Google has introduced OSS Rebuild, an innovative project aimed at bolstering the security of widely used open-source packages. This initiative automatically reconstructs packages from major repositories such as PyPI, npm, and <a href="http://Crates.io" target="_blank" rel="noopener nofollow">Crates.io</a>, generating SLSA (Supply chain Levels for Software Artifacts) provenance attestations to ensure the integrity and trustworthiness of these components.
OSS Rebuild addresses the rising concerns of supply chain attacks by reproducing upstream artifacts and verifying them against published packages. This meticulous comparison helps identify potential compromises, including unauthorized code additions, hidden backdoors, and discrepancies in build environments. By offering this additional layer of scrutiny, Google allows enterprises to enhance their software dependency security without imposing extra burdens on package maintainers.
The tool is compatible with Python, JavaScript/TypeScript, and Rust package ecosystems, and it’s capable of providing SLSA Build Level 3 provenance information. This enables organizations to integrate OSS Rebuild seamlessly into their vulnerability response workflows, granting them enhanced metadata and observability tools to track and manage vulnerabilities proactively.
By making the provenance of package builds transparent, Google empowers developers and enterprises to trust open-source software components confidently. The OSS Rebuild’s capacity to identify malicious code and unsubmitted source code makes it a vital tool in the ongoing effort to safeguard the integrity of software supply chains.

Collections

Google launched OSS Rebuild, a security tool that automatically reconstructs open-source packages from PyPI, npm, and Crates.io repositories to generate SLSA provenance attestations. The tool helps detect supply chain attacks by comparing rebuilt packages against published versions, identifying unauthorized code, backdoors, and build discrepancies. It supports Python, JavaScript/TypeScript, and Rust ecosystems while providing SLSA Build Level 3 provenance information for enhanced vulnerability management.

Google Launches OSS Rebuild to Enhance Open Source Security