Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Adding build provenance to Homebrew

blog.trailofbits.com | blog | #ci-cd | #macos | #supply-chain-security | #slsa | #homebrew | #build-provenance | #open-source-security | #package-managers

Summary

Trail of Bits, Alpha-Omega, and OpenSSF are adding cryptographically verifiable SLSA Build L2 provenance to homebrew-core, letting users prove packages come from Homebrew's official CI/CD.
Published
Collected

original ↗

Related coverage

  1. A peek into build provenance for Homebrew (blog.trailofbits.com)
  2. Why Lockfiles Matter for Supply Chain Security (aikido.dev)
  3. Odyssey Stealer & AMOS Hit macOS Developers with Fake Homebrew Sites (hunt.io)
  4. Fake Homebrew Pages Deliver Cuckoo Stealer via ClickFix | macOS Threat Hunting Analysis (hunt.io)
  5. Securing the software supply chain with the SLSA framework (blog.trailofbits.com)
  6. Our audit of Homebrew (blog.trailofbits.com)

back