# Verify Packages Are Reproducibly Rebuildable Before Trusting Artifacts With Oss Rebuild

> Query OSS Rebuild attestations and rebuild metadata so an agent can verify whether a published package artifact matches a reproducible upstream rebuild.

- Skill: `agentskillexchange/verify-packages-are-reproducibly-rebuildable-before-trusting` (Agent Skill)
- Install (CLI): `npx skillmds@latest add agentskillexchange/verify-packages-are-reproducibly-rebuildable-before-trusting`
- Raw SKILL.md: https://api.skillmd.com/api/skills/agentskillexchange/verify-packages-are-reproducibly-rebuildable-before-trusting/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: agentskillexchange (https://skillmd.com/u/agentskillexchange)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/agentskillexchange/verify-packages-are-reproducibly-rebuildable-before-trusting

---


# Verify Packages Are Reproducibly Rebuildable Before Trusting Artifacts With Oss Rebuild

Query OSS Rebuild attestations and rebuild metadata so an agent can verify whether a published package artifact matches a reproducible upstream rebuild.

## Prerequisites

Go, oss-rebuild CLI, optional gcloud ADC credentials for signature verification

## Installation

Use the upstream install or setup path that matches your environment:
- $ go install github.com/google/oss-rebuild/cmd/oss-rebuild@latest

Requirements and caveats from upstream:
- PyPI (Python)
- chained with docker to execute a rebuild locally:
- $ oss-rebuild get pypi absl-py 2.0.0 --output=dockerfile | docker run $(docker buildx build -q -)

Basic usage or getting-started notes:
- The oss-rebuild CLI tool provides access to OSS Rebuild data:
- bash
- $ go run github.com/google/oss-rebuild/cmd/oss-rebuild@latest --help

- Source: https://github.com/google/oss-rebuild
- Extracted from upstream docs: https://raw.githubusercontent.com/google/oss-rebuild/HEAD/README.md

## Documentation

- https://docs.oss-rebuild.dev/

## Source

- [Agent Skill Exchange](https://agentskillexchange.com/skills/verify-packages-are-reproducibly-rebuildable-before-trusting-artifacts-with-oss-rebuild/)