中文
devexamples
← Workflows

阅读中文版本

Reproducible Build Verification Workflow

Build the same revision twice in different environments, compare hashes, and fix the sources of nondeterminism such as timestamps and paths.

advanced~150 minbuildsecuritysupply-chain

Objective

Verify that a build is reproducible so the artifact provably comes from the reviewed source.

Environment

  • A build process to verify
  • Two independent build environments

Steps

1. Build the same revision in two

Build the same revision in two independent environments.

Expected state: You can compare outputs.

2. Compare artifact hashes and list differences

Compare artifact hashes and list differences.

Expected state: Nondeterminism is detected.

3. Fix sources of nondeterminism: timestamps, paths,

Fix sources of nondeterminism: timestamps, paths, ordering, parallelism.

Expected state: Builds converge on the same output.

4. Record the verification and enforce it

Record the verification and enforce it for releases.

Expected state: Reproducibility is sustained.

Decision points

Fix all nondeterminism or document the differences?

  • Fix what you can
  • Document all differences

Fix timestamps and paths; document irreducible differences with a plan.

Verify every release or periodically?

  • Every release
  • Periodically

Every release for critical artifacts; periodically for large suites where cost is high.

Expected outcome

Two independent builds of the same revision produce byte-identical artifacts, with recorded verification.

Verification

Confirm the artifact hashes match across both environments and that the comparison is part of the release process.

Cleanup

Store the two verification runs and the resulting artifact hashes.

Overview

Verify that a build is reproducible so the artifact provably comes from the reviewed source. Confirm the artifact hashes match across both environments and that the comparison is part of the release process.

Steps

  1. Build the same revision in two independent environments. Expected state: You can compare outputs.
  2. Compare artifact hashes and list differences. Expected state: Nondeterminism is detected.
  3. Fix sources of nondeterminism: timestamps, paths, ordering, parallelism. Expected state: Builds converge on the same output.
  4. Record the verification and enforce it for releases. Expected state: Reproducibility is sustained.
build() { SOURCE_DATE_EPOCH=1700000000 ./build.sh > out/$1.tar; }
build env1
build env2
sha256sum out/env1.tar out/env2.tar

Verification

  • Two independent builds of the same revision produce byte-identical artifacts, with recorded verification.

Decision points

  • Fix all nondeterminism or document the differences? Options: Fix what you can; Document all differences. Recommended: Fix timestamps and paths; document irreducible differences with a plan.
  • Verify every release or periodically? Options: Every release; Periodically. Recommended: Every release for critical artifacts; periodically for large suites where cost is high.