Why reproducible builds are important is explained at reproducible-builds.org:
Whilst anyone may inspect the source code of free and open source software for malicious flaws, most software is distributed pre-compiled with no method to confirm whether they correspond.
This incentivises attacks on developers who release software, not only via traditional exploitation, but also in the forms of political influence, blackmail or even threats of violence.
According to isdebianreproducibleyet.com Debian is currently only 94.7% reproducible.
Packages in buster/amd64 which failed to build reproducibly are listed here.
Is there a simple and fast way to list all unreproducible packaged installed on the system?
I'm thinking of something like
debsecan | grep "remotely exploitable" for identifying installed packages with vulnerabilities or
vrms for making sure no packages which aren't free, open source software are installed. Does such a tool or script exist?