u Main menu move to sidebar hide Navigation Main page Contents Current events Random article About Wikipedia Contact us Contribute Help Learn to edit Community portal Recent changes Upload file Special pages Search Search Appearance Donate Create account Log in Personal tools Donate Create account Log in Contents move to sidebar hide (Top) 1 Methods 2 History 3 Challenges 4 See also 5 References 6 External links Toggle the table of contents Reproducible builds 7 languages Čeština Deutsch Suomi 日本語 한국어 Русский 中文 Edit links Article Talk English Read Edit View history Tools Tools move to sidebar hide Actions Read Edit View history General What links here Related changes Upload file Permanent link Page information Cite this page Get shortened URL Print/export Download as PDF Printable version In other projects Wikimedia Commons Wikidata item Appearance move to sidebar hide From Wikipedia, the free encyclopedia Process in computer science Logo of the Software Freedom Conservancy 's Reproducible Builds project Reproducible builds , also known as deterministic compilation , is a process of building software which ensures the resulting binary code can be reproduced . Source code compiled deterministically will always output the same binary. [ 1 ] [ 2 ] [ 3 ] Reproducible builds can act as part of a chain of trust ; [ 1 ] the source code can be signed, and deterministic compilation can prove that the binary was compiled from trusted source code. Verified reproducible builds provide a strong countermeasure against attacks where binaries do not match their source code, e.g., because an attacker has inserted malicious code into a binary. This is a relevant attack; attackers sometimes attack binaries but not the source code, e.g., because they can only change the distributed binary or to evade detection since it is the source code that developers normally review and modify. In a survey of 17 experts, reproducible builds had a very high utility rating from 58.8% participants, but also a high-cost rating from 70.6%. [ 4 ] Various efforts are being made to modify software development tools to reduce these costs. Methods [ edit ] For the compilation process to be deterministic, the input to the compiler must be the same, regardless of the build environment used. This typically involves normalizing variables that may change, such as order of input files, timestamps , locales , and paths . Additionally, the compilers must not introduce non-determinism themselves. This sometimes happens when using hash tables with a random hash seed value. It can also happen when using the address of variables because that varies from address space layout randomization (ASLR). Build systems , such as Bazel , GNU Guix , and Gitian, [ 5 ] can be used to automate deterministic build processes. History [ edit ] The GNU Project used reproducible builds in the early 1990s. Changelogs from 1992 indicate the ongoing effort. [ 6 ] One of the older [ 7 ] projects to promote reproducible builds is the Bitcoin project with Gitian , and later, GNU Guix. In 2013, the Tor (anonymity network) project started using Gitian for their reproducible builds. [ 8 ] Starting in 2011, a reproducible Java build system was developed for the decentralized peer-to-peer FOSS project DirectDemocracyP2P. [ 9 ] The concepts of the system's application to automated updates recommendation support was first presented in April 2013 at Decentralized Coordination. [ 10 ] [ 11 ] A treatise focusing on the implementation details of the reproducible Java compilation tool itself was published in 2015. [ 12 ] In July 2013, the Debian project started implementing reproducible builds across its entire package archive. [ 13 ] [ 14 ] By July 2017, more than 90% of the packages in the repository were proven to build reproducibly. [ 15 ] In November 2018, the Reproducible Builds project joined the Software Freedom Conservancy . [ 16 ] F-Droid uses reproducible builds to provide a guarantee that distributed APKs use the claimed free source code . [ 17 ] The Tails portable operating system uses reproducible builds and explains to others how to verify their distribution. [ 18 ] NixOS claims 100% build reproducibility as of June 2021 for their minimal ISO releases. [ 19 ] As of May 2020 [update] , Arch Linux is working on making all official packages reproducible. [ 20 ] As of March 2025 [update] , Debian live images for Bookworm are reproducible. [ 21 ] The FreeBSD operating system builds reproducibly and without root access since October 2025. [ 22 ] Challenges [ edit ] According to the Reproducible Builds project, timestamps are "the biggest source of reproducibility issues. Many build tools record the current date and time... and most archive formats will happily record modification times on top of their own timestamps." [ 23 ] They recommend that "it is better to use a date that is relevant to the source code instead of the build: old software can always be built later" if it is reproducible. They identify several ways to modify build processes to do this: Set the SOURCE_DATE_EPOCH environment variable to the number of seconds since January 1, 1970, using something from the source code. Tools that support this environment variable will use its value (when set) instead of the current date and time. Post-process output to remove timestamps or normalize them. The tool strip-nondeterminism can often help do this. Use a library like libfaketime to intercept requests for the current time of day and provide a controlled response. In some cases other changes must be made to make a build process reproducible. For example, some data structures do not guarantee a stable order in each execution. A typical solution is to modify the build process to specify a sorted output from those structures. [ 24 ] See also [ edit ] Bootstrappable builds References [ edit ] ^ a b "reproducible-builds.org" . reproducible-builds.org . Archived from the original on 20 May 2016 . Retrieved 22 August 2016 . Reproducible builds are a set of software development practices which create a verifiable path from human readable source code to the binary code used by computers....build system needs to be made entirely deterministic: transforming a given source must always create the same result. ^ Lamb, Chris; Zacchiroli, Stefano (March 2022). "Reproducible Builds: Increasing the Integrity of Software Supply Chains" . IEEE Software . 39 (2): 62– 70. arXiv : 2104.06020 . doi : 10.1109/MS.2021.3073045 . S2CID   233219473 . Retrieved 26 March 2023 . ^ Ratliff, Emily (4 April 2016). "Establishing Correspondence Between an Application and its Source Code | SecurityWeek.com" . www.securityweek.com . SecurityWeek. Archived from the original on 20 September 2016 . Retrieved 22 August 2016 . ^ Ladisa, Piergiorgio; Plate, Henrik; Martinez, Matias; Barais, Olivier (19 April 2022). "Taxonomy of Attacks on Open-Source Software Supply Chains" . Proceedings - IEEE Symposium on Security and Privacy : 1509– 1526. arXiv : 2204.04008 . doi : 10.1109/SP46215.2023.00010 (inactive 3 May 2026). {{ cite journal }} : CS1 maint: DOI inactive as of May 2026 ( link ) ^ "Gitian: a secure software distribution method" . gitian.org . Retrieved 2018-01-10 . ^ Gilmore, John (2017-01-24). "SOURCE_PREFIX_MAP and Occam's Razor" . rb-general (Mailing list). ^ "LICENSE-file of the Gitian-Project" . GitHub . Retrieved 2019-12-03 . ^ Deterministic Builds Part Two: Technical Details. October 04, 2013 ^ "DDP2P" . GitHub . 2011. ^ Alhamed, Khalid, et al. " "Security by Decentralized Certification of Automatic-Updates for Open Source Software controlled by Volunteers" . Citeseer . .", Proceedings of Decentralized Coordination. pp 40-59, Lulu Publisher, April 6, 2013. ^ Silaghi, M. C., Alhamed, K., Dhannoon, O., Qin, S., Vishen, R., Knowles, R., ... & Hirayama, K. (2013, September). DirectDemocracyP2P—decentralized deliberative petition drives—. In IEEE P2P 2013 Proceedings (pp. 1-2). IEEE. ^ Silaghi, M., Alhamed, K., & Stansifer, R. (2015, December). Java tool extensions for supporting multiple recommenders and distributed bundles. In 2015 International Conference on Computational Science and Computational Intelligence (CSCI) (pp. 722-725). IEEE. ^ "Reproducible Builds talk in Debian" . 21 September 2014. ^ "Reproducible Builds history" . ^ "Linux-Distributionen: Mehr als 90 Prozent der Debian-Pakete reproduzierbar - Golem.de" (in German). 2017-07-24 . Retrieved 2018-10-30 . ^ "Reproducible Builds joins the Software Freedom Conservancy" . Retrieved 2018-12-15 . ^ "Reproducible Builds" . F-Droid. ^ "Verifying a Tails image for reproducibility" . Tails. ^ "Nixos-unstable's iso_minimal.x86_64-linux is 100% reproducible!" . NixOS Discourse . 2021-06-20 . Retrieved 2021-06-21 . ^ "ArchWiki - Reproducible Builds" . ^ Clobus, Roland (19 March 2025). "Irregular status update about reproducible Debian live ISO images" . Retrieved 26 March 2025 . ^ "FreeBSD now builds reproducibly and without root privilege" . 27 October 2025 . Retrieved 26 November 2025 . ^ "Timestamps" . Reproducible builds . Retrieved 2022-04-16 . ^ "Timestamps" . Reproducible builds . Retrieved 2022-04-16 . External links [ edit ] reproducible-builds.org Debian Reproducible Builds Retrieved from " https://en.wikipedia.org/w/index.php?title=Reproducible_builds&oldid=1355643990 " Category : Compiling tools Hidden categories: CS1 maint: DOI inactive as of May 2026 CS1 German-language sources (de) Articles with short description Short description is different from Wikidata Articles containing potentially dated statements from May 2020 All articles containing potentially dated statements Articles containing potentially dated statements from March 2025 This page was last edited on 23 May 2026, at 01:40  (UTC) . Text is available under the Creative Commons Attribution-ShareAlike 4.0 License ; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy . Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc. , a non-profit organization. Privacy policy About Wikipedia Disclaimers Contact Wikipedia Legal & safety contacts Code of Conduct Developers Statistics Cookie statement Mobile view Search Search Toggle the table of contents Reproducible builds 7 languages Add topic