Reproducible builds and pinned dependencies

Goal

Make a build result depend only on the recorded inputs, so that two builds of the same commit are identical and a modified dependency cannot slip in unnoticed.

Prerequisites

A build that already runs from a clean checkout, and a package manager that supports lockfiles.

Steps

1. Record exact dependency versions in a lockfile committed to the repository; do not rely on version ranges at build time.
2. Where the tool supports it, record content hashes and verify them at install time (pip's --require-hashes mode refuses any package whose hash is missing or different).
3. Pin base images and build tools by digest or exact version, not by floating tags such as latest.
4. Remove sources of non-determinism the Reproducible Builds project lists: embedded timestamps (use SOURCE_DATE_EPOCH), file ordering, absolute build paths, locale-dependent output.
5. Build twice in independent environments and compare the artifacts; automate the comparison in the pipeline.

Expected result

Identical artifacts from identical inputs, and a lockfile diff that shows exactly which dependency changed in a given commit.

Limits and test basis

Full bit-for-bit reproducibility is hard for some toolchains; hash-verified dependencies already remove most supply-chain risk even when the final artifact is not yet identical. Lockfiles must be updated deliberately, with review, or they freeze security fixes out.