Michael Altfield

Sign PyPI Releases

4

**Describe the bug** When a user downloads this python module using `pip`, there is no cryptographic authenticity or integrity validation to protect the user from a MITM attack. Therefore, this...

Integrate PGP Key into keys.openpgp.org

2

Please verify your email address with `keys.openpgp.org` so that users can download your key. ### Problem It's great that your project signs your releases with pgp using key = `[email protected]`....

Document "Cryptographic Verification of Release" after-download-and-before-install in "Installing" Docs

2

Please update the "Installing" Documentation to include how users can cryptographically verity the authenticity and integrity of the release after they've downloaded it and before they install it. ### Expected...

Please sign your debian releases with PGP: * https://github.com/wp-cli/builds/tree/gh-pages/deb Signing your releases will provide cryptographic 1. Authenticity and 2. Integrity Because these are releases for Debian, I recommend signing them...

Support external signatures (sigs made on system without TUF installed)

5

Please fill in the fields below to submit an issue or feature request. The more information that is provided, the better. **Description of issue or feature request**: Feature request: please...

Add BusKill

1

First, thanks for maintaining this fantastic, curated list! This issue is a request to add the BusKill project's sites to this repo. BusKill is an open-source project for hardware kill...

added better logging when 'hack attempt is encountered', and fixed a …

3

…logic bug that resulted in a false-positive of the "hack attempt" exit when a phplist subscribe page had 0 lists selected. For more info, see: * https://discuss.phplist.org/t/purpose-of-hack-attempt-exit-in-subscribelib2-php/4578/

Add Monero to Supply Chain Compromises

7

This curated list of Supply Chain Compromises is awesome, thanks for maintaining it! * https://github.com/cncf/tag-security/tree/main/supply-chain-security/compromises I noticed that the Monero wallet's compromised release from 2019-11-18 is not listed in this...

Sign PyPI releases

1

**Describe the bug** When a user downloads this python module using `pip`, there is no cryptographic authenticity or integrity validation to protect the user from a MITM attack. Therefore, this...

Build self-contained, platform-specific releases

2

### Description of the Feature Please setup GitHub Actions to build self-contained executables for the Kitchen Sink demo targeting at least Linux, Windows, and MacOS ### Problem Currently all the...