Building from a different directory results in a different build id
embedded in /usr/bin/aribas:

https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/aribas.html

  Build·ID:·7652115b45271e393b31873efede354e1cb36769
  vs.
  Build·ID:·49cfcb42aa13407e5d7e5ce6e50352610d448a78

The attached patch to the upstream src/Makefile fixes this by adding the
-ffile-prefix-map argument in CFLAGS, removing the build path before the
buildid is calculated.

According to my local tests, with this patch applied aribas should build
reproducibly on tests.reproducible-builds.org!

Thanks for maintaining aribas!

live well,
  vagrant

Dear Maintainer,

Because Debian builds packages from a fixed build path, neither the 'reprotest'
utility in Salsa-CI, nor the Reproducible Builds team's package test
infrastructure for Debian[1] currently check for equivalent binary package
output from differing source package build paths.

This means that your package will pass current reproducibility tests; however
we believe that source code and/or build steps still embed the build path into
the binary package output, making it more difficult than necessary for
independent consumers to check the integrity of binary packages by recompiling
them themselves.

As a result, this bugreport will remain open and be re-assigned the 'wishlist'
severity[2].

For more information about build paths and how they can affect reproducibility,
please refer to: https://reproducible-builds.org/docs/build-path/

Thanks,
James

[1] - https://tests.reproducible-builds.org/debian/reproducible.html

[2] - https://www.debian.org/Bugs/Developer#severities

A correction for a mistake in my previous message:

Currently the 'reprotest' job in Salsa-CI does in fact continue to exercise
variations of the build-path, and will fail if it builds binary packages that
contain different contents as a result.