SLSA BP.2: Follow a consistent build process (Build L1 to L3)

What does BP.2 require?

The producer must build each artifact the same way every time so that verifiers can form expectations of what a correct build looks like. The producer may state its build process to verifiers explicitly, or verifiers may infer it (for example trust on first use). Where the package ecosystem requires a build configuration file describing the build (such as the source repository and build parameters), the producer must fill it in and keep it current.