--- title: "Fedora 43 Reproducible Builds & Supply Chain Security" description: "Fedora 43 targets 99% reproducible builds, boosting supply chain security. Learn what this means for software integrity and Cloudsmith's artifact management vision." canonical_url: "https://cloudsmith.com/blog/reproducible-builds-fedora-43-and-what-it-means-for-the-software-supply-chain" last_updated: "2025-04-12T20:00:53.000Z" --- # Fedora 43 Reproducible Builds & Supply Chain Security _April 2025 has brought some important news in the world of open source and software supply chain security: Fedora has announced a change proposal to make [**99% of its package builds reproducible**](https://lwn.net/Articles/1014979/) in its upcoming Fedora 43 release._ At first glance, this might seem like a low-level Linux packaging detail. But in reality, this is part of a much bigger shift that touches anyone who builds, ships, or consumes software - including us at Cloudsmith and the developers and enterprises who rely on us. So what’s really happening here? And how does it tie into what Cloudsmith is building? ### What Are Reproducible Builds, and Why Do They Matter? A [**Reproducible Build**](https://reproducible-builds.org/) means that if you take the same source code, the same build instructions, and the same environment, you can build a binary package that’s bit-for-bit identical every single time. No variation. No hidden surprises. This concept might sound simple, but while powerful it’s not exactly how most builds are today. Reproducible Builds uniquely make it possible to: - Verify that a package hasn’t been tampered with. - Audit what’s inside an artifact without reverse-engineering it. - Protect against supply chain attacks, like the recent [**XZ Utils Backdoor**](https://www.wired.com/story/xz-backdoor-everything-you-need-to-know/), which shocked the open-source world by showing how easily malicious code can sneak into production. [**Fedora**](https://fedoraproject.org/), one of the major Linux distributions, is now aiming to ensure that **99% of its packages meet this reproducibility standard** by the time Fedora 43 ships. That’s huge!! ### How Fedora Is Doing It Fedora has historically had a tightly controlled build system, which gave it more trust in its artifacts than some other distros. But it still wasn’t verifying reproducibility. That’s changing. To reach its 99% target, Fedora has: - Standardised timestamps and metadata using tools like [**add-determinism**](https://github.com/keszybz/add-determinism). - Adopted [**SOURCE_DATE_EPOCH**](https://reproducible-builds.org/docs/source-date-epoch/) to control build-time data. - Built out infrastructure for independent verification, including the [**rebuilderd**](https://github.com/kpcyrd/rebuilderd) project, which can rebuild packages and confirm they match the originals. This is more than a packaging improvement - **it's a shift toward verifiable trust in the software supply chain**. ### Where This Overlaps with Cloudsmith At Cloudsmith, we’re focused on **cloud-native artifact management**, but at the heart of that is **trust, provenance, and control** over the software that flows through the pipeline. The reproducibility work being done by Fedora (and earlier by [**Debian**](https://wiki.debian.org/ReproducibleBuilds/About) and [**Arch**](https://wiki.archlinux.org/title/Reproducible_builds)) is deeply aligned with what we believe the future of artifact management looks like: #### Supply Chain Security Reproducible builds are a critical defense against tampering and attacks. We see this as complementary to features like [**signature verification**](https://help.cloudsmith.io/docs/signing-keys), [**dependency scanning**](https://help.cloudsmith.io/docs/security-scanning), and [**access control**](https://help.cloudsmith.io/docs/access-controls) - all part of a modern artifact management stack. #### Artifact Provenance and Verification Cloudsmith already helps teams track and distribute their artifacts across [**geographies**](https://help.cloudsmith.io/docs/custom-storage-regions) and [**formats**](https://help.cloudsmith.io/docs/supported-formats). Reproducibility adds another layer: **can this artifact be independently rebuilt and verified to be what it claims to be?** #### Metadata and Transparency Reproducibility introduces a new category of metadata: timestamps, build hosts, source hashes. Our platform is perfectly positioned to surface this metadata and let teams **audit, filter, and trace artifacts across builds and releases**. #### Multi-format, Cross-ecosystem Coverage Whether you're dealing with [**RPMs**](/blog/getting-started-with-rpm-packages-and-cloudsmith) (like Fedora), [**DEBs**](https://help.cloudsmith.io/docs/debian-repository) (like Debian), [**Docker**](https://help.cloudsmith.io/docs/docker-registry) images, or [**Go**](/blog/getting-started-with-go-and-cloudsmith) binaries - Cloudsmith’s support for multiple formats makes it ideal for surfacing reproducibility status across different build systems. ### Cloudsmith and Reproducibility We’re watching these developments closely - and more than that, we're exploring ways to bring reproducibility directly into the artifact lifecycle within Cloudsmith. We would love hear [**community feedback**](https://help.cloudsmith.io/docs/contact-us#email) on how we Cloudsmith could help in areas such as: - **Artifact reproducibility checks** on upload. - **Integration with tools like** rebuilderd or [**diffoscope**](https://pypi.org/project/diffoscope/) for automated validation. - **Reproducibility status dashboards** in the UI. - **“Verified Reproducible” badges** for artifacts that pass checks. - Surfacing **SOURCE_DATE_EPOCH** and build metadata in package views. - CI/CD hooks to trigger reproducibility tests as part of your release process. Because at the end of the day, artifact management is more than just a distribution method, it’s also about building trust in software packages. ### Conclusion Fedora’s push toward reproducible builds is part of a bigger story: the evolution of open source and enterprise software toward **greater transparency, accountability, and security**. It’s an effort we at Cloudsmith deeply support and plan to participate in. As reproducibility becomes the new standard for package integrity, artifact management platforms need to step up and provide the infrastructure to support it - not just to store and deliver packages, but to **verify and prove** them. We’re excited about that future. Let’s build it together.