Disable dnstap in reproducible-build CI job

Commit 515ff3763c ("Simplify reproducible-build CI job") dropped the
-Ddnstap=disabled option from the "meson reprotest" invocation, which
re-introduced a known reproducibility failure:

    Build differences detected
    File contents differ: buildrepro/libdnstap.a

The job builds with CFLAGS=${CFLAGS_COMMON}, which enables LTO with
-ffat-lto-objects. Fat LTO objects embed GIMPLE bytecode keyed by a
per-compilation random LTO hash, so they are not reproducible run to
run. libdnstap.a is the only static archive in the build, and meson
treats every .a as a final, checked artifact, so the two reprotest
builds disagree on its contents. The shared libraries are unaffected
because final LTO linking re-emits and strips the bytecode.

Restore the -Ddnstap=disabled workaround, along with a comment
explaining the instability. The unrelated -Ddoc=disabled and
-Doptimization=1 options are left dropped, as they were only build-time
speedups and not related to reproducibility.

Assisted-by: Claude:claude-opus-4-8

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 08d2ca20817caf26f83d384bf89dc71c01d3d705..2bdfd26f11083aeb70cc20463540ac1c19e7e4be 100644 (file)
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -988,7 +988,12 @@ reproducible-build:
   before_script:
     - *list_installed_package_versions
   script:
-    - meson reprotest
+    # dnstap produces an intermediate .a file, and meson considers all .a
+    # files to be final results independently of whether they are installed
+    # or not. But the content of the .a file is unstable under LTO because
+    # -ffat-lto-objects embeds non-deterministic GIMPLE bytecode. Hence we
+    # disable dnstap for reproducibility tests.
+    - meson reprotest -- -Ddnstap=disabled
   artifacts:
     untracked: true
     when: on_failure