Record · nesbitt.io

Signing is for the bad days

Andrew Nesbitt | Software Engineer and Package Management Nerd · 24 May 2026 · 12 min read

A post on nesbitt.io, published 24 May 2026, has not been cited by any blog yet (corpus.blog, measured 11 October 2026).

A record is what was published and who pointed at it. The text of the post is not shown here: read it at the source, or at its Wayback capture.

Read at nesbitt.io Wayback capture

0blogs citing

Citing blogs and links by period
Period	Blogs	Links
All time	0	0
Last 90 days	0	0
Last 30 days	0	0
Last 7 days	0	0

Figures for this page
Words blogs link it with	0
External links	30
Length	2,578

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://badhomb.re/ Who cites this page

badhomb.re

https://theupdateframework.io/ Who cites this page

theupdateframework.io

https://www.usenix.org/conference/usenixsecurity19/presentation/torres-arias Who cites this page

usenix.org

https://blog.sigstore.dev/a-new-kind-of-trust-root-f11eeeed92ef Who cites this page

blog.sigstore.dev

https://badhomb.re/publications/

badhomb.re

https://guac.sh/ Who cites this page

guac.sh

https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/torres-arias Who cites this page

usenix.org

https://theupdateframework.io/papers/package-management-security-tr08-02.pdf

theupdateframework.io

https://theupdateframework.io/docs/metadata/

theupdateframework.io

https://theupdateframework.io/docs/security/

theupdateframework.io

https://peps.python.org/pep-0458/ Who cites this page

peps.python.org

https://in-toto.io/ Who cites this page

in-toto.io

https://www.openwall.com/lists/oss-security/2024/03/29/4 Who cites this page

openwall.com

https://attack.mitre.org/campaigns/C0024/ Who cites this page

attack.mitre.org

https://reproducible-builds.org/ Who cites this page

reproducible-builds.org

https://about.codecov.io/security-update/ Who cites this page

about.codecov.io

https://central.sonatype.org/publish/requirements/gpg/ Who cites this page

central.sonatype.org

Removing PGP from PyPI Read at blog.pypi.org

blog.pypi.org

https://github.com/sigstore/fulcio/ Who cites this page

github.com

https://github.com/sigstore/rekor Who cites this page

github.com

https://dl.acm.org/doi/10.1145/3548606.3560596 Who cites this page

dl.acm.org

https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/melara Who cites this page

usenix.org

https://www.ledger.com/blog/security-incident-report Who cites this page

ledger.com

The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) Read at unit42.paloaltonetworks.com

unit42.paloaltonetworks.com

https://orca.security/resources/blog/tanstack-npm-supply-chain-worm/ Who cites this page

orca.security

Supply-chain attack analysis: Ultralytics - The Python Package Index Blog Read at blog.pypi.org

blog.pypi.org

https://docs.npmjs.com/generating-provenance-statements?utm_source=nodeland&utm_medium=email&utm_campaign=why-trusted-publishing-can-t-save-us Who cites this page

docs.npmjs.com

https://docs.pypi.org/attestations/ Who cites this page

docs.pypi.org

https://blog.trailofbits.com/2024/05/14/a-peek-into-build-provenance-for-homebrew/ Read at blog.trailofbits.com

blog.trailofbits.com

https://www.cisa.gov/secure-software-attestation-form Who cites this page

cisa.gov

Elsewhere on nesbitt.io (1)

Package Manager Threat Models Read at nesbitt.io

nesbitt.io

Signing is for the bad days

Cited by

Links from this post

Similar posts