People already listed: - security against backdoors - validating build environment - reproducing bugs But there's more: - legal liabilities: many bad build

People already listed: - security against backdoors - validating build environment - reproducing bugs But there's more: - legal liabilities: many bad build systems pull trees of dependencies from the Internet during the build. How can you prove that no license breaching occurred in any of the dependencies? Debian explicitly verifies licensing in each package. - prevent pulling dependencies from deleted (or hijacked!) repositories on the Internet - reproduce performance improvements: non reproducible builds can often lead to non reproducible performance. Even things like the length of the local hostname can leak into a binary and affect memory alignment.