@napi-rs/canvas-linux-arm64-musl

Canvas for Node.js with skia backend

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

broooooklynforehalo

napi-rsNAPIN-APIRustnode-addonnode-addon-apicanvasimagepdfsvgskia

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
install-scripts	install-script:install	AI (install-scripts): Standard napi-rs platform package pattern; node install.js handles prebuilt binary setup. Expected and documented for all @napi-rs/canvas platform packages.	ai	2026/04/24
npm-metadata	bundled-binaries	AI (npm-metadata): This package IS a precompiled native binary (.node) for the napi-rs canvas Skia binding. Bundled binary is the entire purpose of this platform-specific sub-package; stable across all versions.	ai	2026/04/24
provenance	publisher-changed	AI (provenance): napi-rs/canvas uses GitHub Actions for automated publishing; the transition from broooooklyn to GitHub Actions is the documented CI/CD pattern for this package family, confirmed by SLSA provenance attestation.	ai	2026/04/23
bogus-package	bogus-package	AI (bogus-package): Platform-specific napi-rs binary sub-packages legitimately have no JS code, no deps, tiny payload, and minimal README — this is the standard structure for all @napi-rs/canvas-* platform packages.	ai	2026/04/23

View all versions

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.