It was originally about stopping backdoors done post-compile but before software delivery. They were specifically worried about attacks like Paul Karger's compi

It was originally about stopping backdoors done post-compile but before software delivery. They were specifically worried about attacks like Paul Karger's compiler-compiler attack that Ken Thompson made famous. The thing is, almost all attacks are in the code, configuration, etc with transport security and reputation covering most of the risk they're trying to address. It's enormous effort with tiny security gain. I explain here: https://lobste.rs/s/7zbbzr/reproducing_linux_builds_firefox_68#c_rxjicd https://lobste.rs/s/7zbbzr/reproducing_linux_builds_firefox_... Another argument is that reproducible builds, at least the final form being reproducible, creates a monoculture that lets people be hit with exploits more easily. Cutting-edge research in CompSci has produced numerous techniques to use compilers to automatically secure source either by addressing root causes (eg Softbound + CETS) or obfuscating the program (eg instruction set randomization by Barrantes et al.). The latter methods are affected in that the hashes won't match when it's working. If you're trying to understand, they usually do things similar to the kinds of mitigations in OpenBSD (below) just with compilers. Personally, the state of software security would make me prioritize running it through a hardening tool over it being reproducible. https://www.openbsd.org/security.html https://www.openbsd.org/security.html The main way reproducible builds help is with debugging. Design-by-contract with runtime checks on can do that, too, on top of a lot of other benefits. They can have a debug version with checks on that people use just for diagnosing problems. At this point, reproducible builds might be easier than getting that going, though, due to all the work already put it. It also looks like some compiler modifications upstream could help a lot, too. http://se.ethz.ch/~meyer/publications/computer/contract.pdf http://se.ethz.ch/~meyer/publications/computer/contract.pdf https://www.hillelwayne.com/post/contracts/ https://www.hillelwayne.com/post/contracts/ https://www.hillelwayne.com/post/pbt-contracts/ https://www.hillelwayne.com/post/pbt-contracts/