Reproducible builds

✎ This article/section is a stub — some half-sorted notes, not necessarily checked, not necessarily correct. Feel free to ignore, or tell me about it.

Reproducible builds mostly just means that building software from source will work the same everywhere.

The reason this is valuable has a few different angles.

It's useful to check that the build process isn't fragile, that builds don't suffer from "works on my machine" syndrome.

Allow for automatic tests to be useful indication of anything

The last two are useful in a CI/CD sense.

If you go looking around, most people will hark on a different issue, security.

The idea is that if someone else can build the same product from given source code, you have a good indication that that product came from the same source code.

This lets people check that the binary that open source developers provide matches the source code that the same developers provide, and means you don't rely on "trust me bro".

Not proof -- just deterministic compilation might be required, but is not sufficient for trust of that binary.

Also note that proprietary software will, almost by definition, not allow public verification.

You can still ask a trusted verification lab to do it, but you you are adding extra bits (that lab) to the chain of entities you need to be able to trust.

https://en.wikipedia.org/wiki/Reproducible_builds