The build path and resulting Build ID for various libraries is embedded:

https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/libao.html

  /usr/lib/x86_64-linux-gnu/ao/plugins-4/libalsa.so

  /build/1st/libao-1.2.2+20180113/src/plugins/alsa/ao_alsa.c:301
  vs.
  /build/2/libao-1.2.2+20180113/2nd/src/plugins/alsa/ao_alsa.c:30


The attached patch to debian/rules fixes this by passing
-ffile-prefix-map via CFLAGS in the dh_auto_configure override.


Alternately, updating to use the CFLAGS passed via dh/debhelper would
also likely fix this.


With this patch applied libao should build reproducibly on
tests.reproducible-builds.org!


live well,
  vagrant

Dear Maintainer,

Currently, Debian's buildd and also the Reproducible Builds team's testing
infrastructure[1] both use a fixed build path when building binary packages.

This means that your package will pass current reproducibility tests; however
we believe that varying the build path still produces undesirable changes in
the binary package output, making it more difficult than necessary for
independent consumers to check the integrity of those packages by rebuilding
them themselves.

As a result, this bugreport will remain open and be re-assigned the 'wishlist'
severity[2].

You can use the 'reprotest' package build utility - either locally, or as
provided in Debian's Salsa continuous integration pipelines - to assist
uncovering reproducibility failures due build-path variance.

For more information about build paths and how they can affect reproducibility,
please refer to: https://reproducible-builds.org/docs/build-path/

Thanks,
James

[1] - https://tests.reproducible-builds.org/debian/reproducible.html

[2] - https://www.debian.org/Bugs/Developer#severities

Hi Ron and John,

I noticed that you recently pushed a commit to add Vcs fields to the Git
repository on Salsa[1].  This is really helpful.

Since past NMUs hadn't been imported yet, I've taken the liberty to do
so in a fork of your repository[2].  While working on it, I also fixed
three of the open bugs.

Additionally, I updated the packaging to current standards and resolved
all Lintian warnings in the process.

As MRs aren't enabled on your repository, I'm reaching out via email.
Please let me know if you'd like to integrate these changes-I'd be happy
to hand them over or help with merging.

If I don't hear back within the next 30 days, I plan to upload the
updated package as an NMU to address the RC bug.

Kind regards
    Andreas.

PS: This package was highlighted in the Bug of the Day[3] initiative, which
    aims to introduce newcomers to manageable tasks and guide them through
    the workflow to solve them.

[1] https://salsa.debian.org/ron/libao
[2] https://salsa.debian.org/tille/libao
[3] https://salsa.debian.org/qa/tiny_qa_tools/-/wikis/Tiny-QA-tasks

Hi Ron,

as I announced previously I habe NMUed libao to delayed=10.  I would
have created a MR if your repository would permit this.  You can find
all changes as uploaded at

https://salsa.debian.org/tille/libao/

Please let me know if I should cancel the upload.

Kind regards
    Andreas.

We believe that the bug you reported is fixed in the latest version of
libao, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1006858@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andreas Tille <tille@debian.org> (supplier of updated libao package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 15 Jul 2026 15:50:33 +0200
Source: libao
Architecture: source
Version: 1.2.2+20180113-1.4
Distribution: unstable
Urgency: medium
Maintainer: Ron Lee <ron@debian.org>
Changed-By: Andreas Tille <tille@debian.org>
Closes: 911232 1006858 1089839 1124864 1142115
Changes:
 libao (1.2.2+20180113-1.4) unstable; urgency=medium
 .
   * Non-maintainer upload.
 .
   [ Andreas Tille ]
   * Maintain package in Debian team on Salsa
     Closes: #1142115
   * Suggest libsndio7.0 instead of libsndio6.1
     Closes: #911232
   * d/watch: version=5
   * d/copyright:
      - DEP5
      - Add missing src/plugins/sndio/ao_sndio.c
   * d/rules: hardening
   * Refer to specific version of license GPL-2+.
   * Remove redundant Priority: optional from source stanza.
   * Trim trailing whitespace.
   * Use secure URI in Homepage field.
   * Standards-Version: 4.7.4
   * Add debian/lrc.config
 .
   [ Vagrant Cascadian ]
   * reproducible-builds: Do not embed build path into libraries
     Closes: #1006858
 .
   [ Alessandro Astone ]
   * debian: adapt to compatibility level 13 and use autoreconf template.
   * debian/libao.conf: Set the default output to pulseaudio (LP: #1075479)
     Closes: #1089839, #1124864
Checksums-Sha1:
 d6780a76c718881854b000ef4854febebb90de25 2100 libao_1.2.2+20180113-1.4.dsc
 3fb5d51b31794240f8a73811974bf4f1eba94ecf 7888 libao_1.2.2+20180113-1.4.debian.tar.xz
 5cce76c6dc152dd278bcbafd612e1d95066791c3 8860 libao_1.2.2+20180113-1.4_amd64.buildinfo
Checksums-Sha256:
 63bb49a6dacc8a4c560e62a4d794f0647fdddbcd17bdc9fb16f49ccb72d8f915 2100 libao_1.2.2+20180113-1.4.dsc
 103385becbc6abb68d3815ab11c52c46111e5f531695550b1c014d760807a712 7888 libao_1.2.2+20180113-1.4.debian.tar.xz
 0790c64a98419357f7b34a4c11b528edcc88eb9c03f9beb6bc806f2fa613d5f0 8860 libao_1.2.2+20180113-1.4_amd64.buildinfo
Files:
 d29eb175f2b381baf130a816487c6fe3 2100 libs optional libao_1.2.2+20180113-1.4.dsc
 6b6749630b4726df3dc26120002f173f 7888 libs optional libao_1.2.2+20180113-1.4.debian.tar.xz
 e35445b7d3468e54741298e6689068b4 8860 libs optional libao_1.2.2+20180113-1.4_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEE8fAHMgoDVUHwpmPKV4oElNHGRtEFAmpXkTQRHHRpbGxlQGRl
Ymlhbi5vcmcACgkQV4oElNHGRtGZlg/9FQ2+SHqIvn2Nb18f7Vp/u12cDXFu9Bh7
111M2sMZ/ZD8tSBpA2N72M8VztK6TR/V74jCXvy2/It+Nott0xpHoxBN2+DnV7R5
Eoaxw5SeKUf7E3sUytvivBC47ISPlvVn6l2fdgYRRrUqle9PqiKzJ7jQ6Dz4kQJP
W2Zf1nICthKpl/F86bYPghRvmG7rZdjnFFj6dpfqYk3xNPy1tg9MbdCnQcRJvya5
AHEMGYWC09apW54GvGswqg/PdStImyuz0tOHrmnc0vBHq+Tz+oiUOCleidgbR6dN
kSpxFfbE1tL4I/lCUxTlwsa/QUQ5YpoS9Yd2tabi8ALyWcCE2X9P96+5jYH6Opd8
D9/7e2XiDu9iE5W69yBOSQKjndPY/HIaqAuC5zC6GfuTr7lWk9bQYaHZzPWC6JQ3
y8RU5b6rRBKj3PBbXtVjJF+kYNx68XkWtqrH84BkMLzKxHvcEpXC4/iJG6bsFzCz
9obvx51KW5OVmAY5HKG9Nhwz6ClK+QVRl+bX3bEZC7mywTG8XIJBIoUobGJXNhwM
zIl70hvCpx/tEU25X9CbyriD3pzHshu3zFUBCz41r8AvDFt5CqczIq4MjFau6ILK
OuX5coml8ahM0C7BV2BLqU3crJImm3LH5/BHhWtfWNjD9SK5qdSMUtonFg9m4PrB
rij85Jw4mWQ=
=Ps4L
-----END PGP SIGNATURE-----