Google has launched a new initiative, OSS Rebuild, aimed at strengthening the security of open-source package ecosystems and preventing supply chain attacks.
“As supply chain attacks continue to target widely-used dependencies, OSS Rebuild gives security teams powerful data to avoid compromise without burden on upstream maintainers.”
Said, Matthew Suozzo, Google Open Source Security Team (GOSST).
The development aims to deliver build provenance for packages on Python Package Index (Python), npm (JavaScript/TypeScript), and Crates.io (Rust), with future plans to expand to additional open-source development platforms.
OSS Rebuild aims to use declarative build definitions, build instrumentation, and network monitoring to generate reliable security metadata, helping verify a package’s origin and confirm it hasn’t been altered.
“Through automation and heuristics, we determine a prospective build definition for a target package and rebuild it,”
Google said.
“We semantically compare the result with the existing upstream artifact, normalizing each one to remove instabilities that cause bit-for-bit comparisons to fail (e.g., archive compression).”
After a package is reproduced, its build definition and results are published using SLSA Provenance, enabling users to verify its origin, replicate the build, or customize it from a trusted baseline. When full automation isn’t possible, OSS Rebuild provides a manual build specification as an alternative.
“Rebuilds are derived by analyzing the published metadata and artifacts and are evaluated against the upstream package versions,”
Google said.
“When successful, build attestations are published for the upstream artifacts, verifying the integrity of the upstream artifact and eliminating many possible sources of compromise.”