Reproducible build
Also called: deterministic build, bit-for-bit
A reproducible build produces byte-identical output from the same source every time, so anyone can verify a published artifact was built from the code it claims.
A reproducible build yields bit-for-bit identical output from identical source, regardless of when or where it runs.
This matters because a signature proves who built something, not what they built from. If builds are reproducible, a third party can rebuild from published source and compare hashes — turning “trust the publisher” into “verify the artifact”.
The obstacles are mundane: embedded timestamps, absolute build paths, filesystem ordering,
locale, and parallelism ordering. Fixing them means pinning SOURCE_DATE_EPOCH,
normalising paths, and sorting anything that iterates a directory.
For a signed appliance image this closes the loop between the source you can read and the bytes you flash.