Google has rolled out OSS Rebuild, a new effort focused on strengthening the security of open-source software packages, The Hacker News reports. The goal is to reduce supply chain risks by verifying the integrity of popular packages across ecosystems like PyPI (Python), npm (JavaScript/TypeScript), and Crates.io (Rust). Instead of relying on upstream maintainers to implement changes, Google is taking on the task of rebuilding packages and providing trustworthy metadata about how they were created.The project uses a mix of build definitions, instrumentation, and network analysis to reproduce package builds and compare them to the originals. By stripping out variables like compression inconsistencies, OSS Rebuild can semantically verify whether a package matches its source code. If a match is confirmed, it generates a build attestation using SLSA Provenance, a format that makes it easier for users to verify package origins and rebuild from a known-good baseline.If a package can’t be automatically reproduced, the system provides a manual specification instead. This gives users a clear way to validate packages even when automation falls short. OSS Rebuild is also designed to flag unusual or malicious changes, such as code in a published package that doesn’t exist in the public repo, unexpected file changes, or embedded operations that are hard to spot manually.Beyond threat detection, the tool has broader security implications. It can improve the accuracy of SBOMs, reduce response times during vulnerability events, and take pressure off CI/CD platforms, which are often overburdened with managing package trust. In short, OSS Rebuild helps security teams gain more visibility and control without having to overhaul how developers publish or consume packages.
You can skip this ad in 5 seconds