REPRODUCIBLE-BUILDS

Bit-identical reproducible builds for verification.

Definition

Adopted by Debian, Arch Linux, Tails, Coreboot, NixOS. Source datetimes via SOURCE_DATE_EPOCH (Reproducible Builds spec), canonical file ordering, no embedded paths. Compatible with SLSA L3 and BIS firmware verification. Toolchain: Reprotest, diffoscope, Kbuild.

Origin

Movement initiated by Debian Project in 2013-2014.

Example in context

Building the same Debian 12 version on two machines must produce an identical SHA-256.

Related terms

• SLSA levels — related framework.