Hermetic Builds

The build process executes in a completely disconnected environment with no access to the public internet or internal networks. This prevents dependency confusion attacks where a malicious package is pulled from a public registry instead of the intended private one. By physically or logically severing the network link, the build cannot be influenced by remote code execution or poisoned upstream artifacts.

All external libraries, packages, and toolchains must be declared, fetched, and stored locally before the build starts. This is often achieved through a vendor directory or an internal mirror. Key benefits include:

• Deterministic inputs: The exact version of every dependency is locked.
• Resilience: The build succeeds even if an external registry is down.
• Auditability: The complete dependency tree is known before compilation begins.

Hermetic builds strictly prohibit the execution of untrusted code from remote sources during compilation. This blocks Living-off-the-Land (LotL) attacks where a build script silently downloads and executes a payload. All macros, plugins, and build scripts must be sourced from the verified local cache, ensuring no logic is injected at compile time.

A core goal of hermetic builds is reproducibility: given the exact same source code and cached dependencies, the build process must produce a bit-for-bit identical artifact every time. This allows independent auditors to rebuild the software and verify that the distributed binary matches the source, proving no tampering occurred in the build pipeline.

The entire build environment, including the compiler, linker, and system libraries, is treated as a dependency. Tools like Docker or Nix are used to create a sealed container or environment with a cryptographic hash of the toolchain. This eliminates the 'works on my machine' problem and ensures that compiler-level backdoors cannot be introduced through environment drift.

Every hermetic build generates a cryptographically signed in-toto attestation or SLSA provenance document. This metadata records the exact input hashes, the isolated environment's fingerprint, and the output artifact hash. It provides verifiable proof that the build was executed in a controlled, network-disconnected state, forming a critical link in the supply chain security chain.