Build Systems
Turning source into an artifact you can trust: reproducibility, pinned inputs, environment isolation, and being able to prove where a binary came from.
A dependency graph of tasks with declared inputs and outputs, plus a rule for deciding what still needs doing — not a script that runs commands in order.
The same source plus the same declared inputs yields the same artefact — which requires pinned dependencies, deterministic actions and an isolated environment, in that order.
Six facts recorded at build time — commit, builder, inputs, toolchain, timestamp and artefact digest — that let you answer "where did this artefact come from" without guessing.
Most of what you ship was written by strangers, resolved by an algorithm you did not choose, and updated on a schedule you have to decide.
Pinning buys reproducibility and tamper-evidence, and hands you the update duty the range was performing on your behalf.
The machine a build runs on is an input to the build, and everything about it that is not declared is a source of drift, of irreproducibility and of shared-state compromise.
Builds are slow for three different reasons — repeated work, serialised work, and genuinely expensive work — and each has a fix that does nothing for the other two.