Verifying the Package
What each SDK package contains, which dependencies it pulls in, and what Nolax signs today.
Before you add any package to a production service, check what you are installing. This page lists what is true for SDK 1.1, including what Nolax does not yet provide.
Dependencies
| SDK | Runtime dependencies |
| --- | --- |
| Node.js | None |
| Python | None. Flask, FastAPI and Django are optional extras you install yourself |
| .NET | None beyond the ASP.NET Core shared framework |
| Java | slf4j-api. The Jakarta Servlet API is provided by your container |
Signing and provenance
| Registry | Today |
| --- | --- |
| Maven Central (Java) | Artifacts are signed with GPG. The public key is nolax_pubkey.asc in the SDK repository |
| npm, PyPI, NuGet | Published from the maintainer's machine. No build provenance attestation is attached yet |
Nolax does not publish a software bill of materials for the SDKs. With zero
runtime dependencies in three of the four packages, package.json,
pyproject.toml and the project file are the whole list.
Check a package yourself
Inspect the contents before you install:
npm pack @nolax/sdk --dry-run
pip download nolax-sdk==1.1.1 --no-deps
The Node package contains compiled files in dist/, package.json, the licence
and the readme. Pin the exact version in your lockfile and review upgrades like
any other dependency.
For the Java artifact, verify the signature against the published key:
gpg --import nolax_pubkey.asc
gpg --verify nolax-sdk-1.1.0.jar.asc nolax-sdk-1.1.0.jar
Check what it does at runtime
Run the SDK in dry run mode to read every payload
before anything leaves your network. The SDK never throws into your request
path, never logs your API key, and sends data only to the endpoint you configure.