Facundo Tuesca

Summary: Trail of Bits is preparing Sigstore's rekor-monitor for production use so developers can detect tampering and unauthorized uses of their identities in the Rekor transparency log. Separately, PyPI now supports marking projects as archived, letting owners signal that a project is not expected to receive further updates.
What you should know: Package managers have an integrity problem, and these two changes give downstream consumers two signals they lacked: a way to catch unauthorized identity use in the transparency log, and an explicit archival status on PyPI projects that will no longer be updated.

Read the original at Trail of Bits Blog ↗