>This probably should be made clearer, but: Reproducible builds are necessary for the security of any such system. It's outlined in earlier blog posts.

>Consequently, the inclusion of reproducible build verification is taken as a premise.

That is a bit funny. We have had issues making the PHP package reproducible on Arch Linux for years. And I believe upstream has rejected patches which embeds uname into built artifacts.

I'm a bit unsure about the premise considering upstream doesn't seem interested solving this?