I should mention that reproducible builds are really about making bit-for-bit identical builds. There are reasons this is difficult, including individual projects inserting timestamps at the time that they build, or compile-time randomness, sort order of files in the filesystem based on the current locale, etc.