ReproSpec is an open evidence standard and toolkit designed to make software bug reports and test executions portable, sandboxed, and verifiably reproducible.
With automated regex-based redaction, cryptographic SHA-256 integrity hashing, and containerized Docker replay, ReproSpec solves the "works on my machine" crisis in open-source maintenance.
⚠️ Experimental Alpha Software: ReproSpec is currently under active development. It is NOT secure for running arbitrary, malicious, or untrusted code without virtualized host isolation.
- Runtime: Node.js 20+
- Languages: Pure JavaScript and TypeScript
- Package Manager: npm (requires
package-lock.json) - Hosts: macOS and Linux
- Replay Sandbox: Docker-based execution container (offline by default). Repository-dependent replay verifies the immutable bundle snapshot, then runs from a writable disposable execution copy. Build outputs such as
distand coverage are discarded after replay.
See how ReproSpec captures execution, verifies bundle integrity, and replays commands inside a sandboxed container.
# Install the package locally
npm install
# 1. Capture execution (outputs bundle to .reprospec/my-bundle)
node bin/reprospec.js capture --output .reprospec/my-bundle -- node -e "console.log('original run')"
# 2. Verify bundle integrity
node bin/reprospec.js verify .reprospec/my-bundle
# 3. Replay in isolated sandbox container
node bin/reprospec.js replay .reprospec/my-bundleRead QUICKSTART.md for more details.