Reproducible Builds

Core rule

A release build should be deterministic under its declared inputs. Pin the build toolchain, normalize uncontrolled metadata, and verify repeated outputs.

Contract

Record source revision, compiler/runtime versions, dependency lock, flags, target architecture, and environment knobs that affect bytes. Build twice in clean temporary directories and compare relevant output hash values.

Eliminate timestamps, random temp paths, VCS metadata, locale, unordered traversal, and host-specific absolute paths from artifacts where possible. If byte reproducibility is impossible, define and test the narrower reproducibility contract explicitly.

Generate checksums/SBOM/manifests only after final artifact content is fixed.

Do not rebuild a published binary under a different compiler version and call the byte change a source fix. First prove whether the source or the toolchain changed.