Git · Senior · Question 45 of 76
How do you produce a release whose source can be reproduced exactly?
- 1Copy the developer's working folder to the server
- 2Build from whatever is newest on
mainat deploy time - ✓Correct answer: Build from a signed annotated tag with a committed lockfile
Explanation
A tag pins the exact tree, a lockfile pins dependencies, and the signature proves who released it. CI then rebuilds the same artifact from the same inputs.