REPRODUCIBLE BUILD · agent-trust-card@1.1.2

Reproducible build

The source tree rebuilds the published bytes

The npm tarball's inner tar layer rebuilds byte-for-byte from public source under a stated rule. The comparison target is downloaded from the npm registry — if either side moved, verification fails.

12
FILE ENTRIES
122880
TAR BYTES
3
PIN LOCATIONS
1
STATED RULE
0
ZLIB GUESSES
100%
REPRODUCIBLE
Run the rebuildThe rule← Suite root
node verify-rebuild.mjs --manifest source-manifest.json
uta / conformance repro /
agent-trust-card@1.1.2 · tar layer byte-identity

The claim, precisely

tarball sha256f1b44ed29eea0ca9eee65c1e0974c5d2b4b512378c6d21edb6344daf9184641a — 26782 bytes tar layer sha256519d406adba1e8199ca0c91a8f47195a81e42745aac05e599c9b3de87359b990 — 122880 bytes, the rebuild target source manifest5665c19bbfef0212c99ad1a5e156e8b265f3c5a9df05317f21775c34188e20e0 — 12 files pinned innpm registry · this repo (third location) · Rekor

Not claimed: byte-identity of the gzip layer — the deflate stream depends on the zlib build. The honest claim targets the layer fully determined by content + rule: the tar.

The rule (short form)
  • 12 file entries, fixed order, no directory entries — tarball-rule.json
  • Fixed metadata per entry: mode 000644, mtime 499162500, ustar, empty ids
  • 11 files: LF → CRLF; package.json re-serialized in the publisher's exact format (BOM, CRLF, 4-space indent)
  • Trailer: two zero blocks, nothing after
Stranger flow

Rebuild it yourself

# full flow: downloads the tarball from the npm registry, checks the
# anchored digest, rebuilds from the source tree, compares byte-for-byte
git clone https://github.com/alicelabs-llc/universal-trust-adapter
cd universal-trust-adapter/uta-repo/tests/reproducible
node verify-rebuild.mjs --manifest source-manifest.json

No trust in this README is required: the comparison target is downloaded from registry.npmjs.org, and the rebuild inputs come from the git checkout you just made. If either side moved, the verification fails.