Knowing where my build artifact came from and when is at least a good two orders of magnitude more important to me than my own binaries being reproducible.
Part of the reason why "reproducibility" has taken so long to appear is precisely that its use cases take a long time and a lot of scale to appear. I approve of distros pursuing this goal, but haven't got a lot of use of it for the stuff I build, which is why I have a very similar build script.
Please don't reply with a simple recitation of the putative benefits of reproducibility (I'm well aware) or some wild "what if" scenario relating to my own binaries that will occur once every few centuries on average. I have had multiple real problems in my life where not knowing the exact source checkout and time something was built has been a problem. I've only really once had a problem where I would have felt better if I could have reproduced something exactly, to be sure that the source and random unattributed binary were in fact the same, and even that ended up only as a "I would have felt better." (And now that I think about it, if said unattributed binary had just said what commit it was built out of that would have been fine too....) I am much more interested in solving the problems that actually manifest than problems that someone somewhere hypothesizes I may someday have.
Part of the reason why "reproducibility" has taken so long to appear is precisely that its use cases take a long time and a lot of scale to appear. I approve of distros pursuing this goal, but haven't got a lot of use of it for the stuff I build, which is why I have a very similar build script.
Please don't reply with a simple recitation of the putative benefits of reproducibility (I'm well aware) or some wild "what if" scenario relating to my own binaries that will occur once every few centuries on average. I have had multiple real problems in my life where not knowing the exact source checkout and time something was built has been a problem. I've only really once had a problem where I would have felt better if I could have reproduced something exactly, to be sure that the source and random unattributed binary were in fact the same, and even that ended up only as a "I would have felt better." (And now that I think about it, if said unattributed binary had just said what commit it was built out of that would have been fine too....) I am much more interested in solving the problems that actually manifest than problems that someone somewhere hypothesizes I may someday have.