Tag
reproducible-builds
- Oct 18, 2026 Release Gates: Verifying the Cut Before It Ships What a release gate can mechanically check, why reproducibility is the only claim about a build that a second machine can settle, and how a gate fails without becoming a step people bypass. devops
- May 29, 2026 Content-Addressed Build Cache Keys: What Must Go Into the Hash A cache hit is only sound if the key covers every input that can change the output. The compiler binary, its flags, the header contents, and the transitive environment all belong in it; the clock and the path usually do not. compilers
- May 16, 2026 Lockfiles: Recording the Resolved Graph Without Re-Resolving It What a lockfile stores beyond version numbers, how it stays consistent with the manifest, and why regeneration is a different operation from installation. software engineering
- Apr 18, 2026 Verifying Provenance by Rebuilding What an independent rebuild proves, which nondeterministic packaging details decide whether it succeeds, and how to compare artifacts layer by layer rather than by image digest. virtualization
- Feb 22, 2026 Layer Cache Keys and What Makes a Build Reproducible Why two builds of the same source produce different layer digests, which inputs a build cache actually keys on, and how instruction ordering changes both reuse and image size. virtualization
- Feb 20, 2026 Reproducible Builds: The Sources of Nondeterminism in Compiler Output Two builds of identical source differ because something in the environment leaked into the artifact. The taxonomy of those leaks, and the normalizations that remove them. security
- Jan 17, 2026 Hermetic Build Actions: Enforcing That Compilation Reads Only Declared Inputs A declared input list is a promise. Making the promise enforceable means restricting the file system, the clock, and the network, and choosing which of those restrictions is worth its cost. compilers
- Dec 15, 2025 Reproducible Builds and the Sources of Byte-Level Nondeterminism Why two builds of identical source produce different archives, which fields carry the difference, and what verification requires beyond a matching hash. language runtimes
- Dec 5, 2025 How Dependency Resolvers Turn Version Ranges into a Fixed Graph A manifest states constraints, not versions. Resolution is a search over the version space, and the lockfile is the memoized answer that makes a build repeatable. security
- Aug 31, 2025 Hermetic Builds: Isolating the Network, the Clock, and the Filesystem A build that can read the network, the clock, or the ambient filesystem is not a function of its source. Isolation removes those channels and makes the input set explicit. security
- Aug 29, 2025 Bit-Reproducible Builds and Nondeterministic Actions The specific places nondeterminism enters a compile and an archive, the flags that normalise them, and why a byte-identical rebuild is a prerequisite for trusting a shared cache. developer tools
- Jul 29, 2025 Lockfiles and How a Version Range Becomes a Tree Why a range in a manifest is not a pin, what a lockfile records that the manifest cannot, and how resolvers settle or fail on conflicting requirements. devops
- May 13, 2025 Reproducible Mobile Builds and Independent Artifact Verification Which build inputs leak into a mobile binary, how path and timestamp normalisation makes two builds comparable, and what a third party can actually prove by rebuilding. mobile computing
- Jan 25, 2024 Sources of Nondeterminism in Compiled Artifacts and How They Are Removed Two builds of the same source can differ in embedded timestamps, temporary paths, hash-map iteration order, and archive member metadata. Each leak has a specific mechanism and a specific suppression. compilers