SYSE.30:11 - SoTA-Echoing

For “What establishes that this package can be reconstructed?”, adopt the controlled-input and specified-artifact comparison in the Reproducible Builds definition. The serious default is repeated command success from the same source label. Section 4.1 rejects that weaker result as byte reproducibility, and section 4.4 requires a comparison. The stronger evidence costs an additional controlled execution; it is warranted only for the claim being made.

Adapt recording the build environment and its timestamp guidance in sections 4.2–4.4. Compared with recording every ambient value forever, remove irrelevant variation where possible and retain the inputs that can change the output. The worked case separates source identity from execution time. Tool support and format semantics must be checked locally; the source’s historical tool list is not a current compatibility guarantee.

Reopen the selected controls when an independent builder disagrees, an input disappears, a dependency or toolchain changes, or the receiving use needs a different output/equivalence claim. These sources do not establish application correctness or trustworthy provenance.