Notices by yossarian (1.3.6.1.4.1.55738) (yossarian@infosec.exchange)

TIL: Some surprising code execution sources in bash

https://yossarian.net/til/post/some-surprising-code-execution-sources-in-bash

#til #shell #security

i'm really excited to share the work my team at @trailofbits has been doing for the last year: Sigstore-based attestations are now live and generally available on PyPI!

if you're already using Trusted Publishing with the canonical pypi-publish action, you don't need to change anything: the action will generate and upload an attestation on your behalf.

we've written a blog post on some of the technical details behind PyPI's attestation features, including Sigstore and PEP 740, here: https://blog.trailofbits.com/2024/11/14/attestations-a-new-generation-of-signatures-on-pypi/

#python #pypi #security #sigstore