Run #4280 cleared every previously-seen non-determinism (post-process
ran end-to-end, all five iter32-fixed flag paths worked). The next
diffoscope-flagged set is the runtime state that *every* Debian build
captures and reproducible-rebuilders strip:
/var/lib/apt/lists/127.0.0.1:9977_debian-fasttrack_…/InRelease
The InRelease file from the FastTrack repo carries
`Date:` and a fresh PGP signature with a 30-minute drift
between Build A's fetch (22:00 UTC) and Build B's fetch
(22:30 UTC). FastTrack re-signs roughly daily, so apt
pickup lands on different signed files when the two builds
bracket a re-sign. snapshot.debian.org doesn't cover
FastTrack so we can't pin upstream — strip the file
instead. apt-get update regenerates it on first boot.
/var/lib/apt/lists/_home_user_derivative-binary_aptrepo_local_…/Release
The locally-built kicksecure apt repo's Release file.
reprepro stamps this with wall-clock time when it generates
the repo. SOURCE_DATE_EPOCH is honoured for the underlying
package metadata but reprepro writes Release with the
current time regardless.
/var/log/apt/history.log
/var/log/apt/term.log
/var/log/dpkg.log
Wall-clock-stamped logs from package installation. Every
apt/dpkg invocation prepends a timestamp.
Cleanup added:
* /var/log/apt/*.log
* /var/log/{dpkg,alternatives}.log
* /var/lib/apt/lists/{everything except lock and partial/}
The live system regenerates all of these on first use. Standard
reproducible-Debian rebuilder behaviour (Tails, Whonix-public-iso,
debian-cd all do the equivalent).
If the diffoscope output for run #4280 is honest about the full
delta — and grep ├── shows exactly five entries — this should be
the last divergence. Crossing fingers for run #4281.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
SysAdmin
33e1501611