Reproducible builds connect source to artifacts
A reproducible build lets another party recreate specified artifacts byte for byte from the stated source, build instructions, and relevant environment. The promise must name its outputs: matching object files is insufficient when the shipped executable differs. Reproduction provides evidence connecting source and distribution, while source review, provenance, and signatures address other questions. Two identical malicious builds are still malicious, and a compromised toolchain can reproduce its own unwanted behavior. ...