Reproducibility and Security

Identity is not provenance

A SHA-256 digest can identify the bytes you have. A matching release manifest does not prove that a binary was produced from the advertised source, nor that running it is safe. Keep the archive, manifest, release tag and any provenance record together.

Use download verification before evaluating historical resources. Never combine an archive from one version with a checksum manifest from another.

What the hello record proves

The exact local 1.0.1 hello test produced byte-identical Assembly and executable outputs in repeated builds. This is a bounded observation with fixed inputs. It does not establish reproducibility across machines, toolchains or all release artifacts. Source-build provenance of the compiler binary was not claimed.

Evaluate in a controlled workspace

Use a directory you own and preserve existing files. Review the release’s known limitations and verification instructions before running binaries. A source example requiring filesystem access should use test inputs, not personal data. Keep credentials out of examples and bug reports.

Reporting a problem

For ordinary compiler bugs, provide a minimal source file, exact command, version and digest, expected behavior and observed diagnostic through GitHub issues. For sensitive reports, use the contact options on the maintainer’s public GitHub profile; do not post secrets publicly. No external security audit is claimed by this website.