Thousands of Debian packages updated from their upstream Git repository

• pacman-bintrans

  8 83 5.1 Rust

  Experimental pacman integration for Reproducible Builds and Binary Transparency (with sigstore/rekor)

  > Of course, since these packages are built automatically without human supervision it’s likely that some of them will have bugs in them that would otherwise have been caught by the maintainer.

  Human supervision isn't enough to protect the supply chain, and I can't think of a time that it's actually stopped an attack at the packaging stage, but having some extra "friction" in the process seems like it should be a benefit. Ideally an attacker would have to get past both the upstream author and the Debian maintainer, rather than these being two separate single points of failure.

  Fortunately the Debian project is improving the situation with regards to supply chain attacks by continuing to work on Reproducible Builds. I think the next step from there needs to be Binary Transparency, with the adoption of the sort of approach being trialled by Arch Linux:

  https://github.com/kpcyrd/pacman-bintrans

• SaaSHub

  www.saashub.com featured

  SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

  

• 3270font

  1 0 0.0 Python

  A 3270 font in a modern format (by kilobyte)

• 3270font

  12 1,756 3.4 Python

  A 3270 font in a modern format

• gitian-builder

  7 402 3.1 Python

  Build packages in a secure deterministic fashion inside a VM

  For those interested in reproducible builds, the gitian [1] project is a fairly simple VM which sets the up the necessary environment for doing this sort of thing.

  The tooling and community around reproducible builds is growing all the time, and imo we should be insisting on it for things such as government apps.

  [1] https://github.com/devrandom/gitian-builder

Suggest a related project