Comparison
Build provenancevsReproducible build
Build provenance
you can prove which commit, which builder and which inputs produced this exact image, from a signed statement rather than a wiki page.
A signed record generated by the build system describing what was built, from what source, by which builder, with what inputs. It answers the question a security incident actually asks — where did this artefact come from — without relying on anyone's memory. Its trustworthiness comes from being produced by the build platform rather than by the build script, since a script an attacker controls can claim anything.
Full entry →Reproducible build
you build the same commit twice on different machines and get byte-identical output, timestamps and all.
A build whose output depends only on its declared inputs, so anyone can rebuild it and verify they got the same artefact. Ordinary builds are not reproducible by default — timestamps, file ordering, embedded paths and unpinned dependencies all leak in. It matters because it is the only way to check that a published artefact really is what the source says it is, which is the whole basis of supply-chain provenance.
Full entry →