OSS Rebuild

Secure open-source package ecosystems by originating, validating, and augmenting build attestations.

Overview

OSS Rebuild aims to apply reproducible build concepts at low-cost and high-scale for open-source package ecosystems.

Rebuilds are derived by analyzing the published metadata and artifacts and are evaluated against the upstream package versions. When successful, build attestations are published for the upstream artifacts, verifying the integrity of the upstream artifact and eliminating many possible sources of compromise.

We currently support the following ecosystems:

• NPM (JavaScript/TypeScript)
• PyPI (Python)
• Crates.io (Rust)

While complete coverage is the aim, only the most popular packages within each ecosystem are currently rebuilt.

Usage

The oss-rebuild CLI tool provides access to OSS Rebuild data:

$ go run github.com/google/oss-rebuild/cmd/oss-rebuild@latest --help
$ # Alternatively, install the binary locally.
$ # Just make sure it's on your PATH: https://go.dev/ref/mod#go-install
$ go install github.com/google/oss-rebuild/cmd/oss-rebuild@latest
$ oss-rebuild --help

To view the rebuild for a given package, use the get command:

$ oss-rebuild get pypi absl-py 2.0.0

By default, this provides only a summarized view. For more granular access to rebuild data, use one of the --output formats. For example, to access the entire attestation payload, use the --output=payload option:

$ oss-rebuild get pypi absl-py 2.0.0 --output=payload

To view the dockerfile, use the --output=dockerfile option. This can be chained with docker to execute a rebuild locally:

$ oss-rebuild get pypi absl-py 2.0.0 --output=dockerfile | docker run $(docker buildx build -q -)

While the above --output=payload option produces more human-readable content, the raw attestation bundle can be accessed as follows:

$ oss-rebuild get pypi absl-py 2.0.0 --output=bundle

To explore more packages, the list command can be used to view the versions of a package that have been rebuilt:

$ oss-rebuild list pypi absl-py

Usage Requirements

oss-rebuild uses a public Cloud KMS key to validate attestation signatures. Anonymous authentication is not supported so an ADC credential must be present.

This can be accomplished with:

$ gcloud init
$ gcloud auth application-default login

To disable signature verification and skip the requirement for KMS access use: --verify=false.

Contributing

Join us in building a more secure and reliable open-source ecosystem!

Check out the contribution guide to learn more.

Purpose

• Mitigate supply chain attacks: Detect discrepancies in open-source packages, helping to prevent compromises like those of Solarwinds and Codecov.
• Scale security standards: Utilize industry best practices such as SLSA, Sigstore, and containerized builds.
• Community participation: Create a venue to collectivize effort towards securing the open-source supply chain.
• Enable future innovation: Derive data to leverage AI-driven rebuilds.

Security

To better understand the security properties of rebuilds, see Trust and Rebuilds.

Related Projects

Check out these related projects contributing to the reproducible builds effort:

• reproducible-central: Java, Kotlin reproducibility.
• kpcyrd/rebuilderd: Rebuild scheduler with support for several distros.

Disclaimer

This is not an officially supported Google product.