Monday 06 July 2026 08:40:49 GMT+02:00
Netcrook
#Sigstore
When the Trust Layer Blinks: Python’s Release API Bug and the Hidden Risk of Bad Metadata
A patched authentication bypass in Python.org’s release management API shows how a software supply chain can be threatened without touching the actual installer.
When Software Trust Stops Relying on a Hidden Key
Sigstore points to a newer trust model for software releases: identity-backed signing, a public tamper-evident log, and less dependence on a long-lived secret.
When Package Trust Becomes the Attack Surface
A sprawling npm supply-chain incident shows how a single publishing path can ripple through developer tooling, while provenance metadata may look reassuring even when it is part of the problem.
When AI Writes the Code, Trust Becomes the Real Vulnerability
A new product announcement spotlights a harder problem than prompt safety: proving where AI-generated code came from, and who stands behind it before it ships.