google/oss-rebuild
View on GitHub ↗ ★ 724 Go
Securing open-source package ecosystems by originating, validating, and augmenting build attestations.
3 mentions on Hacker News by 3 people: 0 stories, 3 comments · first 2025-07-22 · latest 2025-11-21
20082026
-
…tool from oss-rebuild which proxies registries so they return the state they were at a past date: https://github.com/google/oss-rebuild/tree/main/cmd/timewarp
comment by tracnar · 2025-11-21 · in We should all be using dependency cooldowns -
…burden on upstream maintainers Then I see This is not an officially supported Google product on https://github.com/google/oss-rebuild And then I also see oss-rebuild uses a public Cloud KMS key to validate attestation signatures. Anonymous…
comment by chubot · 2025-07-22 · in OSS Rebuild: open-source, rebuilt to last -
…likely be well architected. 3. It is open source, so others can fork it when Google abandons it. https://github.com/google/oss-rebuild
comment by esafak · 2025-07-22 · in OSS Rebuild: open-source, rebuilt to last