Page History

...

• your builds must be deterministic enough that independent builds produce bit-by-bit identical artifacts
• you have documented how and when artifacts are actually independently rebuilt and verified in your release process
• you follow this process in practice.

Ecosystem-specific notes

See below for any ecosystem-specific notes that could be helpful for other projects to make their builds reproducible. If you have additional input to share, feel free to edit this wiki page. If you have questions or want to discuss approaches, you can use the security-discuss mailinglist or Slack channel.

Java / Maven

If you have a project that is built with Apache Maven, refer to the Configuring for Reproducible Builds guide.