<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting Compromised Build Tools — API Reference

## Hash Verification

```bash
# SHA-256 verification
sha256sum /path/to/tool
echo "expected_hash  /path/to/tool" | sha256sum -c

# Verify against package manager
dpkg -V package-name 2>/dev/null
rpm -V package-name 2>/dev/null
```

## Build Monitoring

```bash
# strace build process
strace -f -e trace=open,openat,execve command 2>&1

# Monitor network during build
strace -f -e trace=network command 2>&1

# Compare build outputs
diffoscope output-1 output-2 --html report.html
```

## Reproducible Build Verification

```bash
# Build twice and compare
make clean && make > /dev/null 2>&1 && sha256sum output > build1.sha
make clean && make > /dev/null 2>&1 && sha256sum output > build2.sha
diff build1.sha build2.sha

# Strip timestamps for comparison
strip-nondeterminism output
```

