The scope here is much larger as it’s every package in the Debian distro, not just the base system.

and pkgsrc has bulk package builds.

same pkgsrc checkout + reproducable base => essentially reproducable full package builds.

yes, some people will find some niggling way to make this not true because the binaries may be somehow altered due to timestamps, yadda, but for all practical purposes w/r/t the actual code and actual executables generated, this is true, and has been true for essentially the entire existance of bsd derivitaves using ports systems (1996).

> same pkgsrc checkout + reproducable base => essentially reproducable full package builds.

I would be truly surpised if that were the case. Are there no packages in pkgsrc which embed, e.g. timestamps, or even download things while building[1]?

[1] JDK packages are a typical culprit in this type of situation because Oracle JDK requires an "accept license" prompt.

> es, some people will find some niggling way to make this not true because the binaries may be somehow altered due to timestamps, yadda, but for all practical purposes w/r/t the actual code and actual executables generated, this is true, and has been true for essentially the entire existance of bsd derivitaves using ports systems (1996).

Oh, so you're coopting "essentially reproducable" to mean "not reproducible". Ok then.

"Reproducible builds" is about verification and isn't just about "close enough".