Doing this outside of NPM?

[goldingdamien]

I am thinking a security model that doesn't rely on package managers to take on the burden would be easier to push forwards. Would this be a possibility?

[wilk]

I think it depends by the implementation.
The point is how transparent would be to the users.
Do you have any example?

[goldingdamien]

No, I haven't really looked into it.
I was assuming a third party would perform the build and then create a checksum that can be checked against the file on npm. The third party could be either explicitly selected via a path or a list of trusted third parties could be centrally stored somewhere. This seems like something that would exist somewhere already(doesn't need to be npm specific), but I am not very familiar with this topic.

[wilk]

@goldingdamien Yes, it could be possible.
Like a Certification Authority for HTTPS certificates or a trusted network of "build partners".
In fact, the huge problem SNPM has is about the resource for building the artifacts of so many projects.
It can be added to the workflow, of course 👍