  Although it is possible to increase confidence in Free and Open Source
Software (FOSS) by reviewing its source code, trusting code is not the same as
trusting its executable counterparts. These are typically built and distributed
by third-party vendors, with severe security consequences if their supply
chains are compromised. In this paper, we present reproducible builds, an
approach that can determine whether generated binaries correspond with their
original source code. We first define the problem, and then provide insight
into the challenges of making real-world software build in a "reproducible"
manner-this is, when every build generates bit-for-bit identical results.
Through the experience of the Reproducible Builds project making the Debian
Linux distribution reproducible, we also describe the affinity between
reproducibility and quality assurance (QA).
