{"id":18952310,"url":"https://github.com/step-security/reproduce-builds","last_synced_at":"2026-03-29T03:30:18.394Z","repository":{"id":38013693,"uuid":"500627317","full_name":"step-security/reproduce-builds","owner":"step-security","description":"To reproduce builds for artifacts being monitored by Release Monitor","archived":false,"fork":false,"pushed_at":"2023-09-07T16:57:48.000Z","size":104,"stargazers_count":5,"open_issues_count":5,"forks_count":6,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-01-01T02:28:43.697Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/step-security.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-06-06T23:47:10.000Z","updated_at":"2023-01-25T16:48:52.000Z","dependencies_parsed_at":"2024-11-08T13:48:52.008Z","dependency_job_id":null,"html_url":"https://github.com/step-security/reproduce-builds","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Freproduce-builds","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Freproduce-builds/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Freproduce-builds/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/step-security%2Freproduce-builds/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/step-security","download_url":"https://codeload.github.com/step-security/reproduce-builds/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239951650,"owners_count":19723915,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-08T13:32:43.583Z","updated_at":"2026-03-29T03:30:18.326Z","avatar_url":"https://github.com/step-security.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# reproduce-builds\n[![build-reproducer](images/banner.png)](#)\n[StepSecurity Release Monitor](https://blog.stepsecurity.io/introducing-stepsecurity-release-monitor-517ed10623a1) uses this repository to programatically reproduce builds for different open source projects. As of now, it has been setup to rebuild software written in the Go Programming Language. \n\nThe `rebuild.yml` workflow takes the following inputs. It then downloads the source code, builds the code, and compares the checksum with the expected checksum. If the checksum matches, the workflow passes, else it fails. The expected checksum comes from the release artifacts of the software being rebuilt. \n\n\n```yaml\nname: rebuild\n\non:\n  workflow_dispatch:\n    inputs:\n      REPO:\n        description: 'Repository to checkout'\n        required: true\n      COMMIT_SHA:\n        description: 'Commit SHA to checkout to rebuild'\n        required: true\n      COMMAND:\n        description: 'Build command to run'\n        required: true\n      GO_VERSION:\n        description: 'Go version to use'\n        required: true\n      OUTPUT_FILE:\n        description: 'Name of output binary file'\n        required: true\n      EXPECTED_CHECKSUM:\n        description: 'Expected checksum of output binary file'\n        required: true\n\npermissions: read-all\n\njobs:\n  rebuild:\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    steps:\n    - name: Checkout\n      uses: actions/checkout@629c2de402a417ea7690ca6ce3f33229e27606a5\n      with:\n        repository: ${{ github.event.inputs.REPO }}\n        ref: ${{ github.event.inputs.COMMIT_SHA }}\n         \n    \n    - name: Set up Go \n      uses: actions/setup-go@424fc82d43fa5a37540bae62709ddcc23d9520d4\n      with:\n        go-version: ${{ github.event.inputs.GO_VERSION }}\n        \n    - run: ${{ github.event.inputs.COMMAND }}\n    - run: | \n        sha=($(shasum -a256 ${{ github.event.inputs.OUTPUT_FILE }}))\n        echo $sha\n        if [[ \"$sha\" != \"${{ github.event.inputs.EXPECTED_CHECKSUM }}\" ]]\n        then\n          echo \"Checksum not as expected\"\n          exit 1\n        fi\n```\n\nThe build commands are stored in a `release-monitor.yml` file. These files can either be in the root of the repository or at https://github.com/step-security/secure-workflows/tree/main/knowledge-base/releases. \n\n### Example\n\nThe `release-monitor.yml` file for Fleet looks like this. The build commands for different release artifacts are listed in the `reproduce-build` section. \n\n``` yaml\nname: \"fleetdm release\"\nrelease-process:\n  artifact-location:\n    github-release:\n      repo: fleetdm/fleet\n  reproducible-build:\n    - artifact: fleetctl_v{{ .Version }}_linux.tar.gz\n      binary: fleetctl\n      build-command: make deps; make generate; CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags=\"-X github.com/kolide/kit/version.appName=fleetctl -X github.com/kolide/kit/version.version={{ .Version }} -X github.com/kolide/kit/version.branch={{ .Branch }} -X github.com/kolide/kit/version.revision={{ .FullCommit }} -X github.com/kolide/kit/version.buildDate={{ time \"2006-01-02\"}} -X github.com/kolide/kit/version.buildUser=runner\" ./cmd/fleetctl/\n      go-version: 1.17.8\n  pipeline:\n    github-action:\n      repo: fleetdm/fleet\n      workflow: goreleaser-fleet.yaml\n    branches: \n      - main\n      - patch-fleet-v*\n    tags:\n      - fleet-v*\n```\n\nIn this example, StepSecurity Release Monitor has fetched the actual checksum from the https://github.com/fleetdm/fleet/releases/tag/fleet-v4.15.0 release of Fleet and triggered workflows to rebuild the `fleetctl` binary. \n\nThis particular workflow was triggered to rebuild `fleetctl` for Linux. \n\nhttps://github.com/step-security/reproduce-builds/runs/6782518145?check_suite_focus=true\n\nThe workflow passed, which means the checksum of `fleetctl` generated after rebuilding from source matched the expected checksum. This means the binary for `fleetctl` that is present in the Fleet Release Assets is as expected, and has not been tampered with during the build process.  \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstep-security%2Freproduce-builds","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstep-security%2Freproduce-builds","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstep-security%2Freproduce-builds/lists"}