---
id: 1606
title: "Adding build provenance to Homebrew"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2023/11/06/adding-build-provenance-to-homebrew/"
published_at: "2023-11-06T13:00:37Z"
tags: ["ci-cd", "macos", "supply-chain-security", "slsa", "homebrew", "build-provenance", "open-source-security", "package-managers"]
phying_url: "https://phying.com/item/1606"
lang: en
---

# Adding build provenance to Homebrew

## Summary

Trail of Bits, Alpha-Omega, and OpenSSF are adding cryptographically verifiable SLSA Build L2 provenance to homebrew-core, letting users prove packages come from Homebrew's official CI/CD.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2023-11-06T13:00:37Z
- **Original:** https://blog.trailofbits.com/2023/11/06/adding-build-provenance-to-homebrew/
- **Phying News:** https://phying.com/item/1606