Google Launches New Initiative, OSS Rebuild, to Secure Open Source Software Supply Chains

Google’s Open Source Security Team has introduced a new project, OSS Rebuild, designed to enhance the security and integrity of open-source software, helping ensure software packages are verified and secure from the ground up.

With the rise of sophisticated supply chain attacks targeting open-source ecosystems, OSS Rebuild aims to tackle these challenges by providing a robust and automated way to verify software packages. This new initiative comes at a time when open-source software has become a cornerstone of modern application development, accounting for 77% of the code in modern applications.

OSS Rebuild is a platform that automates the process of rebuilding open-source packages and ensures they meet trusted security standards. It allows security teams to verify the origin of software packages and ensure they haven’t been tampered with during their development.

The platform currently supports three major package ecosystems: PyPI (Python), npm (JavaScript/TypeScript) and Crates.io (Rust)

By automating the build process and creating SLSA Provenance—an attestation that verifies a package’s build process and origin—OSS Rebuild helps organizations manage their supply chain risks without placing additional burdens on package maintainers. Some of the key features include:

• Automated Build Definitions: OSS Rebuild generates declarative build definitions for the supported package registries. This automation removes the need for manual intervention, making the verification process quicker and more reliable.
• SLSA Provenance: By meeting SLSA Build Level 3 requirements, OSS Rebuild produces verifiable security metadata, ensuring that packages come from a trusted source and haven’t been compromised.
• Build Verification: The platform compares rebuilt packages with their original versions to detect any anomalies. This ensures that any tampering—such as the inclusion of malicious code—can be easily spotted.
• Open Source Transparency: OSS Rebuild gives both consumers and maintainers the ability to trace the full build history of a package, offering transparency similar to how code repositories function.
• AI-Assisted Automation: The project also explores using AI to assist in rebuilding complex packages described in natural language, further reducing manual intervention and speeding up the verification process.

The security of open-source software has become a major concern for organizations worldwide. In recent years, several high-profile supply chain attacks have demonstrated how vulnerable the open-source ecosystem can be. Attackers have used sophisticated methods to insert malicious code into widely-used packages, causing widespread disruptions.

OSS Rebuild addresses key supply chain risks by focusing on three areas:

• Unsubmitted Source Code: Packages that include code not present in the source repository will not be verified by OSS Rebuild, reducing the risk of hidden vulnerabilities.
• Build Environment Compromise: By creating standardized and monitored build environments, OSS Rebuild ensures that packages are built securely without exposure to compromised components.
• Backdoor Detection: Advanced monitoring helps detect stealthy backdoors by analyzing unusual build patterns or suspicious behavior that might be missed through manual inspection.

For enterprises and security teams, OSS Rebuild provides an extra layer of protection against supply chain attacks by enhancing package metadata and supporting the Software Bill of Materials (SBOM). This means quicker vulnerability response and a more secure software inventory.

For open-source maintainers, OSS Rebuild reduces the need to manage complex security processes in their continuous integration/continuous deployment (CI/CD) pipelines. By offloading the responsibility of rebuilding and securing packages to a trusted platform, maintainers can focus more on development while still ensuring their packages meet the highest security standards.

OSS Rebuild is designed to be easy to use. For developers, the quickest way to start is by using the Go-based command-line interface (CLI) to access rebuild attestations and build definitions.

For more information about OSS Rebuild, including how to get started or contribute, visit Google’s official blog post, or the GitHub repository.