dsh-reproducible-build-proof

In software supply chains, reproducible builds are often referenced in the abstract, yet the concrete question that matters most is whether two independently operated builders, after recording the same source revision, recipe, build type, parameters, dependency set, and environment contract, produced byte-identical specified artifacts. dsh-reproducible-build-proof is the offline evidence layer built to answer exactly that question. It does not execute builds, install packages, or issue SLSA Verified Properties; it strictly verifies that the hash-only receipts submitted by both parties converge to the same set of output fingerprints.

The core capability is independent rebuild convergence: it first compares declared inputs (source revision, recipe, build type, parameters, dependency set, and environment contract) for agreement, then checks under SHA-256 whether the specified output set matches byte-for-byte. Reports contain only hashes, sizes, counts, booleans, and verdicts, and explicitly reject secret-shaped material, raw logs, and body or content fields. The verifier has zero runtime dependencies, makes zero network requests, reads a workspace-relative non-symlink manifest, and writes deterministic content-addressed output to an explicit artifact directory via read-back verification.

It suits teams that need a reproducibility audit trail in their release pipeline: security and compliance reviewers, CI/CD platform administrators, and supply-chain engineers who want to keep three layers of evidence distinct under the SLSA framework, namely endpoint consistency (dsh-release-proof), signature-policy conformance (dsh-attestation-proof), and independent rebuild convergence covered by this plugin.