reproducible builds

[RoyalOughtness]

https://reproducible-builds.org/docs/
https://reproducible-builds.org/docs/source-date-epoch/

This allows third parties to confirm that software shipped matches the published source code. It also provides improved consistency and reliability guarantees.

[RoyalOughtness]

Step 1 of this is to diff the checksums of the trivalent artifacts, locally-built on the latest tag

vs the checksums of the trivalent artifacts from the latest published rpm. This will let us see if our builds are already reproducible.