Patching up the software supply chain

Google Introduces OSS Rebuild to Boost Security in Open-Source Package Ecosystems

Google has unveiled OSS Rebuild, a pioneering project designed to enhance trust in package registries by independently reproducing upstream artifacts. This initiative targets the escalating threat of supply chain attacks on widely-used dependencies across Python’s PyPI, JavaScript/TypeScript’s npm, and Rust’s Crates.io. Addressing Supply Chain Vulnerabilities in OSS By automating the derivation of declarative build definitions, […] The post Goog…

Patching up the software supply chain

Google and GitLab products help protect the open-source eco-system. Open-source software dependencies make ideal target for hackers. Supply chain attacks ideal for maximum-effect hacking. Two giants of the technology world have published separate tools that help companies developing software produce safer, more secure and accountable products. Google’s open-source security team (GOSST) has announced OSS Rebuild, a project that builds well-known …

Google launches OSS Rebuild tool to improve trust in open source packages

Google is hoping to improve public trust in open source projects with the launch of a new open source project called OSS Rebuild that reproduces upstream artifacts and compares the new package with the original artifact. According to Google, this process enables customers to verify a package’s origin, understand and repeat its build process, and customize the build.  “Our aim with OSS Rebuild is to empower the security community to deeply unders…

How to Use Google's OSS Rebuild: A New Open Source Software Supply Chain Security Tool

In a bold move to counter the growing number of open-source software supply chain attacks, Google has launched OSS Rebuild, a program designed to automatically rebuild OSS packages in isolated environments and compare the resulting binaries to those published on public registries. By flagging any discrepancies, OSS Rebuild can uncover hidden malware, tampered builds, and post-audit backdoors — issues that have plagued package repositories like P…