PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Adding build provenance to Homebrew

blog.trailofbits.com | blog | #ci-cd | #macos | #supply-chain-security | #slsa | #homebrew | #build-provenance | #open-source-security | #package-managers
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits, Alpha-Omega, and OpenSSF are adding cryptographically verifiable SLSA Build L2 provenance to homebrew-core, letting users prove packages come from Homebrew's official CI/CD.
Published
Collected

Related coverage

blog · blog.trailofbits.com
A peek into build provenance for Homebrew
Trail of Bits brings cryptographic build provenance to Homebrew: homebrew-core now attests all CI-built bottles, binding them to git commits and GitHub Actions run IDs in SLSA-compatible attestations.
blog · aikido.dev
Why Lockfiles Matter for Supply Chain Security
Lockfiles pin exact dependency versions, ensuring reproducible builds and blocking automatic updates to potentially compromised packages—a simple but critical defense against supply chain attacks.
blog · hunt.io
Odyssey Stealer & AMOS Hit macOS Developers with Fake Homebrew Sites
A macOS campaign targeting developers via fake Homebrew, TradingView and LogMeIn download portals delivered Odyssey Stealer and AMOS, with 85+ phishing domains tied to multi-year infrastructure.
research · hunt.io
Fake Homebrew Pages Deliver Cuckoo Stealer via ClickFix | macOS Threat Hunting Analysis
Homebrew typosquats delivered Cuckoo Stealer via ClickFix: a first stage stole credentials via dscl authonly prompts, then a macOS infostealer/RAT hitting 20+ wallets and persisting via LaunchAgent.
blog · blog.trailofbits.com
Securing the software supply chain with the SLSA framework
An overview of the SLSA framework's Build Levels 1-3, signed build provenance from CI/CD platforms, PEP 740 bringing SLSA provenance to PyPI, and how consumers can verify artifact origins.
blog · blog.trailofbits.com
Our audit of Homebrew
Trail of Bits' Open Tech Fund-sponsored audit of Homebrew found non-critical flaws enabling unexpected code loading and CI/CD attacks that could tamper with bottle builds and exfiltrate secrets.
Back