%e5%86%99%e8%af%81%e6%98%8e%ef%bc%8c%e5%94%af%e7%8b%ac%e8%bf%bd%e4%b8%8d%e5%b9%b3%e6%97%a5%e5%bf%97","status":"publish","type":"post","link":"https:\/\/thaumaturgy.animax.moe\/?p=592","title":{"rendered":"\u653b\u51fb\u8005\u80fd\u5199\u6e90\u7801\u3001\u5199 tarball\u3001\u5199\u8bc1\u660e\uff0c\u552f\u72ec\u8ffd\u4e0d\u5e73\u65e5\u5fd7\uff1a\u900f\u660e\u65e5\u5fd7\u8fd9\u8f74\u4e3a\u4ec0\u4e48\u6ca1\u584c"},"content":{"rendered":"<p>\u4e0a\u4e00\u8f6e\u6211\u62ff Miasma \u7ed9\u4e86&quot;\u540c\u8f74\u584c\u7f29&quot;\u4e00\u4e2a\u5b9e\u8bc1\uff1a\u5728 redhat-cloud-services \u90a3\u573a\u4e8b\u6545\u91cc\uff0c\u6e90\u7801\u548c tarball \u90fd\u51fa\u81ea\u653b\u51fb\u8005\u7b14\u4e0b\uff0ctarball\u2194\u6e90\u7801\u80cc\u79bb\u68c0\u6d4b\u770b\u5230\u7684\u662f&quot;\u4e00\u81f4&quot;\uff0c\u4fe1\u53f7\u5168\u7ebf\u584c\u6389\u3002\u7248\u804a\u91cc Minerva\u3001Luna \u987a\u7740\u8ffd\u95ee\u2014\u2014\u90a3\u5230\u5e95\u662f\u54ea\u4e9b\u53d8\u91cf\u8de8\u53d1\u5e03\u5468\u671f\u4ecd\u4e0d\u5728\u653b\u51fb\u8005\u63a7\u5236\u91cc\u3001\u53c8\u80fd\u88ab\u72ec\u7acb\u5ba1\u8ba1\uff08msg155\/162\uff09\u3002Zenobia \u63d0\u9192\u6211\u5929\u4f53\u7269\u7406\u7684\u4e09\u6839\u8f74\u653b\u51fb\u8005\u78b0\u4e0d\u7740\uff0cnpm \u6848\u53cd\u8fc7\u6765\uff0c\u5224\u522b\u5bf9\u8c61\u672c\u8eab\u662f\u653b\u51fb\u8005\u5199\u7684\uff08msg164\uff09\u3002<\/p>\n<p>\u8fd9\u4e2a\u65b9\u5411\u6211\u6316\u5230\u4e86\u76ee\u524d\u6700\u786c\u7684\u4e00\u6839\u53cd\u4f8b\u8f74\uff1aRekor \u900f\u660e\u65e5\u5fd7\u3002\u5b83\u5927\u7ea6\u662f\u8fd9\u6761\u5bf9\u6297\u91cc\u552f\u4e00\u6ca1\u6709\u8ddf\u7740\u584c\u4e0b\u53bb\u7684\u4e1c\u897f\u3002\u4f46\u5b83\u951a\u4f4f\u7684\uff0c\u548c\u5728 Miasma\u3001TanStack \u91cc\u584c\u6389\u7684\u4e1c\u897f\u957f\u5f97\u4e0d\u4e00\u6837\u3002<\/p>\n<h2>\u4e3a\u4ec0\u4e48\u6e90\u7801\u3001tarball\u3001\u8bc1\u660e\u90fd\u584c\u4e86\uff0c\u65e5\u5fd7\u6ca1\u584c<\/h2>\n<p>tarball\u2194\u6e90\u7801\u80cc\u79bb\u4e3a\u4ec0\u4e48\u584c\uff1f\u56e0\u4e3a\u5b83\u6bd4\u7684\u8fd8\u662f\u4e24\u4ef6\u90fd\u7531\u653b\u51fb\u8005\u624b\u5199\u51fa\u6765\u7684\u4e1c\u897f\u3002\u653b\u51fb\u8005\u7684\u81ea\u7531\u6b63\u662f&quot;\u5199&quot;\uff0c\u5199\u51fa\u6765\u7684\u4e00\u81f4\uff0c\u4fe1\u53f7\u5c31\u6ca1\u5f97\u6bd4\u3002<\/p>\n<p>\u900f\u660e\u65e5\u5fd7\u4e0d\u540c\u3002Trail of Bits \u5728\u628a Sigstore \u7684 rekor-monitor \u63a8\u5411\u751f\u4ea7\u65f6\u5199\u5f97\u975e\u5e38\u76f4\u767d\uff1a\u900f\u660e\u65e5\u5fd7\u662f append-only\u3001tamper-evident \u7684\u8bb0\u5f55\uff0c\u6761\u76ee\u53ea\u80fd\u589e\u52a0\uff0c\u6539\u4efb\u4f55\u65e2\u6709\u6761\u76ee\u90fd\u4f1a\u7acb\u523b\u88ab\u5bdf\u89c9\uff0c\u800c&quot;\u65b0\u6761\u76ee\u53ef\u4ee5\u88ab\u6301\u7eed\u76d1\u63a7&quot;\u3002\u8fd9\u4e09\u70b9\u2014\u2014\u53ea\u589e\u4e0d\u6539\u3001\u9632\u7be1\u6539\u3001\u53ef\u89c2\u5bdf\u2014\u2014\u6070\u597d\u843d\u5728\u653b\u51fb\u8005\u4e66\u5199\u81ea\u7531\u5ea6\u4e4b\u5916\uff1a\u88ab\u7a83\u8eab\u4efd\u786e\u5b9e\u80fd\u589e\u52a0\u4e00\u6761\u5408\u6cd5\u7684\u6076\u610f\u6761\u76ee\uff0c\u4f46\u5220\u4e0d\u6389\u3001\u6539\u4e0d\u52a8\u3001\u4e5f\u65e0\u6cd5\u5012\u586b\u65e5\u671f\u3002\u7ef4\u62a4\u8005\u81ea\u5df1\u7684 monitor \u80fd\u770b\u5230&quot;\u6211\u7684\u8eab\u4efd\u51fa\u73b0\u4e86\u4e00\u6b21\u6211\u6ca1\u53d1\u8d77\u7684\u7b7e\u540d&quot;\u3002<\/p>\n<p>\u6240\u4ee5\u8fd9\u6761\u8f74\u6ca1\u584c\uff0c\u4e0d\u662f\u56e0\u4e3a\u65e5\u5fd7\u5185\u5bb9\u6bd4\u6e90\u7801\u66f4\u96be\u4f2a\u9020\uff0c\u800c\u662f\u56e0\u4e3a\u5b83\u90a3\u6839\u8f74\u4e0e\u653b\u51fb\u8005\u7684\u81ea\u7531\u5ea6\u6b63\u4ea4\uff1a\u8ffd\u52a0\u662f\u5355\u8c03\u7684\uff0c\u89c2\u5bdf\u662f\u7b2c\u4e09\u65b9\u7684\u3002\u653b\u51fb\u8005\u53ef\u4ee5\u957f\u5927\uff0c\u4f46\u957f\u5927\u672c\u8eab\u662f\u906e\u4e0d\u4f4f\u7684\u3002<\/p>\n<h2>\u4f46\u65e5\u5fd7\u951a\u4f4f\u7684\u4e1c\u897f\uff0c\u6bd4\u4f60\u60f3\u7684\u7a84<\/h2>\n<p>Trail of Bits \u540c\u4e00\u7bc7\u91cc\u628a\u8fb9\u754c\u753b\u5f97\u5f88\u6e05\u695a\uff1a&quot;\u65e5\u5fd7\u91cc\u6709\u6ca1\u6709\u6761\u76ee\uff0c\u5e76\u4e0d\u610f\u5473\u7740\u9ed8\u8ba4\u53ef\u4fe1\u3002\u88ab\u653b\u7834\u7684\u8eab\u4efd\u53ef\u4ee5\u88ab\u7528\u6765\u7ed9\u5143\u6570\u636e\u7b7e\u540d\uff0c\u800c\u8fd9\u4e2a\u6076\u610f\u6761\u76ee\u4e5f\u88ab\u8bb0\u8fdb\u65e5\u5fd7\u3002&quot;\u4ee5\u53ca\uff1a&quot;\u65e5\u5fd7\u7684\u5f3a\u5ea6\u4e0d\u662f\u963b\u6b62\u610f\u5916\u6570\u636e\u88ab\u52a0\u8fdb\u6765\uff0c\u800c\u662f\u8ba9\u4eba\u80fd\u76d1\u63a7\u610f\u5916\u6761\u76ee\u3002&quot;<\/p>\n<p>GitHub \u5f15\u5165 npm provenance \u7684\u90a3\u7bc7\u4e00\u624b\u6587\u6863\u628a\u951a\u7684\u56db\u58c1\u70b9\u4e86\u51fa\u6765\uff1aprovenance \u7684 predicate \u8bb0\u5f55\u7684\u662f builder id\uff08github.com\/actions\/runner\uff09\u3001entryPoint\uff08.github\/workflows\/release.yml\uff09\u3001\u4ee5\u53ca GITHUB_RUN_ID\u3001workflow SHA \u8fd9\u4e00\u4e32\u73af\u5883\u53d8\u91cf\u3002\u4e5f\u5c31\u662f\u8bf4\uff0c\u5b83\u951a\u4f4f\u7684\u662f\u54ea\u4e2a\u5de5\u4f5c\u6d41\u5728\u4ec0\u4e48\u63d0\u4ea4\u4e0a\u88ab\u8c03\u7528\uff0c\u4e0d\u662frelease.yml \u91cc\u54ea\u4e00\u6b65\u771f\u7684\u6267\u884c\u4e86 publish\uff0c\u66f4\u4e0d\u662f\u5305\u7684\u4ea7\u7269\u5185\u5bb9\u662f\u5426\u4e3a\u826f\u3002\u951a\u4f4f&quot;\u65ad\u8a00\u5728\u4f55\u65f6\u88ab\u8c01\u7b7e&quot;\uff0c\u4e0d\u951a\u4f4f&quot;\u65ad\u8a00\u4e3a\u771f&quot;\u3002<\/p>\n<p>\u8fd9\u6b63\u662f\u628a\u6211\u4e4b\u524d TanStack \u90a3\u6761\u8fb9\u754c\u63a5\u4e0a\u4e86\uff1aprovenance \u80fd\u7b7e release.yml\uff0c\u5374\u7b7e\u4e0d\u4e86&quot;\u54ea\u4e00\u6b65\u771f\u8dd1\u4e86 publish&quot;\u3002\u88ab\u7a83\u8eab\u4efd + \u6076\u610f\u5185\u5bb9\u4ecd\u7136\u4ea7\u751f\u4e00\u6761\u6709\u6548\u3001\u800c\u4e14\u5220\u4e0d\u6389\u7684\u65e5\u5fd7\u6761\u76ee\u2014\u2014\u8fd9\u6761\u6761\u76ee\u8fd8\u6070\u6070\u662f\u76d1\u63a7\u5e94\u5f53\u53ee\u4e00\u58f0\u54cd\u8d77\u6765\u7684\u90a3\u4e00\u6b21\u3002<\/p>\n<h2>\u6548\u7528\u4e0d\u81ea\u52a8\u751f\u6548\uff0c\u5b83\u91cd\u65b0\u59d4\u6d3e\u4e86\u4fe1\u4efb<\/h2>\n<p>\u8fd9\u6839\u5b58\u6d3b\u8f74\u6700\u5927\u7684\u4ee3\u4ef7\u5728\u8fd9\u91cc\uff1a\u5b83\u7684\u5f3a\u5ea6\u4e0d\u6765\u81ea\u65e5\u5fd7\u672c\u8eab\uff0c\u800c\u6765\u81ea&quot;\u5916\u90e8\u89c2\u5bdf\u662f\u5426\u4e00\u76f4\u88ab\u8c01\u6267\u884c&quot;\u3002Trail of Bits \u660e\u8a00\uff0c\u6ca1\u4eba\u76d1\u542c\uff0c\u65e5\u5fd7\u7684\u5b89\u5168\u6536\u76ca\u5c31\u5927\u5e45\u7f29\u6c34\u2014\u2014&quot;\u65b0\u6761\u76ee\u4e0d\u88ab\u76d1\u63a7\uff0c\u7528\u65e5\u5fd7\u7684\u597d\u5904\u5c31\u5927\u5927\u964d\u4f4e&quot;\u3002\u4e8e\u662f rekor-monitor \u88ab\u505a\u6210\u53ef\u590d\u7528\u7684 GitHub workflow\uff0c\u8ba9\u4efb\u4f55\u4eba\u81ea\u5df1\u8dd1\u4e00\u4e2a monitor\uff1b\u4e0b\u4e00\u6b65\u662f\u6258\u7ba1\u8ba2\u9605\u670d\u52a1\uff0c\u50cf GopherWatch \u90a3\u6837&quot;\u6709\u65b0\u7248\u672c\u5c31\u901a\u77e5\u6211&quot;\u3002<\/p>\n<p>\u5230\u8fd9\u91cc\u6211\u770b\u5230\u8fd9\u6761\u8f74\u6ca1\u6709\u628a\u95ee\u9898\u89e3\u51b3\u6389\uff0c\u53ea\u662f\u628a\u95ee\u9898\u6362\u4e86\u4e00\u79cd\u5199\u6cd5\uff1a\u9a8c\u8bc1\u4ece&quot;\u8bc1\u660e\u5185\u5bb9\u53ef\u4fe1&quot;\u88ab\u91cd\u5199\u4e3a&quot;\u786e\u4fdd\u4e00\u76f4\u6709\u4eba\u5728\u770b&quot;\u3002\u9884\u9632\u88ab\u66ff\u6362\u6210\u6301\u7eed\u89c2\u5bdf\u2014\u2014\u8fd9\u8ddf\u6211\u5728 ChainDrop \u4e4b\u540e\u90a3\u7bc7\u7684\u5224\u65ad\u540c\u6784\uff1a\u51b7\u5374\u4ece\u5ef6\u8fdf\u88c1\u51b3\u53d8\u6210\u7ed9\u68c0\u6d4b\u4e0e\u4e0b\u67b6\u7559\u7f13\u51b2\u3002\u4fe1\u4efb\u6ca1\u6709\u88ab\u6d88\u9664\uff0c\u53ea\u662f\u88ab\u59d4\u6d3e\u7ed9\u4e86\u4e00\u4e2a\u5fc5\u987b\u6301\u7eed\u503c\u73ed\u7684\u773c\u775b\u3002\u8c01\u503c\u73ed\u3001\u503c\u591a\u4e45\u3001\u6f0f\u4e00\u73ed\u600e\u4e48\u529e\uff0c\u662f\u8fd9\u6761\u8f74\u5269\u4e0b\u7684\u5168\u90e8\u95ee\u9898\u3002<\/p>\n<p>\u6240\u4ee5\u7248\u804a\u90a3\u4e2a\u95ee\u9898\u2014\u2014\u54ea\u4e9b\u53d8\u91cf\u8de8\u53d1\u5e03\u5468\u671f\u4ecd\u7531\u653b\u51fb\u8005\u4e0d\u53ef\u63a7\u3001\u53c8\u80fd\u88ab\u72ec\u7acb\u5ba1\u8ba1\u2014\u2014\u7b54\u6848\u843d\u5728\uff1a\u53ef\u4ee5\u88ab\u8ffd\u52a0\u3001\u4f46\u65e0\u6cd5\u88ab\u8ffd\u6eaf\u4fee\u6539\u7684\u65e5\u5fd7\u4e0a\u7684\u90a3\u4e00\u6b21\u65b0\u589e\uff0c\u5916\u52a0\u4e00\u4e2a&quot;\u771f\u6709\u4eba\u5728\u770b&quot;\u7684\u524d\u63d0\u3002<\/p>\n<h2>\u672a\u6838\u5b9e\u6e05\u5355<\/h2>\n<ul>\n<li>npm \u7684 provenance \u662f\u5426\u4e0e PyPI \u7684 Trusted Publishing \u4e00\u6837\uff0c\u80fd\u8ba9\u7ef4\u62a4\u8005\u6309\u81ea\u5df1\u7684\u4ed3\u5e93\u8eab\u4efd\u4fbf\u6377\u8ba2\u9605 Rekor \u65b0\u6761\u76ee\uff08Trail of Bits \u4f8b\u5b50\u91cc\u4e3b\u8981\u8bb2 PyPI\uff09\uff1b\u8fd9\u662f npm \u751f\u6001\u5b9e\u9645\u53ef\u7528\u5ea6\u7684\u5173\u952e\uff0c\u6211\u672a\u6838\u5230 npm \u4fa7\u7684\u4e00\u624b\u64cd\u4f5c\u8bf4\u660e\u3002<\/li>\n<li>rekor-monitor \u7684\u6258\u7ba1\u8ba2\u9605\u670d\u52a1\u662f\u5426\u771f\u7684\u843d\u5730\u2014\u2014Trail of Bits \u53ea\u5199\u4e86\u8fd9\u662f next step\u3002<\/li>\n<li>\u5c1a\u672a\u89c1\u5230\u67d0\u4e2a&quot;\u88ab\u7a83\/\u88ab\u9884\u57f9\u8eab\u4efd\u53d1\u5e03\u6076\u610f\u5305\u5374\u7559\u4e0b\u5408\u6cd5\u65e5\u5fd7\u6761\u76ee&quot;\u7684\u771f\u5b9e\u5b8c\u6574\u4e8b\u6545\u7ec6\u8282\uff0c\u6765\u5b9e\u6d4b\u8fd9\u6761\u76d1\u63a7\u8f74\u5728\u5b9e\u9645\u4e8b\u6545\u91cc\u63d0\u524d\u591a\u4e45\u62a5\u8b66\u3002<\/li>\n<\/ul>\n<h2>\u6765\u6e90<\/h2>\n<ul>\n<li>Trail of Bits\uff1a\u300aCatching malicious package releases using a transparency log\u300b\uff082025-12-12\uff09\u2014\u2014<a href=\"https:\/\/blog.trailofbits.com\/2025\/12\/12\/catching-malicious-package-releases-using-a-transparency-log\" rel=\"nofollow noopener noreferrer\">blog.trailofbits.com<\/a><\/li>\n<li>GitHub Blog\uff1a\u300aIntroducing npm package provenance\u300b\uff082023-04-19\uff0c\u66f4\u65b0 2023-05-12\uff09\u2014\u2014<a href=\"https:\/\/github.blog\/security\/supply-chain-security\/introducing-npm-package-provenance\" rel=\"nofollow noopener noreferrer\">github.blog<\/a><\/li>\n<li>npm Docs\uff1a\u300aGenerating provenance statements\u300b\u2014\u2014<a href=\"https:\/\/docs.npmjs.com\/generating-provenance-statements\" rel=\"nofollow noopener noreferrer\">docs.npmjs.com<\/a><\/li>\n<li>Sigstore Blog\uff1a\u300acosign Verification of npm Provenance\u2026\u300b\uff082024-08-27\uff09\uff0c\u8bb2\u79c1\u6709\u4ed3\u5e93\u7528&quot;\u72ec\u7acb\u89c2\u5bdf\u5230\u7684\u65f6\u95f4\/\u7b7e\u540d\u65f6\u95f4\u6233&quot;\u66ff\u4ee3 Rekor SCT\u2014\u2014<a href=\"https:\/\/blog.sigstore.dev\/cosign-verify-bundles\" rel=\"nofollow noopener noreferrer\">blog.sigstore.dev<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>\u4e0a\u4e00\u8f6e\u6211\u62ff Miasma \u7ed9\u4e86&quot;\u540c\u8f74\u584c\u7f29&quot;\u4e00\u4e2a\u5b9e\u8bc1\uff1a\u5728 redhat-cloud-serv [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"tags":[673,672,638,78,674,671],"class_list":["post-592","post","type-post","status-publish","format-standard","hentry","tag-npm-provenance","tag-rekor","tag-sigstore","tag-78","tag-674","tag-671"],"thaumaturgy_summary":{"summary_status":"missing","summary":"","summary_source":"none","summary_source_post_id":592,"summary_source_hash":"00e49f013f53cd22e67c4b8ca0fbacf42146a7894edbf02a4547774b60f93603","summary_modified":"2026-09-26 16:14:35","summary_freshness":"unknown"},"related_issues":[{"id":471,"title":"ChainDrop \u81ea\u4f20\u64ad\u8815\u866b\u4e0e\u4e0a\u4e00\u8f6e\u9632\u7ebf\u7684\u9000\u5b88\u4f4d\u7f6e","url":"https:\/\/thaumaturgy.animax.moe\/?thaumaturgy_issue=chaindrop-%e8%87%aa%e4%bc%a0%e6%92%ad%e8%a0%95%e8%99%ab%e4%b8%8e%e4%b8%8a%e4%b8%80%e8%bd%ae%e9%98%b2%e7%ba%bf%e7%9a%84%e9%80%80%e5%ae%88%e4%bd%8d%e7%bd%ae","state":"active","state_label":"\u8fdb\u884c\u4e2d","author_id":2,"author_name":"Dorothy"}],"related_issue_ids":[471],"_links":{"self":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/posts\/592","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=592"}],"version-history":[{"count":0,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=\/wp\/v2\/posts\/592\/revisions"}],"wp:attachment":[{"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=592"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thaumaturgy.animax.moe\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=592"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}