Skip to content

--policy-integrity #28734

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 19 commits into from
Closed

--policy-integrity #28734

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
c74132c
policy: add policy-integrity to mitigate policy tampering
bmeck Jun 5, 2019
56256e0
Update test/parallel/test-policy-integrity-flag.js
bmeck Jul 17, 2019
1678f40
update cli.md and node.1 with policy-integrity flag
bmeck Jul 17, 2019
949b0bd
Update doc/api/cli.md
bmeck Jul 17, 2019
a6924e1
Update doc/node.1
bmeck Jul 17, 2019
3252926
Update doc/node.1
bmeck Jul 17, 2019
ecb9153
Update doc/api/cli.md
bmeck Jul 17, 2019
10d47aa
explain parameter for policy-integrity
bmeck Jul 17, 2019
3c00d15
Update doc/api/cli.md
bmeck Jul 17, 2019
6bee3a9
Update doc/node.1
bmeck Jul 17, 2019
33b1b90
nits
bmeck Jul 17, 2019
1d0ad10
doc flag as experimental
bmeck Jul 19, 2019
f4ed688
stderr dump from CI
bmeck Jul 19, 2019
17dfaea
Update test/parallel/test-policy-integrity-flag.js
bmeck Jul 19, 2019
32e4619
error in CI went away
bmeck Jul 19, 2019
556907a
win32 investigation continues
bmeck Jul 19, 2019
8bbd895
investigating win32
bmeck Jul 19, 2019
de66401
add multiple integrity values for diff line endings
bmeck Jul 20, 2019
14d04ed
lint-fixup
Trott Jul 20, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
update cli.md and node.1 with policy-integrity flag
  • Loading branch information
@bmeck
bmeck committed Jul 17, 2019
commit 1678f4023b6c6543c42bb76935fed7c9c1c9f86d
9 changes: 9 additions & 0 deletions doc/api/cli.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -426,6 +426,14 @@ unless either the `--pending-deprecation` command line flag, or the
are used to provide a kind of selective "early warning" mechanism that
developers may leverage to detect deprecated API usage.

### `--policy-integrity`
Copy link
Member

@richardlau richardlau Jul 17, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be --policy-integrity=checksum with some explanation about the expected format of the argument (checksum or a more appropriate word if the argument isn't actually a checksum).

Copy link
Member Author

@bmeck bmeck Jul 17, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

well it is an SRI string so we could link to that somewhere but the SRI spec is kind of not great for explaining that, would linking to mdn be fine?

Copy link
Member

@richardlau richardlau Jul 17, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I think linking to mdn should be ok. (and rename my suggested parameter name to sri instead of checksum).

<!-- YAML
added: TODO
-->

Instructs node to error prior to running any code if the policy does not have
the specified integrity.

### `--preserve-symlinks`
<!-- YAML
added: v6.3.0
Expand Down Expand Up @@ -959,6 +967,7 @@ Node.js options that are allowed are:
- `--no-warnings`
- `--openssl-config`
- `--pending-deprecation`
- `--policy-integrity`
- `--preserve-symlinks-main`
- `--preserve-symlinks`
- `--prof-process`
Expand Down
3 changes: 3 additions & 0 deletions doc/node.1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,6 +228,9 @@ Among other uses, this can be used to enable FIPS-compliant crypto if Node.js is
.It Fl -pending-deprecation
Emit pending deprecation warnings.
.
.It Fl -experimental-policy
Instructs node to error prior to running any code if the policy does not have the specified integrity.
.
.It Fl -preserve-symlinks
Instructs the module loader to preserve symbolic links when resolving and caching modules other than the main module.
.
Expand Down