Reproducible Builds.

Build practices that ensure compiling the same source code with the same instructions produces a bit-for-bit identical artifact, regardless of when or where it is built. It belongs to the Application Security category of cybersecurity.

Build practices that ensure compiling the same source code with the same instructions produces a bit-for-bit identical artifact, regardless of when or where it is built.

Reproducible builds eliminate non-determinism so that anyone with the source code and recipe can independently recreate the exact same binary and compare it byte-for-byte to a release. This requires controlling timestamps, build paths, environment variables, randomness, locale, file ordering, and compiler options. The Reproducible Builds project, Debian, NixOS, Arch Linux, Tor, F-Droid, and Bazel have invested heavily in this area. Combined with signed provenance, reproducible builds let independent rebuilders verify that a binary really came from the published source, helping detect compromise of single builders (as in SolarWinds). They are required to reach the highest SLSA build levels and underpin trust in critical open-source software.

Defences for Reproducible Builds typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Deterministic builds, Bit-for-bit builds.