Node.js is an open-source, cross-platform, JavaScript runtime environment. It executes JavaScript code outside of a browser. For more information on using Node.js, see the Node.js Website.
The Node.js project uses an open governance model. The OpenJS Foundation provides support for the project.
This project is bound by a Code of Conduct.
Looking for help? Check out the instructions for getting support.
Current and LTS releases follow Semantic Versioning. A member of the Release Team signs each Current and LTS release. For more information, see the Release README.
Binaries, installers, and source tarballs are available at https://nodejs.org/en/download/.
https://nodejs.org/download/release/
The latest directory is an alias for the latest Current release. The latest-codename directory is an alias for the latest release from an LTS line. For example, the latest-carbon directory contains the latest Carbon (Node.js 8) release.
https://nodejs.org/download/nightly/
Each directory name and filename contains a date (in UTC time) and the commit SHA at the HEAD of the release.
Documentation for the latest Current release is at https://nodejs.org/api/. Version-specific documentation is available in each release directory in the docs subdirectory. Version-specific documentation is also at https://nodejs.org/download/docs/.
Download directories contain a SHASUMS256.txt
file with SHA checksums for the
files.
To download SHASUMS256.txt
using curl
:
$ curl -O https://nodejs.org/dist/vx.y.z/SHASUMS256.txt
To check that a downloaded file matches the checksum, run
it through sha256sum
with a command such as:
$ grep node-vx.y.z.tar.gz SHASUMS256.txt | sha256sum -c -
For Current and LTS, the GPG detached signature of SHASUMS256.txt
is in
SHASUMS256.txt.sig
. You can use it with gpg
to verify the integrity of
SHASUM256.txt
. You will first need to import
the GPG keys of individuals authorized to create releases. To
import the keys:
$ gpg --keyserver pool.sks-keyservers.net --recv-keys DD8F2338BAE7501E3DD5AC78C273792F7D83545D
See the bottom of this README for a full script to import active release keys.
Next, download the SHASUMS256.txt.sig
for the release:
$ curl -O https://nodejs.org/dist/vx.y.z/SHASUMS256.txt.sig
Then use gpg --verify SHASUMS256.txt.sig SHASUMS256.txt
to verify
the file's signature.
See BUILDING.md for instructions on how to build Node.js from source and a list of supported platforms.
For information on reporting security vulnerabilities in Node.js, see SECURITY.md.
For information about the governance of the Node.js project, see GOVERNANCE.md.
Collaborators follow the COLLABORATOR_GUIDE.md in maintaining the Node.js project.
GPG keys used to sign Node.js releases:
4ED778F539E3634C779C87C6D7062848A1AB005C
94AE36675C464D64BAFA68DD7434390BDBE9B9C5
B9AE9905FFD7803F25714661B63B535A4C206CA9
77984A986EBC2AA786BC0F66B01FBB92821C587A
71DCFD284A79C3B38668286BC97EC7A07EDE3FC1
FD3A5288F042B6850C66B31F09FE44734EB7990E
8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600
C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8
DD8F2338BAE7501E3DD5AC78C273792F7D83545D
A48C2BEE680E841632CD4E44F07496B3EB3C1762
B9E2F5981AA6E0CD28160D9FF13993A75599653C
To import the full set of trusted release keys:
gpg --keyserver pool.sks-keyservers.net --recv-keys 4ED778F539E3634C779C87C6D7062848A1AB005C
gpg --keyserver pool.sks-keyservers.net --recv-keys B9E2F5981AA6E0CD28160D9FF13993A75599653C
gpg --keyserver pool.sks-keyservers.net --recv-keys 94AE36675C464D64BAFA68DD7434390BDBE9B9C5
gpg --keyserver pool.sks-keyservers.net --recv-keys B9AE9905FFD7803F25714661B63B535A4C206CA9
gpg --keyserver pool.sks-keyservers.net --recv-keys 77984A986EBC2AA786BC0F66B01FBB92821C587A
gpg --keyserver pool.sks-keyservers.net --recv-keys 71DCFD284A79C3B38668286BC97EC7A07EDE3FC1
gpg --keyserver pool.sks-keyservers.net --recv-keys FD3A5288F042B6850C66B31F09FE44734EB7990E
gpg --keyserver pool.sks-keyservers.net --recv-keys 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600
gpg --keyserver pool.sks-keyservers.net --recv-keys C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8
gpg --keyserver pool.sks-keyservers.net --recv-keys DD8F2338BAE7501E3DD5AC78C273792F7D83545D
gpg --keyserver pool.sks-keyservers.net --recv-keys A48C2BEE680E841632CD4E44F07496B3EB3C1762
See the section above on Verifying Binaries for how to use these keys to verify a downloaded file.
Other keys used to sign some previous releases:
9554F04D7259F04124DE6B476D5A82AC7E37093B
93C7E9E91B49E432C2F75674B0A78B0A6C481CF6
56730D5401028683275BD23C23EFEFE93C4CFFFE
114F43EE0176B71C7BC219DD50A3051F888C628D
7937DFD2AB06298B2293C3187D33FF9D0246406D
此处可能存在不合适展示的内容,页面不予展示。您可通过相关编辑功能自查并修改。
如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容,可点击提交进行申诉,我们将尽快为您处理。