@SylvieLorxu @IzzyOnDroid
Yes, there is plenty of low hanging fruit like embedded timestamps or nondeterministic ordering. Many apps are already easily reproducible or require only small fixes.
But the ecosystem is constantly moving: old toolchain and dependency bugs get fixed, but new ones keep popping up.
Reproducible Builds are not just an item on a checklist, something you (ask upstreams to) enable and then you're done. Especially when it's a hard requirement like at F-Droid where new builds no longer being reproducible means users will not be able to get updates.
It's an ongoing process involving not just upstream app developers, but also maintainers of repositories, clients, and rebuilders; those involved in outreach and writing documentation; developers and maintainers of tooling, toolchains, and dependencies. And often requires a lot of collaborative debugging :)
It requires teamwork and an ongoing commitment to investigate and fix new issues when they pop up.
#ReproducibleBuilds