feat(aur): compare receipts and replay pinned offline builds

[jdx]

Add aur compare for verified receipt differences and aur rebuild --image for pinned offline replay from retained sources. Receipts record SOURCE_DATE_EPOCH, input modes, and image fingerprints; replay checks the approved commit, sources, dependencies, and selected image before execution, then compares recorded evidence and output hashes.

Image fingerprints hash readable contents and record metadata for private files and special nodes. Results are local reproducibility evidence, not independent attestations. Existing receipts remain readable but require the new evidence to support replay.

Validation: receipt/tampering/fingerprint regression tests and real Arch offline rebuilds with identical outputs. Arch acceptance also exercises receipt-verified dependency artifacts in a disposable image.

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

---

Note

Medium Risk
Changes the AUR build and receipt path (pinned epochs, image hashing, offline replay) where mistaken equality or drift checks could mislead operators, though scope stays local verification rather than signed attestation.

Overview
Adds pacvamp aur compare and pacvamp aur rebuild --image so operators can diff verified build receipts and rerun an offline build from retained sources against a pinned Arch image.

Receipts now record SOURCE_DATE_EPOCH (defaulting to the approved commit time), chroot image fingerprints (image_digest, with runtime mount dirs excluded), and source file modes. Receipt writing refuses if the image changes mid-build. Source inventory comparison includes modes.

Build/replay: BuildOpts carries epoch and image hash; replay() enforces offline receipts (no network build, pinned image/deps), copies retained sources, uses --holdver, and re-checks inputs after verify. rebuild re-approves the recipe, blocks overriding a managed chroot_root, then compares the new artifact to the reference. Non-captured makepkg stdout goes to stderr for live builds.

Docs, CLI usage, regression/e2e tests (including Arch container offline rebuild and dependency-artifact isolation) are updated accordingly. Outcomes are framed as local comparison, not independent reproducibility attestation.

^{Reviewed by Cursor Bugbot for commit 5d6a4b3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Warning

Review limit reached

Next included review available in 24 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Team

Run ID: 2223122d-27d7-49e6-b9b9-7fdde0414e91

📥 Commits

Reviewing files that changed from the base of the PR and between 86f90c2 and 5d6a4b3.

📒 Files selected for processing (13)

• PLAN.md
• crates/pacvamp/src/aur/build.rs
• crates/pacvamp/src/aur/receipt.rs
• crates/pacvamp/src/cli/aur_cmd.rs
• crates/pacvamp/src/manifest/settings.rs
• crates/pacvamp/tests/aur_build.rs
• docs/build-receipts.md
• docs/cli/pacvamp.usage.kdl
• docs/cli/pacvamp/aur.md
• docs/cli/pacvamp/aur/compare.md
• docs/cli/pacvamp/aur/rebuild.md
• docs/cli/pacvamp/index.md
• e2e/test_arch_container

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5915c22. Configure here.}