Nearly reproducible Bookworm 12.6 live images

[James Addison]

Hi Roland!

This sounds great - I have one specific question / concern:

On Wed, 3 Jul 2024 at 17:44, Roland Clobus <rclobus at rclobus.nl> wrote:
> [ ... snip ... ]
> live-setup uses a local cache of the git repository of live-build, to
> avoid being blocklisted by salsa for heavy traffic, caused by parallel
> builds.
> This local cache brings that this file could have an old timestamp,
> whereas my local builds always used 'now' (caused by git clone), which
> would be properly truncated to SOURCE_DATE_EPOCH, and therefore be
> reproducible.

Limiting the timestamp to a maximum of SOURCE_DATE_EPOCH makes sense so that
the modification-time is consistent for equivalent rebuilds.

However: if the contents of the txt file / other content in the git repository
change, would that prevent an independent rebuilder from recreating the
identical CD image as output?

(note: given that the package archive is regularly updated, I think that there
are other reasons why an identical point-in-time rebuild may require sharing
of some build-time/archive metadata -- the reason I'm asking is that I'd like
to check whether this git repo could require similar co-ordination during
rebuilds.  fixed commit ID / signed tag, or other mechanism for example)

Regards,
James