commandments of reproducible builds

Commandments by the church of reproducible builds:

1. Thou shall not record the name of thy maker nor the place of thy making (username, hostname)
2. Thou shall not record the date nor time of thy making, unless you respect the holy SDE spec (date+time)
3. Thou shall not use memory without initialization or use memory addresses to decide outcomes (ASLR)
4. Thou shall do all your work in order - not use filesystem-readdir-order nor random order of hash elements
5. Thou shall not (gamble and) record random numbers (UUID, private/public key, hash-seed, ASLR)
6. Thou shall only do one thing at a time or ensure races do no harm (parallelism)
7. Thou shall not look at build machine processor capabilities (CPU)
8. Thou shall not look at build machine benchmarks for optimizations
9. Thou shall be careful with profile-guided-optimization for it can amplify any sin (non-determinism)
10. Thou shall keep your workspace environment clean of timezones, locales and umasks or ensure they do no harm
11. Thou shall allow for offline builds (aka “vendoring” as servers can be down, contents can change)
12. If Thou publishst binaries, Thou shall take note of your build inputs

License: CC-BY-SA 4.0

---

← Documentation index

Documentation home

Introduction

• Definitions
• History
• Buy-in
• Making plans
• Academic publications

Achieve deterministic builds

• commandments of reproducible builds
• Variations in the build environment
• SOURCE_DATE_EPOCH
• Deterministic build systems
• Volatile inputs can disappear
• Stable order for inputs
• Value initialization
• Version information
• Timestamps
• Timezones
• Locales
• Archive metadata
• Stable order for outputs
• Randomness
• Build path
• System images
• JVM

Define a build environment

• What's in a build environment?
• Recording the build environment
• Definition strategies
• Proprietary operating systems

Distribute the environment

• Building from source
• Virtual machine drivers
• Formal definition

Verification

• Cryptographic checksums
• Embedded signatures
• Sharing certifications
• Rebuilders

Specifications

• SOURCE_DATE_EPOCH
• BUILD_PATH_PREFIX_MAP (WIP)