reproducible builds: the rpm from the spec matches the ci artifact #51

New Issue

grenade · 2026-09-15T12:41:22Z

grenade commented

2026-09-15 12:41:22 +00:00

Parent: #10

Scope

Pin everything the build reads (toolchain, lockfiles, vendored crates, node and pnpm versions, SOURCE_DATE_EPOCH), build the RPM on two machines, and diff. Document every remaining difference and fix what can be fixed.

Acceptance

diffoscope on two independent builds of the same tag is empty, or every difference is listed in doc/reproducibility.md with a reason.

Depends on

The RPM child of #5.

Parent: #10 ## Scope Pin everything the build reads (toolchain, lockfiles, vendored crates, node and pnpm versions, `SOURCE_DATE_EPOCH`), build the RPM on two machines, and diff. Document every remaining difference and fix what can be fixed. ## Acceptance `diffoscope` on two independent builds of the same tag is empty, or every difference is listed in `doc/reproducibility.md` with a reason. ## Depends on The RPM child of #5.

grenade added the child label 2026-09-15 12:42:04 +00:00

grenade referenced this issue

2026-09-15 12:42:48 +00:00

epic: security hardening and release readiness #10

grenade referenced this issue from a commit

2026-09-16 07:42:08 +00:00

feat(ramp): the FiatRamp port with a stub provider, opened in the system browser

Sign in to join this conversation.