Get the latest tech news
Google's New Security Project 'OSS Rebuild' Tackles Package Supply Chain Verification
This week Google's Open Source Security Team announced "a new project to strengthen trust in open source package ecosystems" — by reproducing upstream artifacts. It includes automation to derive declarative build definitions, new "build observability and verification tools" for security tea...
This week Google's Open Source Security Team announced " a new project to strengthen trust in open source package ecosystems" — by reproducing upstream artifacts.It includes automation to derive declarative build definitions, new "build observability and verification tools" for security teams, and even "infrastructure definitions" to help organizations rebuild, sign, and distribute provenance by running their own OSS Rebuild instances. Our aim with OSS Rebuild is to empower the security community to deeply understand and control their supply chains by making package consumption as transparent as using a source repository. — Augment SBOMs by adding detailed build observability information to existing Software Bills of Materials, creating a more complete security picture...
Or read this on Slashdot
