This six-month project will bring cryptographically verifiable build provenance to homebrew-core , allowing end users and companies to prove that Homebrew’s packages come from the official Homebrew CI/CD. As the dominant macOS package manager and popular userspace alternative on Linux, Homebrew facilitates hundreds of millions of package installs per year, including development tools and toolchains that millions of programmers rely on for trustworthy builds of their software. Software grows in complexity over time, and builds are no exception; modern build processes contain all the indications of a weak link in the software supply chain: