HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
google
oss-rebuild
Go2025–2025
google / oss-rebuild

oss-rebuild

Securing open-source package ecosystems by originating, validating, and augmenting build attestations.

Explore on GitHubRead Hacker News discussions
3Distinct people
3Mentions
0Explicit recommenders
724GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Securing open-source package ecosystems by originating, validating, and augmenting build attestations.

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by week3 dated mentions

Observed mentions: 2025-07-22 15:34:03 UTC to 2025-11-21 18:23:32 UTC. Weeks start Monday, UTC.

0122025-07-21 00:00:00 UTC to 2025-07-28 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 commentsJul 212025-07-28 00:00:00 UTC to 2025-08-04 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-08-04 00:00:00 UTC to 2025-08-11 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-08-11 00:00:00 UTC to 2025-08-18 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-08-18 00:00:00 UTC to 2025-08-25 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-08-25 00:00:00 UTC to 2025-09-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-09-01 00:00:00 UTC to 2025-09-08 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-09-08 00:00:00 UTC to 2025-09-15 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-09-15 00:00:00 UTC to 2025-09-22 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 commentsSep 152025-09-22 00:00:00 UTC to 2025-09-29 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-09-29 00:00:00 UTC to 2025-10-06 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-10-06 00:00:00 UTC to 2025-10-13 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-10-13 00:00:00 UTC to 2025-10-20 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-10-20 00:00:00 UTC to 2025-10-27 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-10-27 00:00:00 UTC to 2025-11-03 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-11-03 00:00:00 UTC to 2025-11-10 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-11-10 00:00:00 UTC to 2025-11-17 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-11-17 00:00:00 UTC to 2025-11-24 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsNov 17

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Jul 212025-07-21 00:00:00 UTC2025-07-28 00:00:00 UTC202
Jul 282025-07-28 00:00:00 UTC2025-08-04 00:00:00 UTC000
Aug 42025-08-04 00:00:00 UTC2025-08-11 00:00:00 UTC000
Aug 112025-08-11 00:00:00 UTC2025-08-18 00:00:00 UTC000
Aug 182025-08-18 00:00:00 UTC2025-08-25 00:00:00 UTC000
Aug 252025-08-25 00:00:00 UTC2025-09-01 00:00:00 UTC000
Sep 12025-09-01 00:00:00 UTC2025-09-08 00:00:00 UTC000
Sep 82025-09-08 00:00:00 UTC2025-09-15 00:00:00 UTC000
Sep 152025-09-15 00:00:00 UTC2025-09-22 00:00:00 UTC000
Sep 222025-09-22 00:00:00 UTC2025-09-29 00:00:00 UTC000
Sep 292025-09-29 00:00:00 UTC2025-10-06 00:00:00 UTC000
Oct 62025-10-06 00:00:00 UTC2025-10-13 00:00:00 UTC000
Oct 132025-10-13 00:00:00 UTC2025-10-20 00:00:00 UTC000
Oct 202025-10-20 00:00:00 UTC2025-10-27 00:00:00 UTC000
Oct 272025-10-27 00:00:00 UTC2025-11-03 00:00:00 UTC000
Nov 32025-11-03 00:00:00 UTC2025-11-10 00:00:00 UTC000
Nov 102025-11-10 00:00:00 UTC2025-11-17 00:00:00 UTC000
Nov 172025-11-17 00:00:00 UTC2025-11-24 00:00:00 UTC101

What Hacker News says

3 sources
chubot·Jul 22, 2025
At first I thought this might be promising, given without burden on upstream maintainers Then I see This is not an officially supported Google product on https://github.com/google/oss-rebuild And then I also see oss-rebuild uses a public Cloud KMS key to validate attestation signatures. Anonymous authentication is not supported so an ADC credential must be present. $ gcloud init $ gcloud auth application-default login I would not use this with a dependency on Google Cloud, or the gcloud command line tool. Mainly because Google has horrible customer support. It would be more interesting if they came up with something hosted on third party infrastructure. Last I heard, Google Cloud is run by Oracle executives --- e.g. in particular the Unisuper incident led me to believe that a lot of operational stuff is being outsourced, and is
Read the rest
of poor quality UniSuper members go a week with no account access after Google Cloud misconfig https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... Google accidentally deleted a $125 billion pension fund's account https://qz.com/google-cloud-pension-fund-unisuper-1851472990 I would not say this is unrelated, because operations in the underlying cloud can be a weak link in security Although I'd certainly be interested in an argument otherwise
In OSS Rebuild: open-source, rebuilt to last

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.