https://github.com/sigstore/sigstore-js
codesigning javascript node security supply-chain
Score: 32.35619623726514
Last synced: about 5 hours ago
JSON representation
Repository metadata:
Code-signing for npm packages
- Host: GitHub
- URL: https://github.com/sigstore/sigstore-js
- Owner: sigstore
- License: apache-2.0
- Created: 2022-05-23T21:10:15.000Z (over 4 years ago)
- Default Branch: main
- Last Pushed: 2026-08-10T13:18:59.000Z (16 days ago)
- Last Synced: 2026-08-12T03:37:01.650Z (14 days ago)
- Topics: codesigning, javascript, node, security, supply-chain
- Language: TypeScript
- Homepage:
- Size: 7.24 MB
- Stars: 181
- Watchers: 3
- Forks: 48
- Open Issues: 12
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Codeowners: CODEOWNERS
Owner metadata:
- Name: sigstore
- Login: sigstore
- Email: info@sigstore.dev
- Kind: organization
- Description: Software Supply Chain Security
- Website: https://sigstore.dev
- Location: United States of America
- Twitter: projectsigstore
- Company:
- Icon url: https://avatars.githubusercontent.com/u/71096353?v=4
- Repositories: 50
- Last Synced at: 2023-03-03T19:42:33.042Z
- Profile URL: https://github.com/sigstore
GitHub Events
Total
- Create event: 231
- Delete event: 192
- Fork event: 13
- Issue comment event: 268
- Issues event: 11
- Pull request event: 384
- Pull request review comment event: 8
- Pull request review event: 96
- Push event: 339
- Release event: 17
- Watch event: 16
- Total: 1575
Last Year
- Create event: 86
- Delete event: 66
- Fork event: 6
- Issue comment event: 48
- Issues event: 5
- Pull request event: 103
- Pull request review comment event: 4
- Pull request review event: 22
- Push event: 148
- Watch event: 5
- Total: 493
Committers metadata
Last synced: about 22 hours ago
Total Commits: 1,269
Total Committers: 20
Avg Commits per committer: 63.45
Development Distribution Score (DDS): 0.418
Commits in past year: 134
Committers in past year: 7
Avg Commits per committer in past year: 19.143
Development Distribution Score (DDS) in past year: 0.418
| Name | Commits | |
|---|---|---|
| dependabot[bot] | 4****] | 739 |
| Brian DeHamer | b****r@g****m | 427 |
| github-actions[bot] | 4****] | 67 |
| Philip Harrison | p****p@m****m | 12 |
| ejahnGithub | 1****b | 4 |
| Bob Callaway | b****y | 3 |
| Eddie Zaneski | e****e@c****v | 2 |
| Carlos Tadeu Panato Junior | c****u@g****m | 2 |
| Daniel Bevenius | d****s@g****m | 2 |
| Amith KK | a****n@g****m | 1 |
| Arpit Jain | 3****9 | 1 |
| Ashleigh Carr | a****0@g****m | 1 |
| Billy Lynch | 1****h | 1 |
| Charlie Robbins | c****s@g****m | 1 |
| CrazyMax | 1****x | 1 |
| Jamie Magee | j****e@g****m | 1 |
| Jussi Kukkonen | j****u@g****i | 1 |
| Michael Dawson | m****n@d****m | 1 |
| Myles Borins | m****s@g****m | 1 |
| laurentsimon | 6****n | 1 |
Issue and Pull Request metadata
Last synced: about 5 hours ago
Total issues: 29
Total pull requests: 1,486
Average time to close issues: 5 months
Average time to close pull requests: 3 days
Total issue authors: 23
Total pull request authors: 25
Average comments per issue: 1.03
Average comments per pull request: 1.22
Merged pull request: 926
Bot issues: 3
Bot pull requests: 1,171
Past year issues: 4
Past year pull requests: 120
Past year average time to close issues: 13 days
Past year average time to close pull requests: 7 days
Past year issue authors: 4
Past year pull request authors: 13
Past year average comments per issue: 0.0
Past year average comments per pull request: 1.44
Past year merged pull request: 35
Past year bot issues: 0
Past year bot pull requests: 99
Top Issue Authors
- bdehamer (3)
- dependabot[bot] (3)
- enteraga6 (2)
- jku (2)
- PolarishT (1)
- kommendorkapten (1)
- lodekeeper (1)
- ianlewis (1)
- DhruvDange (1)
- amithkk (1)
- mmomtchev (1)
- rapeazabe888 (1)
- owlstronaut (1)
- ericcornelissen (1)
- lsd-cat (1)
Top Pull Request Authors
- dependabot[bot] (1,066)
- bdehamer (288)
- github-actions[bot] (104)
- ejahnGithub (2)
- cloudugba (2)
- segiddins (2)
- feelepxyz (2)
- indexzero (2)
- GregoireW (2)
- Poopy1976bmf (1)
- renovate[bot] (1)
- amithkk (1)
- PowerSpy (1)
- sj26 (1)
- bobcallaway (1)
Top Issue Labels
- enhancement (16)
- bug (6)
- javascript (3)
- question (3)
- dependencies (3)
Top Pull Request Labels
- dependencies (1,066)
- javascript (891)
- github_actions (175)
- bug (1)
Package metadata
- Total packages: 17
-
Total downloads:
- npm: 248,610,093 last-month
- Total docker downloads: 28,961,181,988
- Total dependent packages: 33 (may contain duplicates)
- Total dependent repositories: 88,564 (may contain duplicates)
- Total versions: 240
- Total maintainers: 1
- Total advisories: 4
npmjs.org: sigstore
code-signing for npm packages
- Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/client#readme
- Licenses: Apache-2.0
- Latest release: 5.0.0 (published 3 months ago)
- Last Synced: 2026-08-26T09:20:20.035Z (about 6 hours ago)
- Versions: 40
- Dependent Packages: 23
- Dependent Repositories: 44,259
- Downloads: 43,962,454 Last month
- Docker Downloads: 7,974,271,583
-
Rankings:
- Docker downloads count: 0.012%
- Downloads: 0.089%
- Dependent repos count: 0.152%
- Average: 2.471%
- Dependent packages count: 4.422%
- Stargazers count: 4.576%
- Forks count: 5.573%
- Maintainers (1)
- Advisories:
proxy.golang.org: github.com/sigstore/sigstore-js
- Homepage:
- Documentation: https://pkg.go.dev/github.com/sigstore/sigstore-js#section-documentation
- Licenses: apache-2.0
- Latest release: v1.5.0 (published over 3 years ago)
- Last Synced: 2026-08-24T10:18:07.113Z (2 days ago)
- Versions: 16
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 4.926%
- Average: 5.091%
- Dependent repos count: 5.257%
npmjs.org: @sigstore/tuf
Client for the Sigstore TUF repository
- Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/tuf#readme
- Licenses: Apache-2.0
- Latest release: 5.0.0 (published 3 months ago)
- Last Synced: 2026-08-24T13:58:39.808Z (2 days ago)
- Versions: 19
- Dependent Packages: 2
- Dependent Repositories: 30,370
- Downloads: 42,650,574 Last month
- Docker Downloads: 7,209,152,514
-
Rankings:
- Downloads: 0.101%
- Dependent repos count: 0.176%
- Docker downloads count: 1.356%
- Stargazers count: 4.576%
- Forks count: 5.573%
- Average: 10.894%
- Dependent packages count: 53.583%
- Maintainers (1)
npmjs.org: @sigstore/bundle
Sigstore bundle type
- Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/bundle#readme
- Licenses: Apache-2.0
- Latest release: 5.0.0 (published 3 months ago)
- Last Synced: 2026-08-25T09:37:39.102Z (1 day ago)
- Versions: 13
- Dependent Packages: 2
- Dependent Repositories: 13,871
- Downloads: 42,178,734 Last month
- Docker Downloads: 6,902,759,916
-
Rankings:
- Downloads: 0.116%
- Dependent repos count: 0.233%
- Docker downloads count: 1.507%
- Stargazers count: 4.576%
- Forks count: 5.573%
- Average: 10.931%
- Dependent packages count: 53.583%
- Maintainers (1)
npmjs.org: @sigstore/sign
Sigstore signing library
- Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/sign#readme
- Licenses: Apache-2.0
- Latest release: 5.0.0 (published 3 months ago)
- Last Synced: 2026-08-24T11:38:55.746Z (2 days ago)
- Versions: 17
- Dependent Packages: 1
- Dependent Repositories: 46
- Downloads: 41,985,965 Last month
- Docker Downloads: 6,874,994,057
-
Rankings:
- Downloads: 0.128%
- Docker downloads count: 1.619%
- Dependent repos count: 2.012%
- Stargazers count: 4.576%
- Forks count: 5.573%
- Average: 11.249%
- Dependent packages count: 53.583%
- Maintainers (1)
npmjs.org: @sigstore/rekor-types
Sigstore Rekor types
- Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/rekor-types#readme
- Licenses: Apache-2.0
- Latest release: 5.0.0 (published 3 months ago)
- Last Synced: 2026-08-25T09:39:46.057Z (1 day ago)
- Versions: 7
- Dependent Packages: 3
- Dependent Repositories: 15
- Downloads: 4,418 Last month
-
Rankings:
- Dependent repos count: 3.226%
- Stargazers count: 4.576%
- Forks count: 5.573%
- Downloads: 5.74%
- Average: 14.54%
- Dependent packages count: 53.583%
- Maintainers (1)
npmjs.org: @sigstore/cli
Sigstore CLI
- Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/cli#readme
- Licenses: Apache-2.0
- Latest release: 0.10.3 (published 22 days ago)
- Last Synced: 2026-08-24T10:41:24.052Z (2 days ago)
- Versions: 24
- Dependent Packages: 0
- Dependent Repositories: 2
- Downloads: 7,489 Last month
-
Rankings:
- Stargazers count: 4.576%
- Forks count: 5.573%
- Downloads: 7.623%
- Dependent repos count: 7.989%
- Average: 15.869%
- Dependent packages count: 53.583%
- Maintainers (1)
npmjs.org: @sigstore/mock
Mocked version of the Sigstore services
- Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/mock#readme
- Licenses: Apache-2.0
- Latest release: 0.13.0 (published 3 months ago)
- Last Synced: 2026-08-25T09:38:32.032Z (1 day ago)
- Versions: 25
- Dependent Packages: 2
- Dependent Repositories: 1
- Downloads: 6,325 Last month
-
Rankings:
- Stargazers count: 4.576%
- Forks count: 5.573%
- Downloads: 8.723%
- Dependent repos count: 10.768%
- Average: 16.645%
- Dependent packages count: 53.583%
- Maintainers (1)
repo1.maven.org: org.mvnpm.at.sigstore:core
Base library for Sigstore
- Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/core#readme
- Documentation: https://appdoc.app/artifact/org.mvnpm.at.sigstore/core/
- Licenses: Apache-2.0
- Latest release: 4.0.1 (published 2 months ago)
- Last Synced: 2026-08-24T09:44:07.162Z (2 days ago)
- Versions: 7
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 32.867%
- Average: 39.927%
- Dependent packages count: 46.987%
repo1.maven.org: org.mvnpm.at.sigstore:verify
Verification of Sigstore signatures
- Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/verify#readme
- Documentation: https://appdoc.app/artifact/org.mvnpm.at.sigstore/verify/
- Licenses: Apache-2.0
- Latest release: 4.1.2 (published 21 days ago)
- Last Synced: 2026-08-25T09:39:44.722Z (1 day ago)
- Versions: 8
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 32.867%
- Average: 39.927%
- Dependent packages count: 46.987%
repo1.maven.org: org.mvnpm.at.sigstore:sign
Sigstore signing library
- Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/sign#readme
- Documentation: https://appdoc.app/artifact/org.mvnpm.at.sigstore/sign/
- Licenses: Apache-2.0
- Latest release: 5.0.0 (published 3 months ago)
- Last Synced: 2026-08-24T09:49:10.531Z (2 days ago)
- Versions: 6
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 32.867%
- Average: 39.927%
- Dependent packages count: 46.987%
repo1.maven.org: org.mvnpm:sigstore
code-signing for npm packages
- Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/client#readme
- Documentation: https://appdoc.app/artifact/org.mvnpm/sigstore/
- Licenses: Apache-2.0
- Latest release: 5.0.0 (published 3 months ago)
- Last Synced: 2026-08-24T09:39:56.011Z (2 days ago)
- Versions: 5
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 32.867%
- Average: 39.927%
- Dependent packages count: 46.987%
repo1.maven.org: org.mvnpm.at.sigstore:tuf
Client for the Sigstore TUF repository
- Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/tuf#readme
- Documentation: https://appdoc.app/artifact/org.mvnpm.at.sigstore/tuf/
- Licenses: Apache-2.0
- Latest release: 5.0.0 (published 3 months ago)
- Last Synced: 2026-08-25T09:37:19.337Z (1 day ago)
- Versions: 6
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 32.867%
- Average: 39.927%
- Dependent packages count: 46.987%
repo1.maven.org: org.mvnpm.at.sigstore:bundle
Sigstore bundle type
- Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/bundle#readme
- Documentation: https://appdoc.app/artifact/org.mvnpm.at.sigstore/bundle/
- Licenses: Apache-2.0
- Latest release: 5.0.0 (published 3 months ago)
- Last Synced: 2026-08-25T09:36:59.925Z (1 day ago)
- Versions: 3
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 32.867%
- Average: 39.927%
- Dependent packages count: 46.987%
npmjs.org: @sigstore/verify
Verification of Sigstore signatures
- Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/verify#readme
- Licenses: Apache-2.0
- Latest release: 4.1.2 (published 22 days ago)
- Last Synced: 2026-08-25T09:20:26.352Z (1 day ago)
- Versions: 16
- Dependent Packages: 0
- Dependent Repositories: 0
- Downloads: 38,717,460 Last month
- Docker Downloads: 1,959
-
Rankings:
- Dependent repos count: 33.833%
- Average: 41.027%
- Dependent packages count: 48.22%
- Maintainers (1)
- Advisories:
npmjs.org: @sigstore/oci
OCI artifact support
- Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/oci#readme
- Licenses: Apache-2.0
- Latest release: 0.7.2 (published 22 days ago)
- Last Synced: 2026-08-26T09:20:33.086Z (about 6 hours ago)
- Versions: 17
- Dependent Packages: 0
- Dependent Repositories: 0
- Downloads: 9,524 Last month
-
Rankings:
- Dependent repos count: 34.108%
- Average: 41.403%
- Dependent packages count: 48.697%
- Maintainers (1)
- Advisories:
npmjs.org: @sigstore/core
Base library for Sigstore
- Homepage: https://github.com/sigstore/sigstore-js/tree/main/packages/core#readme
- Licenses: Apache-2.0
- Latest release: 4.0.1 (published 2 months ago)
- Last Synced: 2026-08-25T10:34:31.342Z (1 day ago)
- Versions: 11
- Dependent Packages: 0
- Dependent Repositories: 0
- Downloads: 39,087,150 Last month
- Docker Downloads: 1,959
-
Rankings:
- Dependent repos count: 36.231%
- Average: 44.099%
- Dependent packages count: 51.966%
- Maintainers (1)
- Advisories:
Dependencies
package-lock.json
npm
- 475 dependencies
package.json
npm
- @tsconfig/node12 ^1.0.9 development
- @types/jest ^27.5.1 development
- @types/make-fetch-happen ^10.0.0 development
- @types/node ^18.6.5 development
- @typescript-eslint/eslint-plugin ^5.26.0 development
- @typescript-eslint/parser ^5.26.0 development
- eslint ^8.16.0 development
- eslint-config-prettier ^8.5.0 development
- eslint-plugin-prettier ^4.0.0 development
- jest ^27.5.1 development
- nock ^13.2.4 development
- prettier ^2.6.2 development
- ts-jest ^27.1.5 development
- typescript ^4.7.2 development
- make-fetch-happen ^10.1.5
.github/workflows/auto-merge.yml
actions
- dependabot/fetch-metadata c9c4182bf1b97f5224aee3906fd373f6b61b4526 composite
.github/workflows/ci.yml
actions
- actions/cache v3 composite
- actions/checkout 8ade135a41bc03ea155e62e844d188df1ea18608 composite
- actions/setup-node 5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d composite
.github/workflows/compatibility-check.yml
actions
- actions/checkout 8ade135a41bc03ea155e62e844d188df1ea18608 composite
- actions/setup-node 5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d composite
.github/workflows/conformance.yml
actions
- actions/checkout 8ade135a41bc03ea155e62e844d188df1ea18608 composite
- actions/setup-node 5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d composite
- sigstore/sigstore-conformance 1abc82cdefe80bd907855d8447f903ba8b4918e0 composite
.github/workflows/dependabot-changesets.yml
actions
- feelepxyz/dependabot-changesets 088619209e26134e4817fc0e7aba82cfdc10373a composite
.github/workflows/release.yml
actions
- actions/checkout 8ade135a41bc03ea155e62e844d188df1ea18608 composite
- actions/setup-node 5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d composite
- changesets/action f13b1baaa620fde937751f5d2c3572b9da32af23 composite
.github/workflows/scorecard.yml
actions
- actions/checkout 8ade135a41bc03ea155e62e844d188df1ea18608 composite
- actions/upload-artifact a8a3f3ad30e3422c9c7b888a15615d19a852ae32 composite
- github/codeql-action/upload-sarif cdcdbb579706841c47f7063dda365e292e5cad7a composite
- ossf/scorecard-action 08b4669551908b1024bb425080c797723083c031 composite
.github/workflows/smoke-test.yml
actions
- actions/checkout 8ade135a41bc03ea155e62e844d188df1ea18608 composite
- actions/setup-node 5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d composite
- actions/upload-artifact a8a3f3ad30e3422c9c7b888a15615d19a852ae32 composite
packages/bundle/package.json
npm
- @sigstore/protobuf-specs ^0.2.1
packages/cli/package.json
npm
- make-fetch-happen ^13.0.0 development
- oclif ^3 development
- tslib ^2.6.1 development
- @oclif/color ^1.0.11
- @oclif/core ^2
- @oclif/plugin-help ^5
- open ^8.4.2
- openid-client ^5.5.0
- sigstore ^2.1.0
packages/client/package.json
npm
- @sigstore/jest ^0.0.0 development
- @sigstore/mock ^0.5.0 development
- @sigstore/rekor-types ^2.0.0 development
- @tufjs/repo-mock ^2.0.0 development
- @types/make-fetch-happen ^10.0.0 development
- @sigstore/bundle ^2.1.0
- @sigstore/protobuf-specs ^0.2.1
- @sigstore/sign ^2.1.0
- @sigstore/tuf ^2.2.0
packages/conformance/package.json
npm
- oclif ^3 development
- tslib ^2.6.1 development
- @oclif/core ^2
- sigstore ^2.0.0
packages/jest/package.json
npm
- @types/sigstore-jest-extended ^0.0.0
packages/jest-types/package.json
npm
packages/mock/package.json
npm
- @sigstore/rekor-types ^2.0.0 development
- make-fetch-happen ^13.0.0 development
- @peculiar/webcrypto ^1.4.3
- @peculiar/x509 ^1.9.5
- @sigstore/protobuf-specs ^0.2.1
- asn1js ^3.0.5
- bytestreamjs ^2.0.1
- canonicalize ^2.0.0
- jose ^4.14.6
- nock ^13.3.3
- pkijs ^3.0.15
- pvutils ^1.1.3
packages/mock-server/package.json
npm
- @types/express ^4.17.18 development
- oclif ^3 development
- tslib ^2.6.1 development
- @oclif/color ^1.0.11
- @oclif/core ^2
- @sigstore/mock ^0.5.0
- @tufjs/repo-mock ^2.0.0
- express 4.18.2
packages/rekor-types/package.json
npm
- json-schema-to-typescript ^13.1.1 development
- openapi-typescript-codegen ^0.25.0 development
packages/sign/package.json
npm
- @sigstore/jest ^0.0.0 development
- @sigstore/mock ^0.5.0 development
- @sigstore/rekor-types ^2.0.0 development
- @types/make-fetch-happen ^10.0.0 development
- @sigstore/bundle ^2.1.0
- @sigstore/protobuf-specs ^0.2.1
- make-fetch-happen ^13.0.0
packages/tuf/package.json
npm
- @sigstore/jest ^0.0.0 development
- @tufjs/repo-mock ^2.0.0 development
- @types/make-fetch-happen ^10.0.0 development
- @sigstore/protobuf-specs ^0.2.1
- tuf-js ^2.1.0