“You may remember 2021 announcement that the minimal ISO was 100% reproducible. While back then we successfully tested that all packages that were needed to build the ISO were individually reproducible, actually rebuilding the ISO still introduced differences.”
The 2021 claim of 100% reproducible was true for the parts and false for the whole. This time the ISO matches Hydra’s bit for bit, after manual timestamp and permission hacks for three open bugs. The rebuild started from a 2020 VirtualBox image, so a backdoor there would carry straight through. Verifiable binaries still begin with trusting a binary.