Grep not actually reproducible on Arch but do we have a bigger issue?

[cen]

On 01/05/2026 23:56, cen wrote:
> Another feature that might be useful would be to add a list of 
> rebuilders repro-treshold style to rebuilderd instance and upon 
> package being marked GOOD, daemon could fetch hashes via API from 
> other independent instances and if there is a mismatch, flag such 
> packages for further inspection. Right now, even if I independently 
> managed to match the exact reproducibility % of another rebuilder, I 
> have no idea if the package list is the same between instances. 

Follow up, I hacked together this feature over the weekend as a 
scheduled task and storing results in a new table.


Arch results: 
https://rebuilderd.xpam.pl:2096/?distro=archlinux&release=&arch=x86_64&status=GOOD&has_disagreement=true&peer=reproducible.archlinux.org%2Creproducible.crypto-lab.ch

Debian results: 
https://rebuilderd.xpam.pl:2096/?distro=debian&release=sid&arch=amd64&status=GOOD&has_disagreement=true&peer=reproduce.debian.net


I have 29 more good packages on Arch and 36 on Debian.

The reverse, locally-bad-upstream good are much more but most of those 
are likely infra related issues I still need to go through on my end.


- "Show peer disagreements" checkbox lists packages where my rebuilderd 
disagrees with any of the peers

- Individual peers can be toggled on/off

- Clicking on the package name shows you remote peer status and direct 
remote log links for inspection.


Initially I also fetched all hashes via attestations to try and see if 
there is a wild existence of good-good-different-hash in the wild but 
found none, so I removed it.



Best regards