> Hermetic means reproducible. Hermetic is a subset of reproducible builds (bit-identical results). You can have a hermetic build and it calls getrandom() as a

> Hermetic means reproducible. Hermetic is a subset of reproducible builds (bit-identical results). You can have a hermetic build and it calls getrandom() as a side-effect that ends up in the binary. The only thing that bazel prevents is that your build rules do something like that accidentally, without it being glaringly obvious (eg. accessing $RANDOM, $$, /dev/urandom, time, ... in a shell script)