This month, I declared https://en.opensuse.org/openSUSE:Reproducible_openSUSE/Part1 - the Minimal part of the R-B-OS (sponsored by the NLNet foundation) completed (minus the VM image) and am pretty close to complete https://en.opensuse.org/openSUSE:Reproducible_openSUSE/Part2 (not fully satisfied with the VM image, but that was out of scope here anyway)

I started to use
https://build.opensuse.org/package/show/home:rb-checker/notes
for online note-taking about found issues
and my rb-checker bot now checks all submissions that go to Factory through "adi" staging projects.
This already found the first regression.

And I sent many nice patches, including 3 toolchain patches that fix multiple packages:
* https://build.opensuse.org/request/show/1230042 scons
* https://build.opensuse.org/request/show/1233216 cargo-packaging
* https://github.com/openSUSE/hpc/pull/12 suse-hpc

I also did two more test runs over the ring1 packages and found two new surprising classes of issues that broke reproducibility.

1. .changes file entries with certain timezones (WEST, IST, UCT) were mis-parsed by osc build on one machine. Replacing these with UTC was easy enough.
2. packages such as atftp, ppp, texlive and sendmail use the new system-user-foo packages, but their user-id differed between OBS and local (no-preinstallimage) builds and was embedded into cpio headers. Maybe it was already fixed in sysuser-tools after my fork?

While investigating an issue with r-b, I also stumbled across a silent data corruption:
https://bugzilla.opensuse.org/show_bug.cgi?id=1234897
This is far from the first. And it shows once again, that r-b is not only good for security, but also for quality.