A reproducible build is a software build process that produces identical output when given the same source code, dependencies, configuration, and build instructions. Achieving this typically requires controlling variables such as timestamps, file ordering, compiler versions, and environment settings.
Reproducibility matters in security because it helps teams verify that a distributed package matches its published source and has not been unexpectedly altered. Developers and distribution maintainers can rebuild software independently and compare the results; defenders can also use consistent build scripts to create reliable system images across machines. If identical inputs produce different outputs, that may indicate uncontrolled build conditions or, in some cases, tampering in the software supply chain.