What Makes A Build Reproducible?
summary
Defines three concrete levels: repeatable (scripted build steps), rebuildable builds (internal mirrors and cached intermediates produce equivalent artifacts but not bit-for-bit identical), and binary reproducible (bit-for-bit identical outputs regardless of when or where). Shows Go as an example — vendoring dependencies plus trimpath and linker flags yields identical binaries — and calls out Dockerfile pitfalls, especially the Docker layer cache giving false confidence. Notes real costs: long‑term storage, mirroring many transitive dependencies, and years of effort for large projects.
AI-written summary · about
chapters (14)
- 0:00Start
- 0:34Joshua Luck
- 6:51What It Means To Be Reproducible
- 7:27Levels of Reproducibility
- 7:41Reasons Why Reproducibility Is Not Achieved
- 10:03High Level Definitions
- 11:30Rebuildable Builds
- 12:31Binary Reproducible
- 16:14Typical Build Scripts
- 16:58Dependency Problem
- 17:56Summary
- 20:56Layer Caching
- 28:49Supply Chain Implications of Binary Reproducible Builds
- 30:54Should We Really Care about Binary Reproducible Builds
related talks
47mReproducible builds
42mThe Long Road to Reproducible Builds
23mDemystifying Unreproducible Builds: What, Why, and How?
42mSecurity and Productivity Pick Two with Reproducible Builds
13mDon’t Trust, Verify. Reproducible Builds in Bitcoin
26mReproducible Postgres
30mRootless, Reproducible, and Hermetic: Secure Container Build Showdown
07mReproducible Builds