Cyber Risks · Trail of Bits Blog

William Woodruff

Summary: This is an index page of Trail of Bits blog posts by William Woodruff, covering work such as a new ASN.1 API for PyCA Cryptography, PEP 740 index-hosted digital attestations on PyPI, and audits of Homebrew and PyPI. Individual entries describe projects including trusted publishing for PyPI, sigstore-python's stable release, and abi3audit, a tool that found hundreds of incorrectly tagged Python package distributions.

What you should know: The recurring subject is the integrity of the Python and Homebrew supply chains that most engineering organizations pull from daily, and the page notes that hundreds of package distributions were found with ABI tagging errors that could lead to crashes or exploitable memory corruption.

Read the original at Trail of Bits Blog ↗