Does Rust have a roadmap for reproducible builds?

108 points XiPingTing 28 comments

If I can build a program from source multiple times and get an identical binary with an identical checksum, then I can publish the source and the binary, with a proof that the binary is the compiled source code (assuming the checksum is collision-resistant). It is a much more reasonable exercise to auditing code than to reverse-engineer a binary, when looking for backdoors and vulnerabilities. It is also convenient to use code without having to compile first and fight with dependency issues.

In C, you can have dependencies that deliberately bake randomness into builds, but typically it is a reasonable exercise to make a build reproducible. Is this this case with Rust? My understanding is not.
Does Rust have any ambitions for reproducible builds? If so, what is the roadmap?