Open Source Summit India 2026

What if two independent builds of the same source code produced byte-identical artifacts every time? That’s the goal of reproducible builds and one of the strongest guarantees we can provide for software supply chain integrity. Yet in many CI/CD systems, builds still include hidden sources of nondeterminism.

In this session we’ll break down what reproducible builds actually mean, why they matter beyond simple bit-for-bit equality, and the common pitfalls that quietly break reproducibility—embedded timestamps, non-deterministic file ordering, and environment leakage.

As a Tekton maintainer, I’ll show how Tekton pipeline primitives such as hermetic execution, parameterized TaskRuns, and provenance via Tekton Chains can make deterministic builds practical in real pipelines. Through a live demo, we’ll build a container image, verify identical digests across independent pipeline runs, and generate SLSA-compliant provenance.

Attendees will leave with a clear mental model of reproducibility and concrete patterns for auditing and improving their own pipelines.