---
id: 1499
title: "A peek into build provenance for Homebrew"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2024/05/14/a-peek-into-build-provenance-for-homebrew/"
published_at: "2024-05-14 13:00"
tags: ["open-source", "cryptography", "supply-chain-security", "slsa", "homebrew", "build-provenance"]
phying_url: "https://phying.com/item/1499"
lang: en
---

# A peek into build provenance for Homebrew

## Summary

Trail of Bits brings cryptographic build provenance to Homebrew: homebrew-core now attests all CI-built bottles, binding them to git commits and GitHub Actions run IDs in SLSA-compatible attestations.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2024-05-14 13:00
- **Original:** https://blog.trailofbits.com/2024/05/14/a-peek-into-build-provenance-for-homebrew/
- **Phying News:** https://phying.com/item/1499