--- title: What's missing to have reproducible builds on PyPI description: Brett Cannon, writing for his 2026 Python Packaging Council nomination, argues that Python packaging lacks a defined mechanism for reproducible builds, which... canonical: https://daily.dev/posts/what-s-missing-to-have-reproducible-builds-on-pypi-0iwpf02ac twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What's missing to have reproducible builds on PyPI | daily.dev og:description: Brett Cannon, writing for his 2026 Python Packaging Council nomination, argues that Python packaging lacks a defined mechanism for reproducible builds, which... og:url: https://daily.dev/posts/what-s-missing-to-have-reproducible-builds-on-pypi-0iwpf02ac og:image: https://api.daily.dev/og/posts/0iWPf02AC.png og:image:alt: What's missing to have reproducible builds on PyPI og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What's missing to have reproducible builds on PyPI **[Planet Python](https://daily.dev/sources/planetpython)** · 5 min read · 0 upvotes · 0 comments ## Summary Brett Cannon, writing for his 2026 Python Packaging Council nomination, argues that Python packaging lacks a defined mechanism for reproducible builds, which would let third parties verify that a distribution's bits match its source and detect build-process tampering (as happened in the SolarWinds compromise). He outlines three missing pieces: recording the source code location in sdists and wheels (currently only captured via direct_url.json for source installs), recording the software used to build a distribution (wheels can use SBOMs per PEP 770, but sdists have no equivalent mechanism due to their simple tarball/PKG-INFO structure), and having build backends record their own environment so builds can be replayed via the pyproject.toml build-system table. He proposes that PyPI could surface reproducibility by letting trusted third-party verifiers report successful reproductions, visible via the index API, framed as an opt-in perk (akin to SLSA build level 1) rather than a shaming mechanism. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why can't sdists support SBOMs for reproducible builds the way wheels can with PEP 770? Sdists lack a structured metadata mechanism because they are typically just a tarball containing a PKG-INFO file with precalculated metadata, leaving no place to add an SBOM or similar file. Wheels, by contrast, support recording software bills of materials via the dist-info/sboms directory added by PEP 770, which can capture the build tools used to create the distribution. _daily.dev surfaces packaging specification changes like this for developers tracking Python supply chain security._ ### What information is missing from Python wheels and sdists to enable reproducible builds? Two things are missing: a record of where the source code used to build the distribution came from, and a record of what software built it. Source-installed packages already get this via a direct_url.json file created by the installer, but sdists and wheels uploaded to PyPI don't capture equivalent metadata, making independent verification of build integrity difficult. _Developers weighing Python supply chain security tooling can follow packaging proposals like this on daily.dev._ ## Similar posts on daily.dev - [Python's binary wheels and supply chain attacks](https://daily.dev/posts/python-s-binary-wheels-and-supply-chain-attacks-ly1jpokdl) · Planet Python · 0 upvotes · 0 comments - [How to reduce false positives in security scans](https://daily.dev/posts/how-to-reduce-false-positives-in-security-scans-8soblcatl) · Red Hat Developer · 0 upvotes · 0 comments - [The Road to Reproducible Builds on the JVM · Maarten on IT](https://daily.dev/posts/the-road-to-reproducible-builds-on-the-jvm-maarten-on-it-e36f7n8ew) · Maarten on IT · 0 upvotes · 0 comments - [Who Built This?](https://daily.dev/posts/who-built-this--bc4rx6op2) · Andrew Nesbitt · 0 upvotes · 0 comments --- Tags: [#python](https://daily.dev/tags/python), [#reproducible-builds](https://daily.dev/tags/reproducible-builds), [#sbom](https://daily.dev/tags/sbom), [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/what-s-missing-to-have-reproducible-builds-on-pypi-0iwpf02ac) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What's missing to have reproducible builds on PyPI","url":"https://daily.dev/posts/what-s-missing-to-have-reproducible-builds-on-pypi-0iwpf02ac","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-s-missing-to-have-reproducible-builds-on-pypi-0iwpf02ac"},"datePublished":"2026-08-16T04:50:17.577Z","dateModified":"2026-10-14T02:26:22.623Z","description":"Brett Cannon, writing for his 2026 Python Packaging Council nomination, argues that Python packaging lacks a defined mechanism for reproducible builds, which...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/58fe1a0b085608dc5125e72c71b54c1c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/58fe1a0b085608dc5125e72c71b54c1c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Planet Python","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Planet Python","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/eac3cc584cb043b5a242d13752bd3d0c","url":"https://daily.dev/sources/planetpython"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-s-missing-to-have-reproducible-builds-on-pypi-0iwpf02ac","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"python,reproducible-builds,sbom,security","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Planet Python","item":"https://daily.dev/sources/planetpython"},{"@type":"ListItem","position":3,"name":"What's missing to have reproducible builds on PyPI"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-s-missing-to-have-reproducible-builds-on-pypi-0iwpf02ac#faq","mainEntity":[{"@type":"Question","name":"Why can't sdists support SBOMs for reproducible builds the way wheels can with PEP 770?","acceptedAnswer":{"@type":"Answer","text":"Sdists lack a structured metadata mechanism because they are typically just a tarball containing a PKG-INFO file with precalculated metadata, leaving no place to add an SBOM or similar file. Wheels, by contrast, support recording software bills of materials via the dist-info/sboms directory added by PEP 770, which can capture the build tools used to create the distribution. daily.dev surfaces packaging specification changes like this for developers tracking Python supply chain security."}},{"@type":"Question","name":"What information is missing from Python wheels and sdists to enable reproducible builds?","acceptedAnswer":{"@type":"Answer","text":"Two things are missing: a record of where the source code used to build the distribution came from, and a record of what software built it. Source-installed packages already get this via a direct_url.json file created by the installer, but sdists and wheels uploaded to PyPI don't capture equivalent metadata, making independent verification of build integrity difficult. Developers weighing Python supply chain security tooling can follow packaging proposals like this on daily.dev."}}]} ```