3.0.6: libzest.so is not reproducible

[dvzrv]

Hi! I've built 3.0.6 for zynaddsubfx 3.0.6 on Arch Linux. You can find the current PKGBUILD and all patches here: https://github.com/archlinux/svntogit-community/tree/packages/zynaddsubfx/trunk

Unfortunately the built libzest.so is not (bit-for-bit) reproducible, although all sources are pinned. I assume, that this is due to some code rendering parts of the output binary in a random order.

You can find the diffoscope output here: zynaddsubfx-3.0.6-diffoscope.log

[fundamental]

I'd suspect the problem is either in the guts of mruby or it's this line needing a sort statement https://github.com/mruby-zest/mruby-zest-build/blob/master/Makefile#L16

[dvzrv]

If I understand that call in the Makefile correctly, then it can be replaced by

find mruby/build/host -type f \( -not -iwholename "*mrbc*" -a -not -iwholename "*bin*" -a -iname "*.o" \)

[dvzrv]

I can provide a PR to change that later, but it unfortunately does not repair the issues with reproducibility and even has the diffoscope log grow by 40Mb. I also removed the duplicate inclusion of ./deps/libnanovg.a there and wonder whether that has been there intentionally or not.

[fundamental]

If it doesn't fix the issue, then I wouldn't suggest a PR. If that doesn't resolve it, then I suspect it's something inside the innards of mruby's build system. There's a variety of steps and without a fair amount of work breaking it down into smaller pieces I can't say for certain the source of the problem. Off the top of my head there's VM codegen, there's a variety of symbol collection passes, there's some autotools configuration in the regular expression gem, and a few other elements. Things are being run serially, so I would have thought it would have worked for reproducible builds, but I guess that isn't the case.