Reproducible build
A build that produces bit-for-bit identical artifacts from the same source, build environment and instructions, so independent parties can rebuild a release and confirm that the published binary matches its source.
- Also called
- build reproducibility
- Defined in
- reproducible-builds.org: Definitions
Covered in
Guide
Investigate build differences and improve reproducibility
Control inputs and environment, compare artifact bytes, and explain the security properties a repeatable build can demonstrate.
Case study
Case study: the xz Utils backdoor (CVE-2024-3094)
How a multi-year maintainer takeover planted a backdoor in xz Utils release tarballs, how build-time injection hid it from the git repository, why a performance anomaly exposed it, which systems shipped it, and what it teaches about reproducible builds and maintainer health.