# Reproducible Builds: Increasing the Integrity of Software Supply Chains

arXiv: https://arxiv.org/abs/2104.06020 · HTML: https://mlsanity.com/paper/2104.06020/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 13 Apr 2021.

## Built on by (most cited first, 7 of 7)

- [Atlas: A Framework for ML Lifecycle Provenance & Transparency](https://mlsanity.com/paper/2502.19567/) (2025)
- [Dstack: A Zero Trust Framework for Confidential Containers](https://mlsanity.com/paper/2509.11555/) (2025)
- [SLEAN: Simple Lightweight Ensemble Analysis Network for Multi-Provider LLM Coordination: Design, Implementation, and Vibe Coding Bug Investigation Case Study](https://mlsanity.com/paper/2510.10010/) (2025)
- [Rewriting the Response Path: Silent Tampering and Provider-Signed Defense in BYOK LLM Agents](https://mlsanity.com/paper/2605.02187/) (2026)
- [Reproducibility is the New Copyleft: Defining AGI-oriented Reproducible Builds](https://mlsanity.com/paper/2606.03019/) (2026)
- [Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation](https://mlsanity.com/paper/2607.24888/) (2026)
- [What You Sign Is Not What You Run: The Verifiability Gap in Quantized LLM Supply Chains](https://mlsanity.com/paper/2610.19498/) (2026)

## Abstract (arXiv)

Although it is possible to increase confidence in Free and Open Source Software (FOSS) by reviewing its source code, trusting code is not the same as trusting its executable counterparts. These are typically built and distributed by third-party vendors, with severe security consequences if their supply chains are compromised. In this paper, we present reproducible builds, an approach that can determine whether generated binaries correspond with their original source code. We first define the problem, and then provide insight into the challenges of making real-world software build in a "reproducible" manner-this is, when every build generates bit-for-bit identical results. Through the experience of the Reproducible Builds project making the Debian Linux distribution reproducible, we also describe the affinity between reproducibility and quality assurance (QA).