They only mentioned it briefly, and not by number, but this release includes 95%+ bit-for-bit reproducibility on AMD64, ARM64, and RISC-V across more than 30,000 packages (92% mean across all architectures).
Congratulations to the team--phenomenal work!
Could you help me understand why the remaining 5% is not bit-for-bit reproducible? For example... if you download a tar of sources pinned to a version, and you run `./configure` and `make` in some kind of container and it doesn't embed some kind of timestamp... why are 95% reproducible and some aren't? Would like to learn/understand.
Is there a tool on a given debian trixie system to know what installed packages are not currently reproducible?
Alternative to parsing the reproduce web site :)