travi

Security considerations of automated npm package publishing

Benefits of automated publishing

• Enables Continuous-Publishing
  • the mainline branch always reflects the latest published version
  • contributed fixes are not blocked from consumption after merge because maintainer got distracted/lazy before publishing
• Can automatically determine proper semver bump if commit convention is followed
  • Manually scanning the commits since the last publish can be error prone, leading the the version miscommunicating the level of change to consumers
• Works against committed code only

travi

some steps from http://www.pixelite.co.nz/article/extracting-file-folder-from-git-repository-with-full-git-history/

From the original repository:

git log --pretty=email --patch-with-stat --reverse --full-index --binary -- <path/to/file_or_folder> [path/to/additional/file/or/folder] > /tmp/<patch name>`

In the repository where the history should be imported:

travi

github org

• shareable eslint config
• babel preset
• remark preset
• bot account
• cli
  • project scaffolder
• github apps
  • greenkeeper
• greenkeeper-keeper

travi

# list of IPs from https://docs.travis-ci.com/user/ip-addresses/

## sudo-enabled linux
npm token create --cidr=$(echo $(dig +short {nat.gce-us-central1.travisci.net,nat.gce-us-east1.travisci.net}) | sed 's_ _/32,_g')/32

travi

• Submitting a form should not require JavaScript
• All inputs should have corresponding <label>s
  • Association a <label> with a field
    • If the label is a sibling of the field, the for attribute of the <label> must match the id attribute of the field
    • If the label is the parent of the field, the for attribute is unnecessary
  • Placement of the <label>
    • a sibling relationship is usually appropriate and enables simple styling with the <label> above or to the left of the field
    • a parent relationship works well for choices because specifying an id for each is less valuable. styling with the label to the right of the field works well in this case
• Inputs providing a list of choices (like checkboxes, and radio buttons) should be grouped by a and labeled by its

travi

• esc should dismiss dialogs and other pop-up style components
• esc should clear dynamic inputs, such as a live-filter
• CTRL+enter / ⌘+enter from a text area should submit the form

travi

Keybase proof

I hereby claim:

• I am travi on github.
• I am travi (https://keybase.io/travi) on keybase.
• I have a public key whose fingerprint is 8AF2 251D 667C E15D A1D3 4EBE 8C17 3646 C24F ED70

To claim this, I am signing this object: