Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

`npm audit signatures` does not report how many packages it skipped for want of registry keys

Aperta Adatta ai principianti
  • Qualcosa non va?
#10,018 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@greenlincoln05 ci sta già lavorando.

Dal 27/9/2026.

  • #10048 di @greenlincoln05 — aperta

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
70/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
javascript, nodejs
Ambito
cli, security, tooling

Direzione di ricerca

Esamina l'implementazione del comando audit signatures, probabilmente in lib/commands/audit-signatures.js o in un modulo di audit simile. Trova dove viene tracciato auditedWithKeysCount e dove viene generato l'output del riepilogo. La modifica prevede l'aggiunta di un conteggio skipped all'output, utilizzando i dati di risoluzione del registro già disponibili. Testa configurando un registro locale senza chiavi e verificando che appaia il nuovo messaggio.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Priority 3
Current behaviour

When a registry does not publish signing keys, audit signatures skips the packages installed
from it. That part is intended — #5479 asked for E400 to be treated like E404 for exactly
this reason, and the summary counts only what was checked, through auditedWithKeysCount.

What the summary does not say is how much was skipped. In a tree where some dependencies resolve
from a registry with keys and some from a registry without, the output and the exit code are
indistinguishable from a tree that was fully verified.

Reproduced on npm 10.9.8 with a local registry that answers 404 on /-/npm/v1/keys:

$ cat package.json
{ "name":"mixed-test","version":"1.0.0",
  "dependencies":{ "@nl/nokeys-dep":"1.0.0", "lodash":"4.17.21" } }
$ cat .npmrc
@nl:registry=http://127.0.0.1:8899

$ npm audit signatures
audited 1 package in 0s

1 package has a verified registry signature
$ echo $?
0

@nl/nokeys-dep is in the tree and carries no signature. It is not in the audited count, not
under missing, not under invalid. Nothing in the output indicates it exists.

When nothing can be audited the command already does the right thing:

$ npm audit signatures
npm error found no dependencies to audit that were installed from a supported registry
$ echo $?
1
Why it matters

A pipeline that runs npm audit signatures and branches on the exit code is asking "is this tree
verified". In the mixed case it is told yes, when the honest answer is "the part of it that could
be checked". The configuration where this arises — part of the tree resolving through an internal
mirror, a proxy or a third-party registry that does not publish keys — is a common one, and
arguably the one where the gate matters most.

The tree's total is not printed next to the audited count, so the two cannot be compared without
counting the lockfile separately.

Suggested change

Report the skipped count. Something like:

audited 1 package in 0s
1 package skipped: no signing keys published by http://127.0.0.1:8899

1 package has a verified registry signature

The information is already in hand at that point — the edges walked, the registries resolved and
auditedWithKeysCount — so this is a reporting change rather than a behavioural one. Whether a
skipped package should also affect the exit code is a separate decision, and a flag along the
lines of --require-signatures would leave the current default alone.

I am not suggesting the skip itself should change.

Lingua principale
JavaScript
Stelle
10.2k
Fork
4.8k
Merge medio
3g 21h
PR unite (30g)
12

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di npm/cli

Tutte le issue di npm/cli

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.