Rust compiler source tarballs are now reproducible

In light of the recent xz backdoor fiasco, it might be a good idea to start thinking more about the reproducibility of published source code (and binaries). As a small step in this direction, the Rust compiler/toolchain source tarballs, which are being released for each stable/beta/nightly version, and which are used e.g. by distro maintainers to build their own instance of the Rust toolchain, should now be reproducible (https://github.com/rust-lang/rust/pull/123246).

This means that you can now locally clone the Rust repository, and run a command to generate the source tarball from a given git tag (guide here). You can then easily check if the generated archive exactly matches the source tarball archive that is published on the Rust CDN. Note that this will only start working from today's nightly, and for future (stable) Rust releases.

It's a very small step, but in theory, if distro maintainers checked the checksum of the tarballs in an automated fashion, it could help detect if something like the xz backdoor was attempted against Rust compiler source tarballs (i.e. if someone modified the distributed source archives and thus published something different than what we have in the Rust compiler git repository). It would be cool if something like this was also done automatically for Rust crates on crates.io, there is some ongoing discussion on that.

A follow-up, much harder, step, is to make sure that the binary artifacts themselves are also reproducible. We have some ideas for that, but that will probably take a lot of work and time to achieve.