Secure open-source package ecosystems by originating, validating, and augmenting build attestations.

OSS Rebuild aims to apply reproducible build concepts at low-cost and high-scale for open-source package ecosystems.

Rebuilds are derived by analyzing the published metadata and artifacts and are evaluated against the upstream package versions. When successful, build attestations are published for the upstream artifacts, verifying the integrity of the upstream artifact and eliminating many possible sources of compromise.

We currently support the following ecosystems:

• npm (JavaScript/TypeScript)
• PyPI (Python)
• Crates.io (Rust)

While complete coverage is the aim, only the most popular packages within each ecosystem are currently rebuilt.

The oss-rebuild CLI tool provides access to OSS Rebuild data:

To view the rebuild for a given package, use the get command:

By default, this provides only a summarized view. For more granular access to rebuild data, use one of the --output formats. For example, to access the entire attestation payload, use the --output=payload option:

To view the dockerfile, use the --output=dockerfile option. This can be chained with docker to execute a rebuild locally:

While the above --output=payload option produces more human-readable content, the raw attestation bundle can be accessed as follows:

To explore more packages, the list command can be used to view the versions of a package that have been rebuilt:

oss-rebuild uses a public Cloud KMS key to validate attestation signatures. Anonymous authentication is not supported so an ADC credential must be present.

This can be accomplished with:

To disable signature verification and skip the requirement for KMS access use: --verify=false.

Join us in building a more secure and reliable open-source ecosystem!

Check out the contribution guide to learn more.

• Mitigate supply chain attacks: Detect discrepancies in open-source packages, helping to prevent compromises like those of Solarwinds and Codecov.
• Scale security standards: Utilize industry best practices such as SLSA, Sigstore, and containerized builds.
• Community participation: Create a venue to collectivize effort towards securing the open-source supply chain.
• Enable future innovation: Derive data to leverage AI-driven rebuilds.

To better understand the security properties of rebuilds, see Trust and Rebuilds.

Check out these related projects contributing to the reproducible builds effort:

• reproducible-central: Java, Kotlin reproducibility.
• kpcyrd/rebuilderd: Rebuild scheduler with support for several distros.

This is not an officially supported Google product.