Configuring npm

Point npm at the Seal Artifact Server using a per-project .npmrc.

npm reads registry configuration from .npmrc files (global, per-user, and per-project). We recommend a per-project .npmrc in the repository root so the configuration is version-controlled with the manifest.

Configuration

Create or edit .npmrc in the project root:

registry=https://npm.sealsecurity.io/
//npm.sealsecurity.io/:username=<project-id>
//npm.sealsecurity.io/:_password=<token-base64>
//npm.sealsecurity.io/:always-auth=true

Replace <project-id> with the Seal Project ID as a literal value. Replace <token-base64> with the base64 encoding of your production token:

echo -n "$SEAL_TOKEN" | base64        # macOS
echo -n "$SEAL_TOKEN" | base64 -w0    # Linux

npm decodes the _password field with base64. The raw token is not a valid base64 string even though it looks like one, so the encoding step is mandatory.

The .npmrc may still refer to other registries for privately scoped packages. Only the default registry is replaced.

Verify

npm -d ping

A successful response shows the ping going through https://npm.sealsecurity.io/:

npm notice PING https://npm.sealsecurity.io/
npm notice PONG

Related

• Editing dependency files manually: pinning the sealed version in package.json, with direct and transitive (overrides) examples.