HomebrewHomebrew’s signing key for git commits will be changing from GPG to SSH. Please see the following blog post from @yossarian with more details: https://brew.sh/2025/02/03/Homebrew-git-signing/
| Pronouns | he/they |
| GitHub | https://github.com/p-linnane |
Patrick Linnane
- 63 Followers
- 27 Following
- 16 Posts
I maintain the Homebrew package manager and work in security operations
🇺🇦 Sviatoslav SydorenkoThanks to the efforts of @yossarian, @di, Facundo Tuesca and yours truly, we have PEP 740 attestations available on PyPI.
If you use modern pypi-publish with trusted publishing, your dists are signed automatically by default.
https://blog.pypi.org/posts/2024-11-14-pypi-now-supports-digital-attestations/
Seth LarsonIt's frustrating that every announcement for a new security feature that includes the word "GitHub" immediately gets swarmed by comments and conspiracy theories about GitHub.
I'm an anti-monopolist and want there to be a multitude of ways we build open source software, but I believe security features are different: mostly because they are either enabled by default or largely ignored.
GitHub is important to support because it's where 84% (372,841 / 440,821) of Python packages on PyPI are built.
Soatok DreamseekerA while ago, I announced that I was going to build #E2EE for the Fediverse, so that we might have private direct messaging.
Then I stumbled over the lack of available tooling for Key Transparency in a federated environment. So I started working on a specification for a Public Key Directory server.
I'm happy to announce that I finally have all my ideas on paper.
https://github.com/fedi-e2ee/public-key-directory-specification/tree/main
This specification is not complete. It still needs:
That last one is optional, but if anyone identifies an opportunity to make this project more successful, I'd love to hear it.
The @homebrew booth at GitHub Universe 24 is ready! Swing by and grab some stickers and say hello!
Do you use @homebrew? Are you attending GitHub Universe 2024? @mikemcquaid and I will be there representing Homebrew at the Open Source Zone! Come say hi and grab a sticker!
You can read more on the GitHub Blog: https://github.blog/open-source/10-projects-in-the-open-source-zone-at-github-universe-2024/#homebrew-the-essential-package-manager-for-macos-and-linux
@davidbures The PR is merged, and cork is now available. I haven't seen any problems with `brew bundle dump` lately, but feel free to open an issue and we can take a look: https://github.com/Homebrew/homebrew-bundle
@edbro Just to clarify, Open Tech Fund generously sponsored the audit for us.
@davidbures Happy to work with you on this. One of your users has opened a PR to add Cork to our main cask repo: https://github.com/Homebrew/homebrew-cask/pull/181945
yossarian (1.3.6.1.4.1.55738)i'm really happy this is finally public: we at @trailofbits did an audit of @homebrew last summer: https://blog.trailofbits.com/2024/07/30/our-audit-of-homebrew/
you can read our full report here: https://github.com/trailofbits/publications/blob/master/reviews/2023-08-28-homebrew-securityreview.pdf
