Reproducibility is Not Enough: Artifact Verifiability in Decentralized-Build Package Ecosystems

Oreofe Solarin, Kelechi Kalu, James C. Davis +1

Reproducible and verifiable builds increase trust in distributed software artifacts by enabling independent parties to detect artifacts produced by compromised build or release pip…