Скачать или смотреть Never Mind The Checkboxes, Here's Reproducible Builds Vagrant Cascadian, Chris Lamb FOSSY 2025

There are numerous policy compliance and regulatory processes being developed that target software development... but do they solve actual problems? Does it improve the quality of software? Do Software Bill of Materials (SBOMs) actually give you the information necessary to verify how a given software artifact was built? What is the goal of all these compliance checklists anyways... or more importantly, what should the goals be? If a software object is signed, who should be trusted to sign it, and can they be trusted ... forever?

Could you imagine a world with many bureaucratic compliance checks being replaced with verifiable processes performed by arbitrary third parties?

Let me introduce you to Reproducible Builds, a set of best practices which allow you to verify that software artifacts were built from the source code, allowing auditing for license compliance, providing security benefits, and remove the need to trust arbitrary software vendors.