Verify a canister release against a reproducible build
A source tag identifies a revision. An operator verifying a deployed canister also needs to reproduce the release artifact and compare its digest.
Rebuild the packaged artifact
For a release distributed as a compressed Wasm file, reproduce the documented compression step as well as the compiler and dependencies. Two gzip files can unpack to the same module while carrying different headers. Compare matching representations and record the exact commands used by the release process.
source revision + locked dependencies + compiler version → release Wasm
compare release artifact digest with installed module hash
Tie the result to a deployment
Read the module hash for the intended canister ID on the intended network and record the observation time. A matching digest links code bytes to that observation. Subsequent controller upgrades, initialization arguments and the contents of stable memory require separate evidence.