Reproducible build manual verification setup

.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch

@@ -1,7 +1,22 @@
 diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/cargo/core/compiler/build_runner/compilation_files.rs
 --- a/src/cargo/core/compiler/build_runner/compilation_files.rs
 +++ b/src/cargo/core/compiler/build_runner/compilation_files.rs
-@@ -864,6 +864,12 @@
+@@ -793,6 +793,14 @@
+                 .links_overrides
+                 != unit.links_overrides;
+         target_configs_are_different.hash(&mut shared_hasher);
++    } else if unit.kind.is_host()
++        && bcx.build_config.requested_kinds.iter().any(|kind| {
++            matches!(kind, CompileKind::Target(target) if target.short_name() == "x86_64-unknown-linux-gnu")
++        })
++    {
++        // Reproducible fix: only GNU matches the Linux x86-64 baseline host, not musl.
++        // Change hash input only, not the actual host configuration or compiler flags.
++        false.hash(&mut shared_hasher);
+     }
+
+     let mut c_metadata_hasher = shared_hasher.clone();
+@@ -864,6 +872,12 @@
          for line in bcx.rustc().verbose_version.lines() {
              if unit.kind.is_host() || !line.starts_with("host: ") {
 +                // Normalize hash input only; keep the real host for compilation.
@@ -14,7 +29,7 @@ diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/car
              }
          }
          return;
-@@ -881,3 +887,3 @@
+@@ -881,3 +895,3 @@
      if unit.kind.is_host() {
 -        bcx.rustc().host.hash(hasher);
 +        "x86_64-unknown-linux-gnu".hash(hasher);

.github/workflows/manual_reproducible.yml

@@ -90,9 +90,9 @@ jobs:
           use_cache: "false"
 
       - name: Install cargo-clone
-        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2
-        with:
-          tool: cargo-clone@1.2.4
+        run: |
+          /home/linuxbrew/.linuxbrew/bin/brew install --force-bottle cargo-clone
+          echo "/home/linuxbrew/.linuxbrew/bin" >> "$GITHUB_PATH"
 
       - name: Download tool sources
         run: cargo clone cargo-zigbuild@0.23.2 cargo-auditable@0.7.5 -- freebsd-tool-sources/
@@ -127,9 +127,24 @@ jobs:
       fail-fast: false
       matrix:
         runner: [ubuntu-24.04, ubuntu-24.04-arm]
-        build: &targets
+        build:
           - target: x86_64-unknown-linux-gnu
             zigtargetsuffix: .2.28
+          - target: x86_64-unknown-linux-musl
+            zigtargetsuffix: ""
+          - target: aarch64-unknown-linux-gnu
+            zigtargetsuffix: .2.28
+          - target: aarch64-unknown-linux-musl
+            zigtargetsuffix: ""
+        exclude:
+          - runner: ubuntu-24.04-arm
+            build:
+              target: aarch64-unknown-linux-gnu
+              zigtargetsuffix: .2.28
+          - runner: ubuntu-24.04-arm
+            build:
+              target: aarch64-unknown-linux-musl
+              zigtargetsuffix: ""
     env:
       TARGET: ${{ matrix.build.target }}
       ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
@@ -180,13 +195,18 @@ jobs:
         run: |
           rustc -vV
           cargo -vV
-          cargo zigbuild -vv --locked --release --no-default-features --features from-toml,from-yaml,greppable,from-xml --target "${TARGET}${ZIGTARGETSUFFIX}"
+          cargo auditable zigbuild -vv --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
 
       - name: Create release archive
         run: |
           mkdir -p artifacts
           cp "target/${TARGET}/release/celq" artifacts/celq
-          tar czf artifacts/celq.tar.gz -C "target/${TARGET}/release" celq
+          tar --version
+          gzip --version
+          tar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
+            --owner=0 --group=0 --numeric-owner --mode=0755 \
+            -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
+          gzip -n -9 artifacts/celq.tar
 
       - name: Upload archive and binary
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -206,7 +226,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        build: *targets
+        build:
+          - target: aarch64-unknown-linux-gnu
+            zigtargetsuffix: .2.28
+          - target: aarch64-unknown-linux-musl
+            zigtargetsuffix: ""
     env:
       TARGET: ${{ matrix.build.target }}
       ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
@@ -241,7 +265,7 @@ jobs:
           envs: TARGET ZIGTARGETSUFFIX SOURCE_DATE_EPOCH
           prepare: |
             set -eu
-            pkg install -y ca_root_nss git devel/rustup-init
+            pkg install -y ca_root_nss git devel/rustup-init archivers/gtar archivers/gzip
 
             # Install the official FreeBSD Zig archive directly from ziglang.org.
             cd /tmp
@@ -257,8 +281,11 @@ jobs:
           run: |
             set -eu
             . "$HOME/.cargo/env"
-            install -m 755 freebsd-tools/cargo-zigbuild freebsd-tools/cargo-auditable "$HOME/.cargo/bin/"
-            export PATH="/tmp/zig-x86_64-freebsd-0.15.2:$PATH"
+            install -m 755 freebsd-tools/cargo-zigbuild "$HOME/.cargo/bin/"
+            mkdir -p /home/runner/.cargo/bin
+            install -m 755 freebsd-tools/cargo-auditable /home/runner/.cargo/bin/cargo-auditable
+            export PATH="/home/runner/.cargo/bin:/tmp/zig-x86_64-freebsd-0.15.2:$PATH"
+            test "$(command -v cargo-auditable)" = /home/runner/.cargo/bin/cargo-auditable
             rustup target add --toolchain 1.94.1 "$TARGET"
 
             # Host job environment variables are not inherited by the VM.
@@ -274,11 +301,16 @@ jobs:
             echo "Using patched Cargo: $CARGO"
             rustc -vV
             "$CARGO" -vV
-            "$CARGO" zigbuild -vv --locked --release --no-default-features --features from-toml,from-yaml,greppable,from-xml --target "${TARGET}${ZIGTARGETSUFFIX}"
+            "$CARGO" auditable zigbuild -vv --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
 
             mkdir -p artifacts
             cp "target/${TARGET}/release/celq" artifacts/celq
-            tar czf artifacts/celq.tar.gz -C "target/${TARGET}/release" celq
+            gtar --version
+            /usr/local/bin/gzip --version
+            gtar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
+              --owner=0 --group=0 --numeric-owner --mode=0755 \
+              -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
+            /usr/local/bin/gzip -n -9 artifacts/celq.tar
 
       - name: Upload archive and binary
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -292,16 +324,42 @@ jobs:
           compression-level: 0
 
   hashes:
-    name: Print SHA-256 hashes
+    name: SHA-256 (${{ matrix.pair.target }}, ${{ matrix.original }} vs ${{ matrix.pair.verify }})
     needs: [zigbuild, freebsd]
     if: ${{ !cancelled() }}
     runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        original: [ubuntu-24.04]
+        pair:
+          - target: x86_64-unknown-linux-gnu.2.28
+            verify: ubuntu-24.04-arm
+          - target: x86_64-unknown-linux-musl
+            verify: ubuntu-24.04-arm
+          - target: aarch64-unknown-linux-gnu.2.28
+            verify: freebsd-x86_64
+          - target: aarch64-unknown-linux-musl
+            verify: freebsd-x86_64
     steps:
-      - name: Download all host artifacts
+      - name: Download original artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-${{ matrix.pair.target }}-${{ matrix.original }}
+          path: artifacts/${{ matrix.original }}
+
+      - name: Download verification artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
-          pattern: reproducible-*
-          path: artifacts
+          name: reproducible-${{ matrix.pair.target }}-${{ matrix.pair.verify }}
+          path: artifacts/${{ matrix.pair.verify }}
 
-      - name: Print SHA-256 hashes
-        run: find artifacts -type f -exec sha256sum {} +
+      - name: Print and compare SHA-256 hashes
+        env:
+          ORIGINAL: ${{ matrix.original }}
+          VERIFY: ${{ matrix.pair.verify }}
+        run: |
+          find artifacts -type f -exec sha256sum {} +
+          (cd "artifacts/$ORIGINAL" && sha256sum celq celq.tar.gz) > original.sha256
+          (cd "artifacts/$VERIFY" && sha256sum celq celq.tar.gz) > verification.sha256
+          diff -u original.sha256 verification.sha256