Reproducible builds
On this page
Bit-identical reproducible builds for verification.
Definition
Adopted by Debian, Arch Linux, Tails, Coreboot, NixOS. Source datetimes via SOURCE_DATE_EPOCH (Reproducible Builds spec), canonical file ordering, no embedded paths. Compatible with SLSA L3 and BIS firmware verification. Toolchain: Reprotest, diffoscope, Kbuild.
Origin
Movement initiated by Debian Project in 2013-2014.
Example in context
Building the same Debian 12 version on two machines must produce an identical SHA-256.
Related terms
- SLSA levels — related framework.