Security and Productivity Pick Two with Reproducible Builds
summary
Reproducible builds guarantee identical output bits from the same source so hashes match, letting teams verify CI artifacts by rebuilding locally and comparing with diffoscope; Maven and Gradle both offer reproducible settings (Maven: fixed timestamp property, Gradle: properties) and SDKMAN locks Java versions. Build caches then reuse task outputs (Gradle introduced remote cache in 2017) so builds get much faster — about half the speedup often comes from a remote cache — reducing context switches and catching issues like supply‑chain incidents (XcodeGhost affected ~4,000 apps). run your build twice on two machines, use a remote cache for team wins
AI-written summary · about
chapters (17)
- 0:00Introduction and speaker intro
- 1:06About reproducible builds
- 5:44Why builds aren't reproducible
- 10:04Supply chain attack risks
- 12:54Who should care about reproducible builds
- 14:16Common causes of build entropy
- 17:30OS environment consistency
- 20:24Verifying reproducible builds
- 21:50Getting started with reproducible builds
- 23:56Benefits for build quality
- 24:58Build caching fundamentals
- 28:50How build caching works
- 31:40Fast feedback cycles and productivity
- 35:51Developer productivity engineering
- 38:25Challenges and future of reproducible builds
- 38:46Tips for maintaining builds
- 40:10Free resources and Q&A
related talks
45mWhat Makes A Build Reproducible?
40mReproducible Builds: Unexpected Benefits and Problems
47mReproducible builds
56mReproducible Builds, the first ten years
01h 39mWorkshop: Maximize Developer Productivity with Fast and Reliable Gradle and Maven Builds
54mDeveloper Productivity Engineering Deep Dive
42mThe Long Road to Reproducible Builds
44mWhat does it take to deploy to production with confidence?