node-addon-slsa

You npm install a package with a prebuilt .node binary. The package is signed — but how do you know the binary was built from the same source? You don't, unless both artifacts are verified against the same CI run.

node-addon-slsa cross-checks sigstore npm provenance with the Rekor transparency log to confirm the package and its binary were produced by the same GitHub Actions workflow run. If they were not, installation aborts with a SECURITY error.

npm install node-addon-slsa

Usage

{
  "addon": {
    "path": "./dist/my_addon.node"
  },
  "scripts": {
    "postinstall": "slsa wget",
    "pack-addon": "slsa pack"
  }
}

Download URLs live in the generated slsa-manifest.json alongside the binary's SHA-256 and sigstore sidecar URL; the publish workflow writes it into the published tarball.

Programmatic API:

import { verifyPackage } from "node-addon-slsa";

const provenance = await verifyPackage({
  packageName: "my-native-addon",
  repo: "owner/repo",
});

await provenance.verifyAddonFromFile("/path/to/addon.node.gz");

Setup guide, threat model, and full API reference (including requireAddon, options, error handling): packages/node-addon-slsa/README.md

The published npm package lives in packages/node-addon-slsa/; workspace-internal primitives live in packages/internal/ as @node-addon-slsa/internal. See packages/README.md for the layout.

Contributing

See CONTRIBUTING.md.

License

Apache-2.0 OR MIT — see LICENSE-APACHE.txt and LICENSE-MIT.txt.