Protocol 4.8Testing
Build Reproducibility
Checks for reproducible build practices: lock file installs, pinned action versions, containerization, and caching.
Reproducible builds mean "works on my machine" also works in CI and production. Non-reproducible builds cause phantom failures.
Incidents that failed this protocol
SolarWindsDec 2020civilizational
SUNBURST malware injected into Orion build pipeline compromises 18,000 organisations
Build reproducibility / pipeline integrity controls did not detect injected code in the compiled artifact.
xz utils (Tukaani Project)Mar 2024civilizational
CVE-2024-3094 — multi-year social-engineering attack inserts backdoor into xz/liblzma
Build reproducibility: the malicious payload required specific build configurations to activate, exploiting the gap between source code and shipped binary.
CodecovApr 2021enterprise
Codecov bash-uploader supply-chain compromise exfiltrates customer secrets
Build reproducibility: the bash-uploader script lacked checksum verification, allowing silent server-side modification to propagate undetected.
See where your repo scores against Protocol 4.8 — and the other 49 — in 60 seconds.
Run a free scan →Full framework →