trying to reproduce hello-traditional from Debian. .buildinfo file? next steps?

[Carles Pina i Estany]

Hi,

This is Debian specific but I cannot find a reproducible builds Debian
specific mailing list. Let me know if I should ask elsewhere. Feel free
to send me some pointers to read it myself.

TL;DR: I'm trying to build hello-traditional from Debian and have the
same result as Debian. I cannot do it. Pointers welcome. I thought of
using the .buildinfo file to reproduce the build environment and deps
but unsure of the best way and if this is the way.

I'm trying to reproduce the build of the package hello-traditional. I
understand from here:
https://tests.reproducible-builds.org/debian/rb-pkg/bookworm/amd64/hello-traditional.html

That should be reproducible.

I've done:
$ sbuild --no-clean --arch-any --arch-all --no-source --dist=stable --arch=amd64 http://deb.debian.org/debian/pool/main/h/hello-traditional/hello-traditional_2.10-6.dsc

Multiple times in two Debian systems (Debian 12.1 and 11.7, I know that
should only depend on the schroot...) and every time I get:

f712bac966e8fc2d1660bc5d61328a8e9f8354a93c119bb2137169dbdaeb22ab  hello-traditional_2.10-6_amd64.deb

But the package that I can retrieve from Debian has a different sha256:
$ curl -s http://ftp.de.debian.org/debian/pool/main/h/hello-traditional/hello-traditional_2.10-6_amd64.deb | sha256sum
e39004ec8c3309f909d5442596f9fc442082cd8e28f03e7c438a65fb5bfd9956  -

Using diffoscope (and simplifiying):

│ --rw-r--r--   0        0        0    54696 2022-12-15 22:15:00.000000 data.tar.xz
│ +-rw-r--r--   0        0        0    54692 2022-12-15 22:15:00.000000 data.tar.xz

│ │ │ │  Displaying notes found in: .note.gnu.build-id
│ │ │ │    Owner                Data size 	Description
│ │ │ │ -  GNU                  0x00000014	NT_GNU_BUILD_ID (unique build ID bitstring)	    Build ID: 4d6c09356ebc6db48e5f0599f4f78fa8fd67537f
│ │ │ │ +  GNU                  0x00000014	NT_GNU_BUILD_ID (unique build ID bitstring)	    Build ID: 50fa36df8334f86225be85b4992368fe96f907b6

And my question is: how to achieve the same Build ID?

I thought of using the .buildinfo file from:
https://tests.reproducible-builds.org/debian/buildinfo/bookworm/amd64/hello-traditional_2.10-6_amd64.buildinfo

But I'm not sure what is the best way (besides installing the same exact
packages in the schroot and setting the Environment) to do it. And I'm
not sure that this is the way to go anyway, tool that might exist, etc.

Thanks for any help (links to read welcome as well!).

-- 
Carles Pina i Estany
https://carles.pina.cat || Wiktionary translations: https://kamus.pina.cat