Reproducible-build observatory

The word "source" in "open source" is doing a lot of quiet work. Most of the time the thing you actually install isn't the source at all. It's a tarball someone built on a laptop, or in a CI job you can't see, and pushed to a registry. You're trusting that the artefact matches the code, and almost nobody ever checks.

So it checks. It rebuilds the most-used packages on npm, PyPI and crates from the exact source commit they claim, and diffs the result against the artefact the registry's serving. Then it publishes a scoreboard: what reproduces cleanly, what doesn't, and why. Public, on purpose, because a project that fails will fix it a lot quicker with the whole ecosystem watching than it ever would from a private email.

The hard part

I've shipped enough build artefacts over the years to know how far a file can drift from the commit it supposedly came from, and how much of that drift is completely innocent. Build timestamps. Embedded absolute paths. The order a minifier happened to emit things. A line ending that flipped on the way through a Windows runner. A naive diff screams about all of it and trains everyone to ignore the alarm. The entire value of this sits in separating that noise from the one difference that matters: the byte that says this artefact wasn't built from this source.

$ omnis-repro build left-pad@1.3.0
  source:  github.com/.../left-pad @ v1.3.0
  tarball: sha256 9f1e...     rebuilt: sha256 9f1e...     reproducible

$ omnis-repro build somepkg@2.4.0
  3 files differ: bundle.js (timestamp), bundle.js.map (path), LICENSE (CRLF)
  verdict: reproducible   (every diff is build-noise, none is source drift)

IF IT DOESN'T REBUILD, YOU'RE TRUSTING A LAPTOP.

It's in design. The near-term work is the noise model, the boring, unglamorous set of rules that tell a harmless timestamp from a real divergence, and picking the first ecosystem to run against at scale. There's a real case for starting with crates, though I think npm's where the fireworks are. It feeds the same supply-chain picture OSPulse already builds, from a different angle. Not what's inside your dependencies, but whether they're even what they say they are.