news
Google Debuts OSS Rebuild Project
Quoting: Google Debuts OSS Rebuild Project —
Remember high-profile incidents, such as the xz-utils drama in 2024, which showed how malicious actors can slip backdoors into widely used dependencies, putting millions of systems at risk? There’s now a solid way to stop these kinds of attempts, backed by one of the world’s tech giants, namely, Google.
Yesterday, Google’s Open Source Security Team announced a brand new project, OSS Rebuild, a hosted service that automatically recompiles popular packages from PyPI, npm, and Crates.io and then publishes SLSA-Level 3 provenance for every build.
In simple terms, it attempts to rebuild what developers download, verify that the binaries originated from the public source tree, and raise an alarm if anything appears suspicious. Here’s how the whole thing works.