Google launches OSS Rebuild [LWN.net]

Google has announced the existence of OSS Rebuild, an infrastructure for the creation and verification of reproducible builds of software projects.

Our aim with OSS Rebuild is to empower the security community to deeply understand and control their supply chains by making package consumption as transparent as using a source repository. Our rebuild platform unlocks this transparency by utilizing a declarative build process, build instrumentation, and network monitoring capabilities which, within the SLSA Build framework, produces fine-grained, durable, trustworthy security metadata. [...]
Our vision extends beyond any single ecosystem: We are committed to bringing supply chain transparency and security to all open source software development. Our initial support for the PyPI (Python), npm (JS/TS), and Crates.io (Rust) package registries—providing rebuild provenance for many of their most popular packages—is just the beginning of our journey.

to post comments

Manual download of attestations

Posted Jul 23, 2025 3:06 UTC (Wed) by cesarb (subscriber, #6266) [Link]

It was not clear in the announcement, but you can access that attestation data through HTTP without needing any special tool. Combining https://docs.oss-rebuild.dev/storage.html and https://cloud.google.com/storage/docs/request-endpoints you can find the list of files at https://storage.googleapis.com/google-rebuild-attestations/ and you can concatenate each <Key> onto that URL to open the corresponding file.