Introducing OSS Rebuild: Open Source, Rebuilt to Last

This report announces OSS Rebuild, a project aimed at strengthening software supply chain security by automatically rebuilding packages from PyPI, npm, and Crates.io to produce SLSA Level 3 provenance and detailed build observability. It describes how the platform derives declarative build definitions, semantically compares artifacts, detects anomalies (e.g., unsubmitted source, compromised build environments, stealthy backdoors), and integrates with existing workflows while offering a CLI for fetching and rebuilding attestations. The initiative seeks to empower security teams and maintainers with verifiable builds, enhanced metadata, and the ability to augment SBOMs without burdening upstream publishers.