Celebrating our 2025 open-source contributions

Celebrating our 2025 open-source contributions
嗯，用户让我帮忙总结一篇文章，控制在100字以内，而且不需要特定的开头。首先，我需要仔细阅读文章内容，理解其主要信息。文章主要讲的是Trail of Bits公司在过去一年中对开源社区的贡献。他们提交了375个pull requests，影响了90个项目，从密码学库到Rust编译器。这些贡献体现了他们“分享他人可用”的价值观。他们不仅在自己的项目上努力，还修复了依赖工具中的限制，并将改进贡献给更广泛的开源社区。大部分贡献来自客户项目，他们选择上游贡献而不是分叉或本地修补。文章还提到了一些关键贡献，如Sigstore rekor-monitor、Rust compiler和pyca/cryptography等。接下来，我需要将这些信息浓缩到100字以内。重点包括：贡献的数量和范围、核心价值观、修复上游工具、客户项目驱动的贡献、关键项目如Sigstore和Rust等。最后，确保语言简洁明了，直接描述内容，不使用任何开头模板。 </think> Trail of Bits在过去一年中提交了375个Pull Request至90个开源项目，涵盖密码学库、Rust编译器等领域。这些贡献体现了其“分享他人可用”的核心价值观，并修复了依赖工具中的限制。大部分贡献来自客户项目，选择上游贡献而非分叉或本地修补。关键项目包括Sigstore rekor-monitor、Rust compiler和pyca/cryptography等。 2026-1-30 12:0:0 Author: blog.trailofbits.com(查看原文) 阅读量:4 收藏

Last year, our engineers submitted over 375 pull requests that were merged into non–Trail of Bits repositories, touching more than 90 projects from cryptography libraries to the Rust compiler.

This work reflects one of our driving values: “share what others can use.” The measure isn’t whether you share something, but whether it’s actually useful to someone else. This principle is why we publish handbooks, write blog posts, and release tools like Claude skills, Slither, Buttercup, and Anamorpher.

But this value isn’t limited to our own projects; we also share our efforts with the wider open-source community. When we hit limitations in tools we depend on, we fix them upstream. When we find ways to make the software ecosystem more secure, we contribute those improvements.

Most of these contributions came out of client work—we hit a bug we were able to fix or wanted a feature that didn’t exist. The lazy option would have been forking these projects for our needs or patching them locally. Contributing upstream instead takes longer, but it means the next person doesn’t have to solve the same problem. Some of our work is also funded directly by organizations like the OpenSSF and Alpha-Omega, who we collaborate with to make things better for everyone.

Key contributions

Sigstore rekor-monitor: rekor-monitor verifies and monitors the Rekor transparency log, which records signing events for software artifacts. With funding from OpenSSF, we’ve been getting rekor-monitor ready for production use. We contributed over 40 pull requests to the Rekor project this year, including support for custom certificate authorities and support for the new Rekor v2. We also added identity monitoring for Rekor v2, which lets package maintainers configure monitored certificate subjects and issuers and then receive alerts whenever matching entries appear in the log. If someone compromises your release process and signs a malicious package with your identity, you’ll know.
Rust compiler and rust-clippy: Clippy is Rust’s official linting tool, offering over 750 lints to catch common mistakes. We contributed over 20 merged pull requests this year. For example, we extended the implicit_clone lint to handle to_string() calls, which let us deprecate the redundant string_to_string lint. We added replacement suggestions to disallowed_methods so that teams can suggest alternatives when flagging forbidden API usage, and we added path validation for disallowed_* configurations so that typos don’t silently disable lint rules. We also extended the QueryStability lint to handle IntoIterator implementations in rustc, which catches nondeterminism bugs in the compiler. The motivation came from a real issue we spotted: iteration order over hash maps was leaking into rustdoc’s JSON output.
pyca/cryptography: pyca/cryptography is Python’s most widely used cryptography library, providing both high-level recipes and low-level interfaces to common algorithms. With funding from Alpha-Omega, we landed 28 pull requests this year. Our work was aimed at adding a new ASN.1 API, which lets developers define ASN.1 structures using Python decorators and type annotations instead of wrestling with raw bytes or external schema files. Read more in our blog post “Sneak peek: A new ASN.1 API for Python.”
hevm: hevm is a Haskell implementation of the Ethereum Virtual Machine. It powers both the symbolic and concrete execution in Echidna, our smart contract fuzzer. We contributed 14 pull requests this year, mostly focused on performance: we added cost centers to individual opcodes to ease profiling, optimized memory operations, and made stack and program counter operations strict, which got us double-digit percentage improvements on concrete execution benchmarks. We also implemented cheatcodes like toString to improve hevm’s compatibility with Foundry.
PyPI Warehouse: Warehouse powers the Python Package Index (PyPI), which serves over a billion package downloads per day. We continued our long-running collaboration with PyPI and Alpha-Omega, shipping project archival support so that maintainers can signal when packages are no longer actively maintained. We also cut the test suite runtime by 81%, from 163 to 30 seconds, even as test coverage grew to over 4,700 tests.
pwndbg: pwndbg is a GDB and LLDB plugin that makes debugging and exploit development less painful. Last year, we packaged LLDB support for distributions and improved decompiler integration. We also contributed pull requests to other tools in the space, including pwntools, angr, and Binary Ninja’s API.

A merged pull request is the easy part. The hard part is everything maintainers do before and after: writing extensive documentation, keeping CI green, fielding bug reports, explaining the same thing to the fifth person who asks. We get to submit a fix and move on. They’re still there a year later, making sure it all holds together.

Thanks to everyone who shaped these contributions with us, from first draft to merge. See you next year.

Trail of Bits’ 2025 open-source contributions

AI/ML

Repo: majiayu000/litellm-rs
- By smoelius
  - #3: Specify Anthropic key with x-api-key header
Repo: mlflow/mlflow
- By Ninja3047
  - #18274: Fix type checking in truncation message extraction (#18249)
Repo: simonw/llm
- By dguido
  - #950: Add model_name parameter to OpenAI extra models documentation
Repo: sst/opencode
- By Ninja3047
  - #4549: tweak: Prefer VISUAL environment variable over EDITOR per Unix convention

Cryptography

Languages and compilers

Libraries

Repo: alex/rust-asn1
- By facutuesca
Repo: bytecodealliance/wasi-rs
- By smoelius
  - #103: Upgrade wit-bindgen-rt to version 0.39.0
Repo: cargo-public-api/cargo-public-api
- By smoelius
  - #831: Box<dyn ...> with two or more traits
Repo: di/id
- By woodruffw
  - #333: refactor: replace requests with urllib3
Repo: di/pip-api
- By woodruffw
Repo: fardream/go-bcs
- By tjade273
  - #19: Fix unbounded upfront allocations
Repo: frewsxcv/rust-crates-index
- By smoelius
  - #189: Add git-https-reqwest feature
Repo: luser/strip-ansi-escapes
- By smoelius
  - #21: Upgrade vte to version 0.14
Repo: psf/cachecontrol
- By woodruffw
Repo: tafia/quick-xml
- By Ninja3047
  - #904: Implement serializing CDATA

Tech infrastructure

Repo: Homebrew/homebrew-core
- By elopez
  - #206517: slither-analyzer 0.11.0
  - #254439: slither-analyzer: bump python resources
- By woodruffw
Repo: NixOS/nixpkgs
- By elopez
Repo: google/oss-fuzz
- By ret2libc
  - #14080: projects/libpng: make sure master branch is used
  - #14178: infra/helper: pass the right arguments to docker_run in reproduce_impl
Repo: microsoft/vcpkg
- By ekilmer
  - #45458: \[abseil\] Add feature “test-helpers”
Repo: microsoft/vcpkg-tool
- By ekilmer
  - #1602: Check errno after waitpid for EINTR
  - #1744: \[spdx\] Add installed package files to SPDX SBOM file

Software testing tools

Packaging ecosystem/supply chain

Others

Repo: AzureAD/microsoft-authentication-extensions-for-python
- By DarkaMaul
  - #144: Add missing import in token_cache_sample
Repo: SchemaStore/schemastore
- By woodruffw
  - #4635: github-workflow: workflow_call.secrets.*.required is not required
  - #4637: github-workflow: trigger types can be an array or a scalar string
Repo: google/gvisor
- By ret2libc
  - #12325: usertrap: disable syscall patching when ptraced
Repo: oli-obk/cargo_metadata
- By smoelius
Repo: ossf/alpha-omega
- By woodruffw
Repo: rustsec/advisory-db
- By DarkaMaul
  - #2169: Protobuf DoS
- By smoelius
  - #2289: Withdraw RUSTSEC-2022-0044

文章来源: https://blog.trailofbits.com/2026/01/30/celebrating-our-2025-open-source-contributions/
如有侵权请联系:admin#unsafe.sh