Comparison
Hermetic buildvsReproducible build
Hermetic build
the build runs with the network switched off, so anything it needs had to be declared up front.
A build isolated from anything not explicitly declared as an input: no ambient network access, no reliance on tools that happen to be on the machine. It is the precondition for reproducibility and for meaningful provenance, because a build that can reach the internet mid-run can pull in anything. Making a build hermetic is usually a painful audit of everything it was implicitly depending on, and the audit is the point.
Full entry →Reproducible build
you build the same commit twice on different machines and get byte-identical output, timestamps and all.
A build whose output depends only on its declared inputs, so anyone can rebuild it and verify they got the same artefact. Ordinary builds are not reproducible by default — timestamps, file ordering, embedded paths and unpinned dependencies all leak in. It matters because it is the only way to check that a published artefact really is what the source says it is, which is the whole basis of supply-chain provenance.
Full entry →