Reproducible Builds: Pipeline Wiring, Verification Tooling, and Benchmark Suite
Konflux container builds produce different image digests from identical source commits. The buildah task already supports reproducibility flags, but the pipelines don't wire them and there's no way to verify reproducibility automatically. This project audits all non-determinism sources in the build pipeline, wires SOURCE_DATE_EPOCH and related parameters through every pipeline variant, builds a benchmark suite of Containerfiles that exercise different reproducibility scenarios, and creates a standalone verify-reproducibility Tekton task. Deliverables: a non-determinism audit document, pipeline wiring patches, a 5+ Containerfile benchmark suite, a verification task with diffoci integration, and user/developer documentation.
Project details
Technologies
Not listed in the archive