Make builds reproducible

[celskeggs]

This should avoid certain weird edge-case bugs (or at least make them easier to diagnose) and hopefully limit the dependencies on the build environment.

[celskeggs]

There are two elements to this:

• Setting up builds of individual components to produce consistent artifacts.
• Setting up a chroot/container/VM-like system to have a consistent build system.

[celskeggs]

Latter part is pbuilder. Former part is using debian tools and various hacks.

TODO reminder: verify reproducibility across checkouts (for modification times) and machines; make sure verbosity settings are turned down.

[celskeggs]

Current progress is in the try-debian-builds branch.

[celskeggs]

Full completion of this is going to depend on golang/go#16860, especially for kubernetes, which fares the worst with reproducibility.

[celskeggs]

The easy part is completed -- notably, building everything with debian packaging tool in chroots. The hard part is not yet done, but has some work completed towards it.

[celskeggs]

On further reflection, this is not a security issue. It's nice for security to have reproducibility, but it's not a security issue per se.

[cryslith]

Full completion of this is going to depend on golang/go#16860, especially for kubernetes, which fares the worst with reproducibility.

That issue is fixed since Apr 24 of this year, by the way 🎉