{"id":139662,"date":"2025-07-22T11:11:56","date_gmt":"2025-07-22T09:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/google-predstavil-proekt-oss-rebuild-dlya-vyyavleniya-skrytyh-izmenenij-v-paketah"},"modified":"2025-07-22T11:11:56","modified_gmt":"2025-07-22T09:11:56","slug":"google-predstavil-proekt-oss-rebuild-dlya-vyyavleniya-skrytyh-izmenenij-v-paketah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/google-predstavil-proekt-oss-rebuild-dlya-vyyavleniya-skrytyh-izmenenij-v-paketah","title":{"rendered":"Google has introduced the OSS Rebuild project to identify hidden changes in packages.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Google has introduced the OSS Rebuild project, aimed at identifying hidden changes in finished packages published in repositories. The OSS Rebuild functionality is based on the concept of reproducible builds and involves verifying the compliance of the package hosted in the repository with a package obtained from a rebuild of the reference source code corresponding to the declared package version. The toolkit's code is written in Go and is distributed under the Apache 2.0 license. <\/p>\n
Currently, OSS Rebuild supports the verification of packages from NPM (JavaScript\/TypeScript), PyPI (Python), and Crates.io (Rust) repositories. In the future, the number of supported repositories is planned to expand. In practice, the toolkit allows identifying supply chain attack vectors, during which, after compromising maintainers' accounts or internal project diversions, a malicious update is published in the repository. At the same time, the code in the source repository of the main project remains correct, while the malicious changes are only made in the final packages. <\/p>\n
The system automatically generates a scenario for reproducing the selected package's build whenever possible, using heuristics and selecting parameters that ensure the identity of artifacts delivered within the package. If it cannot automatically reproduce the package hosted in the repository, manual addition of the build specification is possible. Once the package is successfully reproduced, the OSS Rebuild toolkit saves a description of the build process for future verification of new package versions. Additionally, verification information is published using the SLSA framework. <\/p>\n
After verifying a specific version of the package, attestation data is generated, which can be used by others to assess already verified packages. Verification can be performed by running the command-line utility or by checking the hash stored in a separate cloud storage. The infrastructure for package verification can be deployed on one's own. server<\/a>. Information about checks performed by Google for several thousand packages is also available. <\/p>\n