Grep not actually reproducible on Arch but do we have a bigger issue?

[cen]

Hi,

today I found an interesting case of time based non-reproducibility.

Arch rebuilderd has grep as reproducible: 
https://reproducible.archlinux.org/api/v0/builds/787931/log (build was 
in 2025)

Mine is not: https://rebuilderd.xpam.pl:2096/api/v1/builds/416039/log


Diffoscope shows differences in translations. It seems that translations 
are fetched from a remote location during bootstrap

and it just so happens that remote translations have changed since last 
year and thus introduced a diff.

The obvious fix is that translations should not be dynamically fetched 
but it got me thinking more generally.


Perhaps rebuilderd needs a feature where GOOD packages are also 
periodically rebuilt in exponential back-off style and compared against 
current upstream build and also our last GOOD build. This would confirm 
whether a package is reproducible if built in a short time window but 
also help uncover longer time window issues that are currently hidden.

This won't solve the issue entirely but at least uncover them eventually.

Such edge cases will also cause weird issues like all rebuilders 
agreeing that package is GOOD but repro-treshold failing.

Another feature that might be useful would be to add a list of 
rebuilders repro-treshold style to rebuilderd instance and upon package 
being marked GOOD, daemon could fetch hashes via API from other 
independent instances and if there is a mismatch, flag such packages for 
further inspection. Right now, even if I independently managed to match 
the exact reproducibility % of another rebuilder, I have no idea if the 
package list is the same between instances.


Best regards, cen