So much of this is just normal stuff anyway, right? Signing CI output, tracking dependencies, using bundled resources.. Bit-for-bit reproducible builds are def

So much of this is just normal stuff anyway, right? Signing CI output, tracking dependencies, using bundled resources.. Bit-for-bit reproducible builds are definitely doable, but mean including build dates is tricky, and care needs to be taken with archival file ordering. Is this such a big departure from the norm? Curious what constitutes normal!