{"id":178637,"date":"2025-07-22T09:40:51","date_gmt":"2025-07-22T09:40:51","guid":{"rendered":"https:\/\/linuxiac.com\/?p=178637"},"modified":"2025-07-22T10:02:20","modified_gmt":"2025-07-22T10:02:20","slug":"google-debuts-oss-rebuild-project","status":"publish","type":"post","link":"https:\/\/linuxiac.com\/google-debuts-oss-rebuild-project\/","title":{"rendered":"Google Debuts OSS Rebuild Project"},"content":{"rendered":"\n<p>Remember high-profile incidents, such as the <a href=\"https:\/\/linuxiac.com\/the-upstream-xz-tarballs-have-been-backdoored\/\">xz-utils drama<\/a> in 2024, which showed how malicious actors can slip backdoors into widely used dependencies, putting millions of systems at risk? There&#8217;s now a solid way to stop these kinds of attempts, backed by one of the world&#8217;s tech giants, namely, Google.<\/p>\n\n\n\n<p>Yesterday, Google\u2019s Open Source Security Team announced a brand new project, <a href=\"https:\/\/oss-rebuild.dev\/\" target=\"_blank\" rel=\"noreferrer noopener\">OSS Rebuild<\/a>, a hosted service that automatically recompiles popular packages from PyPI, npm, and Crates.io and then publishes SLSA-Level 3 provenance for every build.<\/p>\n\n\n\n<p>In simple terms, it attempts to rebuild what developers download, verify that the binaries originated from the public source tree, and raise an alarm if anything appears suspicious. Here&#8217;s how the whole thing works.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Automatic build recipes.<\/strong> Heuristics inspect an upstream package and spit out a declarative build file.<\/li>\n\n\n\n<li><strong>Hermetic rebuild.<\/strong> The service recompiles inside a minimal, instrumented environment.<\/li>\n\n\n\n<li><strong>Semantic diffing.<\/strong> Bit-for-bit matches aren\u2019t required; instead, archives are normalized to catch real discrepancies rather than gzip timestamp noise.<\/li>\n\n\n\n<li><strong>Signed provenance.<\/strong> Each successful build emits a Sigstore-backed SLSA attestation, providing security teams with verifiable breadcrumbs that can be piped into SBOM generators or policy engines.<\/li>\n<\/ol>\n\n\n\n<p>Because every step is logged and diffed, the platform can flag three ugly scenarios that routinely slip through today:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Hidden code drops.<\/strong> If a published artifact includes files missing from GitHub, the attestation simply isn\u2019t issued\u2014an instant red flag.<\/li>\n\n\n\n<li><strong>Poisoned builders.<\/strong> Standardized containers isolate the build from a vendor\u2019s compromised CI.<\/li>\n\n\n\n<li><strong>Stealth backdoors.<\/strong> Dynamic trace analysis can surface odd syscalls or network dials\u2014tells that foiled investigators during last year\u2019s xz-utils backdoor hunt.<\/li>\n<\/ul>\n\n\n\n<p>The codebase, <a href=\"https:\/\/github.com\/google\/oss-rebuild\" target=\"_blank\" rel=\"noreferrer noopener\">pushed to GitHub<\/a> under the Apache 2.0 license, already ships a Go-based CLI. A single <code>go install<\/code> drops the <code>oss-rebuild<\/code> binary, letting practitioners pull provenance for <em>syn<\/em> v2.0.39 on Crates.io, list every rebuilt wheel of <em>absl-py<\/em>, or pipe an entire <em>lodash<\/em> rebuild straight into Docker.<\/p>\n\n\n\n<p>Lastly, Google stresses that OSS Rebuild is \u201cjust the beginning.\u201d Support for other ecosystems\u2014think Maven Central, Go modules, maybe even container base images\u2014sits on the roadmap. For now, the company is nudging security researchers to kick the tires, file issues, and bolt the attestation feed into existing SBOM pipelines.<\/p>\n\n\n\n<p>For details, check out <a href=\"https:\/\/security.googleblog.com\/2025\/07\/introducing-oss-rebuild-open-source.html\" target=\"_blank\" rel=\"noopener\">Google\u2019s official announcement<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Google launches the OSS Rebuild project to verify open source packages and combat supply chain attacks through reproducible builds.<\/p>\n","protected":false},"author":10,"featured_media":178640,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7,5],"tags":[3154,2016,3374],"class_list":["post-178637","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-software","category-news","tag-google","tag-package-manager","tag-security"],"blocksy_meta":[],"_links":{"self":[{"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/posts\/178637","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/comments?post=178637"}],"version-history":[{"count":0,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/posts\/178637\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/media\/178640"}],"wp:attachment":[{"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/media?parent=178637"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/categories?post=178637"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/tags?post=178637"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}