[{"data":1,"prerenderedAt":80},["ShallowReactive",2],{"term-r\u002Freproducible-builds":3,"related-r\u002Freproducible-builds":60},{"id":4,"title":5,"acronym":6,"body":7,"category":40,"description":41,"difficulty":42,"extension":43,"letter":44,"meta":45,"navigation":46,"path":47,"related":48,"seo":54,"sitemap":55,"stem":58,"subcategory":6,"__hash__":59},"terms\u002Fterms\u002Fr\u002Freproducible-builds.md","Reproducible Builds",null,{"type":8,"value":9,"toc":33},"minimark",[10,15,19,23,26,30],[11,12,14],"h2",{"id":13},"eli5-the-vibe-check","ELI5 - The Vibe Check",[16,17,18],"p",{},"A reproducible build means if ten different people, on ten different computers, build your code from the exact same source, they all get byte-for-byte identical output. It's like baking the same cake from the same recipe in ten different kitchens and every single crumb coming out identical, with no mystery ingredients sneaking in from someone's oven.",[11,20,22],{"id":21},"real-talk","Real Talk",[16,24,25],{},"A reproducible build is a build process that produces bit-for-bit identical binaries given the same source and build inputs, regardless of when or where the build runs. It eliminates non-determinism from timestamps, file ordering, and environment paths so independent parties can verify that a published artifact genuinely matches its claimed source.",[11,27,29],{"id":28},"when-youll-hear-this","When You'll Hear This",[16,31,32],{},"\"We stripped build timestamps so the release is reproducible.\" \u002F \"Debian's reproducible builds project lets anyone independently verify a package wasn't tampered with.\"",{"title":34,"searchDepth":35,"depth":35,"links":36},"",2,[37,38,39],{"id":13,"depth":35,"text":14},{"id":21,"depth":35,"text":22},{"id":28,"depth":35,"text":29},"security","A reproducible build means if ten different people, on ten different computers, build your code from the exact same source, they all get byte-for-byte iden...","advanced","md","r",{},true,"\u002Fterms\u002Fr\u002Freproducible-builds",[49,50,51,52,53],"SLSA","Attestation","Supply Chain Security","Build","Docker",{"title":5,"description":41},{"changefreq":56,"priority":57},"weekly",0.7,"terms\u002Fr\u002Freproducible-builds","OwRbO7SoKaLmr8TmnPw2i6HWIxdsRAA3iWVEvdP3Cns",[61,64,69,73,76],{"title":50,"path":62,"acronym":6,"category":40,"difficulty":42,"description":63},"\u002Fterms\u002Fa\u002Fattestation","Think of attestation as a build getting a notarized receipt: it doesn't just claim to be trustworthy, it comes with cryptographically signed proof of exact...",{"title":52,"path":65,"acronym":6,"category":66,"difficulty":67,"description":68},"\u002Fterms\u002Fb\u002Fbuild","general","beginner","A build is the process of turning your development code into something a real computer or browser can run efficiently.",{"title":53,"path":70,"acronym":6,"category":71,"difficulty":67,"description":72},"\u002Fterms\u002Fd\u002Fdocker","cicd","Docker is like a lunchbox for your app.",{"title":49,"path":74,"acronym":6,"category":40,"difficulty":42,"description":75},"\u002Fterms\u002Fs\u002Fslsa","SLSA (pronounced 'salsa') is a framework with levels (1-4) that measure how secure your software supply chain is. Level 1: you have some build process.",{"title":51,"path":77,"acronym":6,"category":40,"difficulty":78,"description":79},"\u002Fterms\u002Fs\u002Fsupply-chain-security","intermediate","Supply Chain Security protects the entire path from code to production — dependencies, build systems, registries, everything.",1792528117355]