So much of this is just normal stuff anyway, right? Signing CI output, tracking dependencies, using bundled resources..

Bit-for-bit reproducible builds are definitely doable, but mean including build dates is tricky, and care needs to be taken with archival file ordering.

Is this such a big departure from the norm? Curious what constitutes normal!