RustBuildEq: A Benchmark for Binary Equivalence Under Build Variability

Reproducible independent rebuilds strengthen software supply-chain integrity by recreating the original build environment and enforcing bitwise equivalence between resulting artifacts. However, this approach implicitly assumes a trustworthy toolchain and can fail under adversarial manipulation of the build process itself, as illustrated by the Ken Thompson attack. Prior work has explored introducing variation across build environments to reduce reliance on any single toolchain, and has proposed methods for establishing behavioural equivalence that tolerate benign build variability in the Java ecosystem. In this work, we extend this line of research to Rust and present RustBuildEq, a benchmark for studying binary equivalence under realistic build variability. We curate a large corpus of crates drawn from the top 20\% of the crates.io ecosystem and construct datasets of equivalent (EQ) and non-equivalent (NEQ) artifact pairs with reproducible provenance metadata. EQ pairs are generated from identical source revisions under varying toolchain versions and build configurations, such as code generation backends, debugging information settings, and link-time optimizations, while NEQ pairs are derived either from AST rewrites or from API-breaking changes across versions. Many Rust libraries rely heavily on generics and cannot be compiled into binaries without specifiying concrete types; to address this, we employ a combination of automated techniques, including heuristic type instantiation, witness-type synthesis, and a repair loop assisted by a large language model. RustBuildEq comprises 19,184,671 EQ artifacts and 273,848,531 NEQ artifacts, with a Python API for dataset navigation.