diff --git a/README.md b/README.md index b3d77e8..7264eca 100644 --- a/README.md +++ b/README.md @@ -123,6 +123,7 @@ | Presentation Title | Author(s) | Year | | --- | --- | --- | +| [Trusted Publishing: Lessons from PyPI](presentations/Trusted%20Publishing:%20Lessons%20from%20PyPI/) | William Woodruff | 2023 | | [Python Packaging Mystery Meat](presentations/Python%20Packaging%20Mystery%20Meat) | William Woodruff | 2022 | | [Improving PyPI's security with Two Factor Authentication](presentations/Improving%20PyPI%27s%20security%20with%20Two%20Factor%20Authentication) | William Woodruff | 2019 | | [Linux Security Event Monitoring with osquery](presentations/osquery%20Linux%20security%20event%20monitoring) | Alessandro Gario | 2019 | @@ -278,7 +279,7 @@ Companies that have allowed us to speak about our work can be found here. Many m | Product | Date | Level of
Effort | Announcement | Report | | --- | --: | :-: | --- | :-: | -| [DragonFly2](https://d7y.io/) | July 2023 | 4 | [Dragonfly](https://d7y.io/blog), [OSTIF](https://ostif.org/dragonfly-audit/) | [📄✅](reviews/2023-07-dragonfly2-securityreview.pdf) | +| [DragonFly2](https://d7y.io/) | July 2023 | 4 | [Dragonfly](https://d7y.io/blog), [OSTIF](https://ostif.org/dragonfly-audit/) | [📄✅](reviews/2023-07-dragonfly2-securityreview.pdf) | | [Thesis tss-lib BitForge](https://threshold.network/) | June 2023 | .2 | | [📄✅](reviews/2023-06-thesistsslib-securityreview.pdf) | | [DigitalOcean OIDC](https://www.digitalocean.com/) | August 2023 | 4 | | [📄](reviews/2023-08-digitalocean-oidc-securityreview.pdf) | | [Eclipse JKube](https://eclipse.dev/jkube/) | May 2023 | 5 | [OSTIF](https://ostif.org/jkube-audit/), [Eclipse](https://blogs.eclipse.org/post/mika%C3%ABl-barbero/eclipse-foundation-publishes-results-eclipse-jkube-security-audit) | [📄✅](reviews/2023-05-eclipse-jkube-securityreview.pdf) | @@ -425,8 +426,8 @@ Companies that have allowed us to speak about our work can be found here. Many m | [Raft](https://docs.tempus.finance/products/raft) | Apr 2023 | 2 | | [📄✅](reviews/2023-04-tempus-raft-securityreview.pdf) | | [MYSO v2](https://www.myso.finance) | Apr 2023 | 2 | [Security review of our v2 contracts](https://twitter.com/MysoFinance/status/1649191996978786305) | [📄✅](reviews/2023-04-mysoloans-securityreview.pdf) | | [Waymont](https://www.waymont.co/) | Mar 2023 | 1 | | | -| [Atlendis Smart Contracts](https://www.atlendis.io/) | Mar 2023 | 6 | [Atlendis V2 Audit](https://www.atlendis.io/blog/Atlendis-V2-Trail-of-Bits-Audit) | [📄✅](reviews/2023-03-atlendis-atlendissmartcontracts-securityreview.pdf) | -| [Succinct Labs Ethereum Light Client](https://www.succinct.xyz/) | Feb 2023 | 8 | [Introducing Telepathy](https://blog.succinct.xyz/blog/telepathy) | [📄✅](reviews/2023-02-succinct-securityreview.pdf) | +| [Atlendis Smart Contracts](https://www.atlendis.io/) | Mar 2023 | 6 | [Atlendis V2 Audit](https://www.atlendis.io/blog/Atlendis-V2-Trail-of-Bits-Audit) | [📄✅](reviews/2023-03-atlendis-atlendissmartcontracts-securityreview.pdf) | +| [Succinct Labs Ethereum Light Client](https://www.succinct.xyz/) | Feb 2023 | 8 | [Introducing Telepathy](https://blog.succinct.xyz/blog/telepathy) | [📄✅](reviews/2023-02-succinct-securityreview.pdf) | | [Primitive Hyper](https://primitive.xyz/) | Jan 2023 | 8 | | | | [Polygon Edge](https://polygon.technology/) | Jan 2023 | 6 | | | | [Optimism](https://www.optimism.io/) | Dec 2022 | 8 | | | diff --git a/presentations/Trusted Publishing: Lessons from PyPI/README.md b/presentations/Trusted Publishing: Lessons from PyPI/README.md new file mode 100644 index 0000000..dd0d3cc --- /dev/null +++ b/presentations/Trusted Publishing: Lessons from PyPI/README.md @@ -0,0 +1,21 @@ +# Trusted Publishing: Lessons from PyPI + +This talk will provide a developer-minded introduction to "trusted publishing," +an OpenID Connect-based authentication scheme that PyPI has successfully +deployed to reduce the need for (and risk associated with) manual configured +API tokens. Thousands of packages (including many of Python's most critical +packages) have already enrolled in trusted publishing, improving the overall +security posture (and audibility) of the Python ecosystem. + +We will cover trusted +publishing in two parts: the first part will be a high-level overview of the +trusted publishing scheme and how it uses ephemeral OpenID Connect credentials, +including motivation for the scheme's security properties and how they improve +upon pre-existing package index authentication schemes (e.g. user/password pairs +and long-lived API tokens). The second part will dive into the nitty-gritty +details of how trusted publishing was implemented on PyPI, and will serve as +both a retrospective on the work and a reference for other package indices +considering similar models: it will cover some of the challenges posted by OIDC +(including support for multiple identity providers), threat model +considerations, as well as "knock-on" benefits (such as future adjoiners with +code-signing schemes like Sigstore). diff --git a/presentations/Trusted Publishing: Lessons from PyPI/Trusted Publishing: Lessons from PyPI.pdf b/presentations/Trusted Publishing: Lessons from PyPI/Trusted Publishing: Lessons from PyPI.pdf new file mode 100644 index 0000000..34be311 Binary files /dev/null and b/presentations/Trusted Publishing: Lessons from PyPI/Trusted Publishing: Lessons from PyPI.pdf differ