If you want this level of static dependencies you can check in your deps into node_modules in your git tree or use git submodules in there. Git does guarantee that the thing you point to can't be changed because the hash *is* the hash of the content. If anything changes, the hash changes.
On Wed, Dec 18, 2013 at 7:40 AM, Brian Lalor <bla...@bravo5.org> wrote: > On Dec 18, 2013, at 7:23 AM, Richard Marr <richard.m...@gmail.com> wrote: > > I'm working on an app where security is an issue, and among the (many) > things that I'm frothingly paranoid about is the possibility of malicious > (or more likely just untested) code somehow getting into our app, even > though we're using shrink-wrapped versions. It means we'll have to be much > more careful with the way we proxy the npm registry. > > > I’d like to know this, as well. One of the guarantees made by the Maven > central repository is that artifacts (packages) can check in, but they can > never check out. I frankly don’t think NPM provides this type of > assurance, but it should. Otherwise the only way an organization can trust > packages is to run their own repository. > > -- > Brian Lalor > bla...@bravo5.org > > -- > -- > Job Board: http://jobs.nodejs.org/ > Posting guidelines: > https://github.com/joyent/node/wiki/Mailing-List-Posting-Guidelines > You received this message because you are subscribed to the Google > Groups "nodejs" group. > To post to this group, send email to nodejs@googlegroups.com > To unsubscribe from this group, send email to > nodejs+unsubscr...@googlegroups.com > For more options, visit this group at > http://groups.google.com/group/nodejs?hl=en?hl=en > > --- > You received this message because you are subscribed to the Google Groups > "nodejs" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to nodejs+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/groups/opt_out. > -- -- Job Board: http://jobs.nodejs.org/ Posting guidelines: https://github.com/joyent/node/wiki/Mailing-List-Posting-Guidelines You received this message because you are subscribed to the Google Groups "nodejs" group. To post to this group, send email to nodejs@googlegroups.com To unsubscribe from this group, send email to nodejs+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/nodejs?hl=en?hl=en --- You received this message because you are subscribed to the Google Groups "nodejs" group. To unsubscribe from this group and stop receiving emails from it, send an email to nodejs+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
