Comparison
DeterministicvsReproducible build
Deterministic
you run it twice with the same input and get byte-identical output, because nothing inside it reads the clock or a random number.
The property that the same inputs always produce the same output. It is about reproducibility, not about repeat-safety: a deterministic function can still be unsafe to run twice if it has side effects, and an idempotent operation can be non-deterministic in what it returns. Determinism is what makes replay, caching and testing possible.
Full entry →Reproducible build
you build the same commit twice on different machines and get byte-identical output, timestamps and all.
A build whose output depends only on its declared inputs, so anyone can rebuild it and verify they got the same artefact. Ordinary builds are not reproducible by default — timestamps, file ordering, embedded paths and unpinned dependencies all leak in. It matters because it is the only way to check that a published artefact really is what the source says it is, which is the whole basis of supply-chain provenance.
Full entry →