Also known as: deterministic build · bit-for-bit reproducibility
A reproducible build is one where compiling the same source code with the same environment always produces a byte-for-byte identical binary, allowing anyone to independently verify that a distributed binary genuinely corresponds to its published source.
Without reproducibility, a published source repository is a claim rather than a verifiable fact — nothing proves the shipped binary was actually built from it rather than from a modified copy on a compromised build server.
Achieving reproducibility requires eliminating sources of nondeterminism: embedded timestamps, absolute file paths, unordered hash-map iteration, and locale-dependent sorting. Several major distributions and language ecosystems have invested heavily in this over the past decade.
Software Supply Chain Security
Software supply chain security is the practice of verifying the integrity and provenance of every component, tool, and process that contributes to a piece of software, from source dependencies through the build system to distribution.
SLSA
SLSA (Supply-chain Levels for Software Artifacts) is a security framework that defines graduated levels of build integrity, describing increasingly rigorous requirements for how software artifacts are produced and verified.
Code Signing
Code signing is the practice of cryptographically signing software artifacts so that recipients can verify who produced them and confirm the code has not been altered since signing.
Open Source
Open source software is software distributed under a licence that grants anyone the right to use, inspect, modify, and redistribute the source code, subject to conditions defined by that licence.