With the recent supply chain attacks it has become more important than ever to verify the supply chain integrity of any and all binaries, artifacts and code pulled from external sources.
It seems that this repo does not supply the checksums on release artifacts and does not publish the dist/ of the built library either. It would be great if releases of this library included the built index.js and the checksums of each artifact the way they are included in https://github.com/grafana/k6-jslib-testing/releases. This would help to mitigate exposure to future attacks and aid in identifying compromised dependencies.
With the recent supply chain attacks it has become more important than ever to verify the supply chain integrity of any and all binaries, artifacts and code pulled from external sources.
It seems that this repo does not supply the checksums on release artifacts and does not publish the
dist/of the built library either. It would be great if releases of this library included the built index.js and the checksums of each artifact the way they are included in https://github.com/grafana/k6-jslib-testing/releases. This would help to mitigate exposure to future attacks and aid in identifying compromised dependencies.