Hermetic Build
A build whose output is a function only of its declared inputs, so the same commit cannot produce two different artifacts.
A hermetic build declares every input — source, toolchain version, dependency versions by digest, build flags — and is denied access to anything else. No network fetch at build time, no reading of the host's installed compiler, no implicit "latest".
The property this buys is that the build becomes verifiable. Given the same commit, anyone can rebuild and get a bit-identical result, which means an attestation about the artifact is an attestation about the source. Without it, the artifact is a claim about what one machine did on one afternoon.
Full bit-for-bit reproducibility is hard and often not worth chasing: timestamps, file ordering and non-deterministic compilers all leak in. The valuable ninety percent is cheaper — pin every dependency by digest rather than by tag, pin the toolchain, and fail the build if it tries to reach the network. That alone removes the class of incident where a transitive dependency changed under a floating tag and the same commit stopped working.