base on Securing open-source package ecosystems by originating, validating, and augmenting build attestations. # [OSS Rebuild](https://oss-rebuild.dev/) [](https://docs.oss-rebuild.dev/) [](https://goreportcard.com/report/google/oss-rebuild) [](https://pkg.go.dev/github.com/google/oss-rebuild) <div align="center"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/google/oss-rebuild/main/site/logo-light.svg"> <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/google/oss-rebuild/main/site/logo-dark.svg"> <img alt="OSS Rebuild logo" src="https://raw.githubusercontent.com/google/oss-rebuild/main/site/logo-dark.svg" height="110" width="230"> </picture> </div> Secure open-source package ecosystems by originating, validating, and augmenting build attestations. ## Overview [OSS Rebuild](https://oss-rebuild.dev/) aims to apply [reproducible build](https://reproducible-builds.org/) concepts at low-cost and high-scale for open-source package ecosystems. Rebuilds are derived by analyzing the published metadata and artifacts and are evaluated against the upstream package versions. When successful, build attestations are published for the upstream artifacts, verifying the integrity of the upstream artifact and eliminating many possible sources of compromise. We currently support the following ecosystems: - npm (JavaScript/TypeScript) - PyPI (Python) - Crates.io (Rust) While complete coverage is the aim, only the most popular packages within each ecosystem are currently rebuilt. ## Usage The `oss-rebuild` CLI tool provides access to OSS Rebuild data: ```bash $ go run github.com/google/oss-rebuild/cmd/oss-rebuild@latest --help $ # Alternatively, install the binary locally. $ # Just make sure it's on your PATH: https://go.dev/ref/mod#go-install $ go install github.com/google/oss-rebuild/cmd/oss-rebuild@latest $ oss-rebuild --help ``` To view the rebuild for a given package, use the `get` command: ```bash $ oss-rebuild get pypi absl-py 2.0.0 ``` By default, this provides only a summarized view. For more granular access to rebuild data, use one of the `--output` formats. For example, to access the entire attestation payload, use the `--output=payload` option: ```bash $ oss-rebuild get pypi absl-py 2.0.0 --output=payload ``` To view the dockerfile, use the `--output=dockerfile` option. This can be chained with `docker` to execute a rebuild locally: ```bash $ oss-rebuild get pypi absl-py 2.0.0 --output=dockerfile | docker run $(docker buildx build -q -) ``` While the above `--output=payload` option produces more human-readable content, the raw attestation bundle can be accessed as follows: ```bash $ oss-rebuild get pypi absl-py 2.0.0 --output=bundle ``` To explore more packages, the `list` command can be used to view the versions of a package that have been rebuilt: ```bash $ oss-rebuild list pypi absl-py ``` ### Usage Requirements `oss-rebuild` uses a public [Cloud KMS](https://cloud.google.com/kms/docs) key to validate attestation signatures. Anonymous authentication is not supported so an [ADC credential](https://cloud.google.com/docs/authentication/set-up-adc-local-dev-environment) must be present. This can be accomplished with: ```bash $ gcloud init $ gcloud auth application-default login ``` To disable signature verification and skip the requirement for KMS access use: `--verify=false`. ## Contributing Join us in building a more secure and reliable open-source ecosystem! Check out [the contribution guide](./CONTRIBUTING.md) to learn more. ## Purpose - **Mitigate supply chain attacks**: Detect discrepancies in open-source packages, helping to prevent compromises like those of Solarwinds and Codecov. - **Scale security standards**: Utilize industry best practices such as SLSA, Sigstore, and containerized builds. - **Community participation**: Create a venue to collectivize effort towards securing the open-source supply chain. - **Enable future innovation**: Derive data to leverage AI-driven rebuilds. ## Security To better understand the security properties of rebuilds, see [Trust and Rebuilds](./docs/trust.md). ## Related Projects Check out these related projects contributing to the reproducible builds effort: - [reproducible-central](https://github.com/jvm-repo-rebuild/reproducible-central): Java, Kotlin reproducibility. - [kpcyrd/rebuilderd](https://github.com/kpcyrd/rebuilderd): Rebuild scheduler with support for several distros. ## Disclaimer This is not an officially supported Google product. ", Assign "at most 3 tags" to the expected json: {"id":"14388","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"