Post

Simon Willison
@simonwillison.net

I wrote up some notes on Google Security's new OSS Rebuild project, which increases supply chain security for popular packages on PyPI, NPM and Crates through offering independent build attestations simonwillison.net/2025/Jul/23/...

simonwillison.netIntroducing OSS Rebuild: Open Source, Rebuilt to LastMajor news on the Reproducible Builds front: the Google Security team have announced OSS Rebuild, their project to provide build attestations for open source packages released through the NPM, PyPI …

5 reposts35 likes

Simon Willison
@simonwillison.net

OSS Rebuild doesn't (yet) have a web UI... but it turns out their data is in a public Google cloud bucket, which means you can host your own web app in a separate cloud bucket and use fetch() to access their data! So I had Claude Code build and deploy a vibe-coded search UI