RFC for linking npm packages to their source and build

[feelepxyz]

👋 We've published a RFC for linking npm packages to their source and build using the Sigstore project (you could think of this as "software signing as a service").

The proposal lays out planned changes in the npm CLI but our aim is to build it in such a way that it would be straight forward for any npm client (e.g. yarn) to add support.

We're working on a client library that will implement the bulk of the signing logic (sigstore-js), this will be the main integration point.

I wanted to raise awareness of this proposal and ask for any feedback and thoughts on how to best collaborate on making an integration with yarn happen.

Sidenote: I'm now realising "linking" might be a pretty overloaded term for npm related things 🤔