<a href="https:&#x2F;&#x2F;reproducible.alioth.debian.org&#x2F;presentations&#x2F;2015-08-13-CCCamp15.pdf" rel="nofollow">https:&#x2F;&#x2F;reproducible.alioth.debian.org&#x2F;presentations&#x2F;2015-08...</a> has some tips on what you can do to ensure your own FOSS packages have reproducible builds, e.g.:
* avoid storing build-timestamps (maybe use timestamp of last commit instead)
* avoid storing build numbers
* LC_ALL=C sort the sets of things where order is undefined&#x2F;unimportant, e.g. file lists going into tar or hash keys
* try building, then changing something in the environment, building again and diffing (with diffoscope)