No Snake Oil: Verifying Python Package Builds

2026-07-23

AI Summary

This study addresses the risk of malware injection in the Python package supply chain by verifying the logical equivalence between rebuilt and originally published packages to ensure trustworthiness. The authors propose daleq4py, a novel tool that introduces Datalog rules preserving provenance information and leverages normalization functions to assess semantic equivalence of wheel files, moving beyond reliance on byte-level identity. Through large-scale rebuild experiments on 12,180 popular PyPI package versions using macaron and oss-rebuild, daleq4py significantly increases the proportion of verifiably equivalent rebuilt packages from under 20% to 78.9%, thereby substantially enhancing the verifiability and security of the software supply chain.

Abstract

Python has become the default language for interacting with AI, with packages being distributed through registries like the Python Package Index (PyPI). This creates a need to analyse supply chains comprising such packages. One such analysis is to rebuild packages in order to identify compromised builds injecting malware. Independent rebuilds in hardened environments have the added advantage that they can generate and record provenance in order to increase the trustworthiness of packages. Two tools that are designed to automate such rebuilds and run them at scale are macaron and oss-rebuild. We study 12,180 popular releases from PyPI and find that the byte-for-byte equivalence rate is generally low. We analyse the reasons why they produce different wheels, and find that equivalence between the original and rebuilt wheels can often still be established, preserving most of the guarantees users expect from rebuildable releases. We present and evaluate daleq4py, a tool to establish the equivalence of Python wheels through the kernel of a normalisation function that is based on provenance-preserving datalog rules. Experimental results show that daleq4py substantially expands the set of rebuilds that can be accepted as equivalent. Although only 15.4% of macaron rebuilds and 19.1% of oss-rebuild rebuilds are byte-for-byte identical to the published PyPI wheels, daleq4py establishes wheel equivalence for 60.2% and 78.9% of source-equivalent rebuilds, respectively.

Problem

• Python package
• supply chain security
• reproducible builds
• wheel equivalence
• software provenance

Innovation

• wheel equivalence
• provenance-preserving
• Datalog
• reproducible builds
• software supply chain security