A build produced a different artefact from the same commit two weeks apart. Why does that matter, and what makes builds reproducible?

Why it matters

• Debugging. If the artefact in production cannot be reproduced from its commit, investigating a defect means investigating something you cannot recreate.
• Security. "Was this artefact built from our source" is unanswerable without reproducibility, which means a compromised build cannot be distinguished from a legitimate one.
• Rollback. Rolling back to a previous commit and rebuilding may produce a different artefact from the one that was known good — which converts a rollback into an unknown.
• Incident attribution. A dependency that changed silently between builds is a cause that no code diff reveals.

What makes builds reproducible

• Pinned, hashed dependencies. Lock files with integrity hashes, so a compromised or changed registry cannot silently substitute. A version range is a reproducibility hole.
• Pinned build tooling and base images by digest, not by tag — tags move.
• A hermetic build environment with no network access to unpinned sources during the build.
• Deterministic outputs: no timestamps, no build hostnames, no non-deterministic ordering embedded in the artefact.
• Build provenance: a signed attestation of what source produced which artefact, on which builder. This is what makes the security question answerable, and it addresses build-system compromise rather than dependency compromise.

The practical intermediate position

Full bit-for-bit reproducibility is expensive and is not the point for most organisations. What matters is dependency reproducibility — that the same commit pulls the same dependencies — which delivers most of the value for a fraction of the effort and is achieved by lock files with hashes plus digest-pinned base images.

The related control that pays immediately

No ambient credentials in the build environment. A build executes untrusted code from dependencies and build scripts, and a build that can reach production secrets turns any dependency into a path to them.

That is the single highest-value hardening step in most pipelines, and it is independent of reproducibility while being motivated by the same threat.