Re: "Reproducible build" definition in OpenSSF glossary

[David A. Wheeler via rb-general]

> On Apr 24, 2025, at 9:59 AM, fosslinux via rb-general 
> <rb-general@lists.reproducible-builds.org> wrote:
> 
> Hi David, list,
> 
> Of course, it would be ideal for r-b.org and OpenSSF to have the same 
> definition!

I agree! It'd be nice for r-b.org <http://r-b.org/> to have the same definition 
as itself, too, instead of the current situation :-).
Here's what I'd like to see:

* The page https://reproducible-builds.org/ has the *first* sentence of the 
definition (explaining why it's important), linking to...
* The page https://reproducible-builds.org/docs/definition/ which has the 
*full* definition including the first sentence (not a completely different one)
* The page https://glossary.openssf.org/reproducible-build/ has the same full 
definition, with a link to r-b.org <http://r-b.org/>

So here's another try, proposed as a modification to 
https://reproducible-builds.org/docs/definition/ given Samuel's suggestion & 
other comments. I've changed "source" to "source code" so it's clearer & links 
better. I also defined the term "source code" ("it is usually..." is NOT the 
correct form for a definition). I've changed the first sentence to use "build 
artifacts" consistently. I added a definition of what a *verified* reproducible 
build is (I think that's critically important, because if you don't verify it 
anywhere, it's not doing much good).

Thoughts?

--- David A. Wheeler

======================

Reproducible builds are a set of software development practices that create an 
independently-verifiable path from source code to build artifacts (e.g., binary 
code) that counters attacks on the build process. A build is reproducible if 
given the same source code, any party can recreate bit-by-bit identical copies 
of all build artifacts specified in the build process by generating them from 
the source code. Information about the build environment and build instructions 
is usually needed to achieve that. The relevant attributes of the build 
environment, the build instructions, and the source code, as well as the 
expected reproducible artifacts, are defined by the authors or distributors.

A verified reproducible build is a build result that has been independently 
verified to reproduce. Verified reproducible builds allow multiple third 
parties to come to a consensus on a “correct” result, highlighting any 
deviations as suspect and worthy of scrutiny.

Explanations

Source code is the preferred form of the work for making modifications to it. 
It is usually a checkout from version control at a specific revision of a 
source code archive.

< "Relevant attributes of the build environment" unchanged >

Artifacts of a build are the parts of the build results that are the desired 
primary output. Artifacts would include executables, distribution packages, or 
filesystem images. Build logs and similar ancillary outputs are usually not 
considered artifacts.

< Rest unchanged, but add... >

See https://reproducible-builds.org/docs/ for tips on how to achieve 
reproducible builds.