Home » Security Bloggers Network » Celebrating our 2021 Open Source Contributions

Celebrating our 2021 Open Source Contributions

by Sam Moelius on December 31, 2021

At Trail of Bits, we pride ourselves on making our best tools open source, such as algo, manticore, and graphtage. But while this post is about open source, it’s not about our tools…

In 2021, Trail of Bits employees submitted over 190 pull requests (PRs) that were merged into non-Trail of Bits repositories. This demonstrates our commitment to securing the software ecosystem as a whole and to improving software quality for everyone. A representative list of contributions appears at the end of this post, but here are some highlights:

LLVM is a set of compiler and toolchain technologies. LLVM serves as the backend for many popular compilers, such as clang, rustc, and swiftc. We implemented a number of fixes for bugs in LLVM, including correcting documentation errors, ensuring valid JSON is produced in clang’s AST dumping mode, and ensuring that LLVM accepts only well-formed bitcode.
Nixpkgs is a collection of over 80,000 software packages that can be installed with the Nix package manager. We made improvements and bug fixes to many widely used Nix packages, including Go, Hevm, libff, Protobuf, and SBV.
Osquery is an SQL-powered framework for operating system instrumentation, monitoring, and analytics. We made numerous contributions to osquery, most notably adding support for Apple Silicon, the Arm-based architecture that Apple began transitioning to earlier this year.
Python is an interpreted, high-level, general-purpose programming language. We contributed a bunch of fixes and new functionality to key packages in the Python packaging/distribution ecosystem, including mypy, pip-api, and Warehouse. We also added DWARFv5 support to pyelftools, the dominant Python ELF parser.
Pwndbg is a GDB plug-in that makes debugging with GDB “suck less.” We made improvements and bug fixes to pwndbg in areas ranging from command parsing to the way anonymous pages are mapped.

We would like to acknowledge that submitting a PR is only a tiny part of the open source experience. Someone has to review the PR. Someone has to maintain the code after the PR is merged. And submitters of earlier PRs have to write tests to ensure the functionality of their code is preserved.

We contribute to these projects in part because we love the craft, but also because we find these projects useful. For this, we offer the open source community our most sincere thanks, and wish everyone a happy, safe, and productive 2022!