legit.build

How legit.build works

The claim, not the proof

We do not run builds and we do not prove a build is honest. We record independent claims that a project release builds to a given binary hash, and surface where builders agree and where they diverge. Trust comes from N-of-M corroboration across identities, not from any single attestation.

Build it yourself

Start a session, pick projects, and paste one line into your coding agent. It builds each project against a pinned, deterministic recipe and reports the binary hash back here live. You review every result and sign only what you approve.

Two ways to attest

  • Wallet: you sign one gas-free EAS off-chain attestation covering the whole batch. Self-sovereign; identity shown via ENS / Farcaster.
  • Twitter: you authenticate with X and our backend (a trusted issuer) signs on your behalf, recording your handle.

On-chain publishing (a Base timestamp anchor, and opt-in full on-chain attestations) is coming later; v1 is off-chain.

Architecture cohorts

Builders report whatever architecture they built on. Hashes are only comparable within the same os/arch, so a release page groups attestations by architecture first and flags divergence only within a cohort. Different hashes across architectures are expected.

An open index of independent attestations that a release builds to a given binary hash. We don't run the builds and we don't vouch for them. We show where builders agree and where they don't.