From 5278297167a720cdd45254041fad7f2fa4b454e1 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Mon, 7 Sep 2026 17:49:10 -0400
Subject: [PATCH 01/34] Use cargo patch for host as well. Benchmark patched vs
 unpatched

---
 .github/workflows/manual_reproducible.yml | 70 ++++++++++++++++++++---
 1 file changed, 61 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index f4d363d..b4b5cc5 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -16,7 +16,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: [aarch64-unknown-linux-gnu, x86_64-unknown-freebsd]
+        target: [x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, x86_64-unknown-freebsd]
     env:
       TARGET: ${{ matrix.target }}
     steps:
@@ -90,9 +90,9 @@ jobs:
           use_cache: "false"
 
       - name: Install cargo-clone
-        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2
-        with:
-          tool: cargo-clone@1.2.4
+        run: |
+          /home/linuxbrew/.linuxbrew/bin/brew install --force-bottle cargo-clone
+          echo "/home/linuxbrew/.linuxbrew/bin" >> "$GITHUB_PATH"
 
       - name: Download tool sources
         run: cargo clone cargo-zigbuild@0.23.2 cargo-auditable@0.7.5 -- freebsd-tool-sources/
@@ -141,10 +141,9 @@ jobs:
           persist-credentials: false
 
       - name: Download patched Cargo
-        if: matrix.runner == 'ubuntu-24.04-arm'
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
-          name: patched-cargo-aarch64-unknown-linux-gnu
+          name: patched-cargo-${{ matrix.runner == 'ubuntu-24.04-arm' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu' }}
           path: patched-cargo
 
       - name: Setup Zigbuild
@@ -156,14 +155,12 @@ jobs:
           use_cache: "false"
 
       - name: Select patched Cargo
-        if: matrix.runner == 'ubuntu-24.04-arm'
         run: |
           chmod +x "$GITHUB_WORKSPACE/patched-cargo/cargo"
           echo "$GITHUB_WORKSPACE/patched-cargo" >> "$GITHUB_PATH"
           echo "CARGO=$GITHUB_WORKSPACE/patched-cargo/cargo" >> "$GITHUB_ENV"
 
       - name: Verify patched Cargo selection
-        if: matrix.runner == 'ubuntu-24.04-arm'
         run: |
           test "$(command -v cargo)" = "$CARGO"
           echo "Using patched Cargo: $CARGO"
@@ -199,6 +196,61 @@ jobs:
           if-no-files-found: error
           compression-level: 0
 
+  zigbuild_unpatched:
+    name: Zigbuild unpatched (ubuntu-24.04, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        build: *targets
+    env:
+      TARGET: ${{ matrix.build.target }}
+      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Setup Zigbuild
+        uses: $/.github/actions/setup-zigbuild
+        with:
+          target: ${{ matrix.build.target }}
+          rust_components: rust-src
+          install_target: "true"
+          use_cache: "false"
+
+      - name: Configure reproducible builds
+        run: |
+          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
+          echo "TZ=UTC" >> "$GITHUB_ENV"
+          echo "LC_ALL=C" >> "$GITHUB_ENV"
+          RUST_SYSROOT=$(rustc --print sysroot)
+          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
+
+      - name: Build with Zig
+        run: |
+          rustc -vV
+          cargo -vV
+          cargo zigbuild -vv --locked --release --no-default-features --features from-toml,from-yaml,greppable,from-xml --target "${TARGET}${ZIGTARGETSUFFIX}"
+
+      - name: Create release archive
+        run: |
+          mkdir -p artifacts
+          cp "target/${TARGET}/release/celq" artifacts/celq
+          tar czf artifacts/celq.tar.gz -C "target/${TARGET}/release" celq
+
+      - name: Upload archive and binary
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-ubuntu-24.04-unpatched
+          retention-days: 1
+          path: |
+            artifacts/celq
+            artifacts/celq.tar.gz
+          if-no-files-found: error
+          compression-level: 0
+
   freebsd:
     name: Zigbuild (FreeBSD x86-64, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
     needs: [patched_cargo, freebsd_tools]
@@ -293,7 +345,7 @@ jobs:
 
   hashes:
     name: Print SHA-256 hashes
-    needs: [zigbuild, freebsd]
+    needs: [zigbuild, zigbuild_unpatched, freebsd]
     if: ${{ !cancelled() }}
     runs-on: ubuntu-24.04
     steps:

From aa26be6a8d85600fe3a8988f96af1619e756b461 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Mon, 7 Sep 2026 18:06:16 -0400
Subject: [PATCH 02/34] Add extra logs to cargo patch

---
 .../patches/cargo-linux-x86_64-metadata.patch | 140 +++++++++++++++++-
 1 file changed, 138 insertions(+), 2 deletions(-)

diff --git a/.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch b/.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
index 1cfd001..29f2d37 100644
--- a/.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
+++ b/.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
@@ -1,7 +1,138 @@
 diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/cargo/core/compiler/build_runner/compilation_files.rs
 --- a/src/cargo/core/compiler/build_runner/compilation_files.rs
 +++ b/src/cargo/core/compiler/build_runner/compilation_files.rs
-@@ -864,6 +864,12 @@
+@@ -688,6 +688,15 @@ fn metadata_of<'a>(
+     &metas[unit]
+ }
+
++fn trace_metadata(unit: &Unit, stage: &str, hasher: &StableHasher, input: impl fmt::Debug) {
++    if unit.pkg.name().as_str() == "unicode-ident" {
++        eprintln!(
++            "cargo-metadata-trace: crate={} kind={:?} stage={} hash={:016x} input={:?}",
++            unit.pkg.name(), unit.kind, stage, Hasher::finish(hasher), input,
++        );
++    }
++}
++
+ /// Computes the metadata hash for the given [`Unit`].
+ fn compute_metadata(
+     unit: &Unit,
+@@ -706,6 +715,7 @@ fn compute_metadata(
+     let mut shared_hasher = StableHasher::new();
+
+     METADATA_VERSION.hash(&mut shared_hasher);
++    trace_metadata(unit, "metadata-version", &shared_hasher, &METADATA_VERSION);
+
+     let ws_root = if unit.is_std {
+         // SourceId for stdlib crates is an absolute path inside the sysroot.
+@@ -722,17 +732,22 @@ fn compute_metadata(
+         .package_id()
+         .stable_hash(ws_root)
+         .hash(&mut shared_hasher);
++    trace_metadata(unit, "package", &shared_hasher, (unit.pkg.package_id(), ws_root));
+
+     // Also mix in enabled features to our metadata. This'll ensure that
+     // when changing feature sets each lib is separately cached.
+     unit.features.hash(&mut shared_hasher);
++    trace_metadata(unit, "features", &shared_hasher, &unit.features);
+
+     // Throw in the profile we're compiling with. This helps caching
+     // `panic=abort` and `panic=unwind` artifacts, additionally with various
+     // settings like debuginfo and whatnot.
+     unit.profile.hash(&mut shared_hasher);
++    trace_metadata(unit, "profile", &shared_hasher, &unit.profile);
+     unit.mode.hash(&mut shared_hasher);
++    trace_metadata(unit, "mode", &shared_hasher, &unit.mode);
+     build_runner.lto[unit].hash(&mut shared_hasher);
++    trace_metadata(unit, "lto", &shared_hasher, &build_runner.lto[unit]);
+
+     // Artifacts compiled for the host should have a different
+     // metadata piece than those compiled for the target, so make sure
+@@ -740,13 +755,17 @@ fn compute_metadata(
+     // so that the StableHash doesn't change based on the pathnames
+     // of the custom target JSON spec files.
+     unit.kind.fingerprint_hash().hash(&mut shared_hasher);
++    trace_metadata(unit, "compile-kind", &shared_hasher, &unit.kind.fingerprint_hash());
+
+     // Finally throw in the target name/kind. This ensures that concurrent
+     // compiles of targets in the same crate don't collide.
+     unit.target.name().hash(&mut shared_hasher);
++    trace_metadata(unit, "target-name", &shared_hasher, &unit.target.name());
+     unit.target.kind().hash(&mut shared_hasher);
++    trace_metadata(unit, "target-kind", &shared_hasher, &unit.target.kind());
+
+     hash_rustc_version(bcx, &mut shared_hasher, unit);
++    trace_metadata(unit, "rustc-version-complete", &shared_hasher, &bcx.rustc().version);
+
+     if build_runner.bcx.ws.is_member(&unit.pkg) {
+         // This is primarily here for clippy. This ensures that the clippy
+@@ -756,6 +775,11 @@ fn compute_metadata(
+         }
+     }
+
++    trace_metadata(
++        unit, "workspace-wrapper", &shared_hasher,
++        (bcx.ws.is_member(&unit.pkg), &bcx.rustc().workspace_wrapper),
++    );
++
+     // Seed the contents of `__CARGO_DEFAULT_LIB_METADATA` to the hasher if present.
+     // This should be the release channel, to get a different hash for each channel.
+     if let Ok(ref channel) = build_runner
+@@ -764,8 +788,14 @@ fn compute_metadata(
+         .get_env("__CARGO_DEFAULT_LIB_METADATA")
+     {
+         channel.hash(&mut shared_hasher);
++        trace_metadata(unit, "channel-seed", &shared_hasher, channel);
+     }
+
++    trace_metadata(
++        unit, "channel-seed-complete", &shared_hasher,
++        bcx.gctx.get_env("__CARGO_DEFAULT_LIB_METADATA").ok(),
++    );
++
+     // std units need to be kept separate from user dependencies. std crates
+     // are differentiated in the Unit with `is_std` (for things like
+     // `-Zforce-unstable-if-unmarked`), so they are always built separately.
+@@ -774,6 +804,7 @@ fn compute_metadata(
+     // `is_std` to false for build dependencies so that they can be shared
+     // with user dependencies.
+     unit.is_std.hash(&mut shared_hasher);
++    trace_metadata(unit, "is-std", &shared_hasher, &unit.is_std);
+
+     // While we don't hash RUSTFLAGS because it may contain absolute paths that
+     // hurts reproducibility, we track whether a unit's RUSTFLAGS is from host
+@@ -793,8 +824,13 @@ fn compute_metadata(
+                 .links_overrides
+                 != unit.links_overrides;
+         target_configs_are_different.hash(&mut shared_hasher);
++        trace_metadata(unit, "host-config-discriminator", &shared_hasher, target_configs_are_different);
+     }
+
++    trace_metadata(
++        unit, "shared-complete", &shared_hasher,
++        (bcx.gctx.target_applies_to_host().ok(), &unit.rustflags, &unit.rustdocflags),
++    );
+     let mut c_metadata_hasher = shared_hasher.clone();
+     // Mix in the target-metadata of all the dependencies of this target.
+     let mut dep_c_metadata_hashes = deps_metadata
+@@ -803,6 +839,7 @@ fn compute_metadata(
+         .collect::<Vec<_>>();
+     dep_c_metadata_hashes.sort();
+     dep_c_metadata_hashes.hash(&mut c_metadata_hasher);
++    trace_metadata(unit, "dependencies-final-metadata", &c_metadata_hasher, &dep_c_metadata_hashes);
+
+     let mut unit_id_hasher = shared_hasher.clone();
+     // Mix in the target-metadata of all the dependencies of this target.
+@@ -854,6 +891,7 @@ fn has_remap_path_prefix(args: &[String]) -> bool {
+
+ /// Hash the version of rustc being used during the build process.
+ fn hash_rustc_version(bcx: &BuildContext<'_, '_>, hasher: &mut StableHasher, unit: &Unit) {
++    trace_metadata(unit, "rustc-version-raw", hasher, &bcx.rustc().verbose_version);
+     let vers = &bcx.rustc().version;
+     if vers.pre.is_empty() || bcx.gctx.cli_unstable().separate_nightlies {
+         // For stable, keep the artifacts separate. This helps if someone is
+@@ -863,7 +901,14 @@ fn hash_rustc_version(bcx: &BuildContext<'_, '_>, hasher: &mut StableHasher, uni
+         // regardless of the host.
          for line in bcx.rustc().verbose_version.lines() {
              if unit.kind.is_host() || !line.starts_with("host: ") {
 +                // Normalize hash input only; keep the real host for compilation.
@@ -11,11 +142,16 @@ diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/car
 +                    line
 +                };
                  line.hash(hasher);
++                trace_metadata(unit, "rustc-version-line", hasher, line);
              }
          }
          return;
-@@ -881,3 +887,3 @@
+@@ -879,7 +924,7 @@ fn hash_rustc_version(bcx: &BuildContext<'_, '_>, hasher: &mut StableHasher, uni
+     // targets, (like gnu vs musl or gnu vs msvc). In the future, we may want
+     // to consider hashing `unit.kind.short_name()` instead.
      if unit.kind.is_host() {
 -        bcx.rustc().host.hash(hasher);
 +        "x86_64-unknown-linux-gnu".hash(hasher);
      }
+     // None of the other lines are important. Currently they are:
+     // binary: rustc  <-- or "rustdoc"

From d86bad9364a5d92afcb2040f05aa6e9a19a38fa9 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Mon, 7 Sep 2026 18:25:14 -0400
Subject: [PATCH 03/34] Fix for cargo-reproducibility

---
 .../patches/cargo-linux-x86_64-metadata.patch     | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch b/.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
index 29f2d37..8e0e87b 100644
--- a/.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
+++ b/.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
@@ -101,11 +101,16 @@ diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/car
 
      // While we don't hash RUSTFLAGS because it may contain absolute paths that
      // hurts reproducibility, we track whether a unit's RUSTFLAGS is from host
-@@ -793,8 +824,13 @@ fn compute_metadata(
+@@ -793,8 +824,18 @@ fn compute_metadata(
                  .links_overrides
                  != unit.links_overrides;
          target_configs_are_different.hash(&mut shared_hasher);
 +        trace_metadata(unit, "host-config-discriminator", &shared_hasher, target_configs_are_different);
++    } else if unit.kind.is_host() {
++        // Reproducible fix: match the Linux x86-64 zigbuild baseline's discriminator.
++        // Change hash input only, not the actual host configuration or compiler flags.
++        false.hash(&mut shared_hasher);
++        trace_metadata(unit, "host-config-discriminator-reproducible", &shared_hasher, false);
      }
 
 +    trace_metadata(
@@ -115,7 +120,7 @@ diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/car
      let mut c_metadata_hasher = shared_hasher.clone();
      // Mix in the target-metadata of all the dependencies of this target.
      let mut dep_c_metadata_hashes = deps_metadata
-@@ -803,6 +839,7 @@ fn compute_metadata(
+@@ -803,6 +844,7 @@ fn compute_metadata(
          .collect::<Vec<_>>();
      dep_c_metadata_hashes.sort();
      dep_c_metadata_hashes.hash(&mut c_metadata_hasher);
@@ -123,7 +128,7 @@ diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/car
 
      let mut unit_id_hasher = shared_hasher.clone();
      // Mix in the target-metadata of all the dependencies of this target.
-@@ -854,6 +891,7 @@ fn has_remap_path_prefix(args: &[String]) -> bool {
+@@ -854,6 +896,7 @@ fn has_remap_path_prefix(args: &[String]) -> bool {
 
  /// Hash the version of rustc being used during the build process.
  fn hash_rustc_version(bcx: &BuildContext<'_, '_>, hasher: &mut StableHasher, unit: &Unit) {
@@ -131,7 +136,7 @@ diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/car
      let vers = &bcx.rustc().version;
      if vers.pre.is_empty() || bcx.gctx.cli_unstable().separate_nightlies {
          // For stable, keep the artifacts separate. This helps if someone is
-@@ -863,7 +901,14 @@ fn hash_rustc_version(bcx: &BuildContext<'_, '_>, hasher: &mut StableHasher, uni
+@@ -863,7 +906,14 @@ fn hash_rustc_version(bcx: &BuildContext<'_, '_>, hasher: &mut StableHasher, uni
          // regardless of the host.
          for line in bcx.rustc().verbose_version.lines() {
              if unit.kind.is_host() || !line.starts_with("host: ") {
@@ -146,7 +151,7 @@ diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/car
              }
          }
          return;
-@@ -879,7 +924,7 @@ fn hash_rustc_version(bcx: &BuildContext<'_, '_>, hasher: &mut StableHasher, uni
+@@ -879,7 +929,7 @@ fn hash_rustc_version(bcx: &BuildContext<'_, '_>, hasher: &mut StableHasher, uni
      // targets, (like gnu vs musl or gnu vs msvc). In the future, we may want
      // to consider hashing `unit.kind.short_name()` instead.
      if unit.kind.is_host() {

From 8e3e8b6f617d6a4aa575487e1e951928365d9d64 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Mon, 7 Sep 2026 18:44:58 -0400
Subject: [PATCH 04/34] Towards a reproducible build

---
 .../patches/cargo-linux-x86_64-metadata.patch | 136 +-----------------
 .github/workflows/manual_reproducible.yml     |  80 +++--------
 2 files changed, 22 insertions(+), 194 deletions(-)

diff --git a/.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch b/.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
index 8e0e87b..7b6a7bd 100644
--- a/.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
+++ b/.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
@@ -1,143 +1,18 @@
 diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/cargo/core/compiler/build_runner/compilation_files.rs
 --- a/src/cargo/core/compiler/build_runner/compilation_files.rs
 +++ b/src/cargo/core/compiler/build_runner/compilation_files.rs
-@@ -688,6 +688,15 @@ fn metadata_of<'a>(
-     &metas[unit]
- }
-
-+fn trace_metadata(unit: &Unit, stage: &str, hasher: &StableHasher, input: impl fmt::Debug) {
-+    if unit.pkg.name().as_str() == "unicode-ident" {
-+        eprintln!(
-+            "cargo-metadata-trace: crate={} kind={:?} stage={} hash={:016x} input={:?}",
-+            unit.pkg.name(), unit.kind, stage, Hasher::finish(hasher), input,
-+        );
-+    }
-+}
-+
- /// Computes the metadata hash for the given [`Unit`].
- fn compute_metadata(
-     unit: &Unit,
-@@ -706,6 +715,7 @@ fn compute_metadata(
-     let mut shared_hasher = StableHasher::new();
-
-     METADATA_VERSION.hash(&mut shared_hasher);
-+    trace_metadata(unit, "metadata-version", &shared_hasher, &METADATA_VERSION);
-
-     let ws_root = if unit.is_std {
-         // SourceId for stdlib crates is an absolute path inside the sysroot.
-@@ -722,17 +732,22 @@ fn compute_metadata(
-         .package_id()
-         .stable_hash(ws_root)
-         .hash(&mut shared_hasher);
-+    trace_metadata(unit, "package", &shared_hasher, (unit.pkg.package_id(), ws_root));
-
-     // Also mix in enabled features to our metadata. This'll ensure that
-     // when changing feature sets each lib is separately cached.
-     unit.features.hash(&mut shared_hasher);
-+    trace_metadata(unit, "features", &shared_hasher, &unit.features);
-
-     // Throw in the profile we're compiling with. This helps caching
-     // `panic=abort` and `panic=unwind` artifacts, additionally with various
-     // settings like debuginfo and whatnot.
-     unit.profile.hash(&mut shared_hasher);
-+    trace_metadata(unit, "profile", &shared_hasher, &unit.profile);
-     unit.mode.hash(&mut shared_hasher);
-+    trace_metadata(unit, "mode", &shared_hasher, &unit.mode);
-     build_runner.lto[unit].hash(&mut shared_hasher);
-+    trace_metadata(unit, "lto", &shared_hasher, &build_runner.lto[unit]);
-
-     // Artifacts compiled for the host should have a different
-     // metadata piece than those compiled for the target, so make sure
-@@ -740,13 +755,17 @@ fn compute_metadata(
-     // so that the StableHash doesn't change based on the pathnames
-     // of the custom target JSON spec files.
-     unit.kind.fingerprint_hash().hash(&mut shared_hasher);
-+    trace_metadata(unit, "compile-kind", &shared_hasher, &unit.kind.fingerprint_hash());
-
-     // Finally throw in the target name/kind. This ensures that concurrent
-     // compiles of targets in the same crate don't collide.
-     unit.target.name().hash(&mut shared_hasher);
-+    trace_metadata(unit, "target-name", &shared_hasher, &unit.target.name());
-     unit.target.kind().hash(&mut shared_hasher);
-+    trace_metadata(unit, "target-kind", &shared_hasher, &unit.target.kind());
-
-     hash_rustc_version(bcx, &mut shared_hasher, unit);
-+    trace_metadata(unit, "rustc-version-complete", &shared_hasher, &bcx.rustc().version);
-
-     if build_runner.bcx.ws.is_member(&unit.pkg) {
-         // This is primarily here for clippy. This ensures that the clippy
-@@ -756,6 +775,11 @@ fn compute_metadata(
-         }
-     }
-
-+    trace_metadata(
-+        unit, "workspace-wrapper", &shared_hasher,
-+        (bcx.ws.is_member(&unit.pkg), &bcx.rustc().workspace_wrapper),
-+    );
-+
-     // Seed the contents of `__CARGO_DEFAULT_LIB_METADATA` to the hasher if present.
-     // This should be the release channel, to get a different hash for each channel.
-     if let Ok(ref channel) = build_runner
-@@ -764,8 +788,14 @@ fn compute_metadata(
-         .get_env("__CARGO_DEFAULT_LIB_METADATA")
-     {
-         channel.hash(&mut shared_hasher);
-+        trace_metadata(unit, "channel-seed", &shared_hasher, channel);
-     }
-
-+    trace_metadata(
-+        unit, "channel-seed-complete", &shared_hasher,
-+        bcx.gctx.get_env("__CARGO_DEFAULT_LIB_METADATA").ok(),
-+    );
-+
-     // std units need to be kept separate from user dependencies. std crates
-     // are differentiated in the Unit with `is_std` (for things like
-     // `-Zforce-unstable-if-unmarked`), so they are always built separately.
-@@ -774,6 +804,7 @@ fn compute_metadata(
-     // `is_std` to false for build dependencies so that they can be shared
-     // with user dependencies.
-     unit.is_std.hash(&mut shared_hasher);
-+    trace_metadata(unit, "is-std", &shared_hasher, &unit.is_std);
-
-     // While we don't hash RUSTFLAGS because it may contain absolute paths that
-     // hurts reproducibility, we track whether a unit's RUSTFLAGS is from host
-@@ -793,8 +824,18 @@ fn compute_metadata(
+@@ -793,6 +793,10 @@
                  .links_overrides
                  != unit.links_overrides;
          target_configs_are_different.hash(&mut shared_hasher);
-+        trace_metadata(unit, "host-config-discriminator", &shared_hasher, target_configs_are_different);
 +    } else if unit.kind.is_host() {
 +        // Reproducible fix: match the Linux x86-64 zigbuild baseline's discriminator.
 +        // Change hash input only, not the actual host configuration or compiler flags.
 +        false.hash(&mut shared_hasher);
-+        trace_metadata(unit, "host-config-discriminator-reproducible", &shared_hasher, false);
      }
 
-+    trace_metadata(
-+        unit, "shared-complete", &shared_hasher,
-+        (bcx.gctx.target_applies_to_host().ok(), &unit.rustflags, &unit.rustdocflags),
-+    );
      let mut c_metadata_hasher = shared_hasher.clone();
-     // Mix in the target-metadata of all the dependencies of this target.
-     let mut dep_c_metadata_hashes = deps_metadata
-@@ -803,6 +844,7 @@ fn compute_metadata(
-         .collect::<Vec<_>>();
-     dep_c_metadata_hashes.sort();
-     dep_c_metadata_hashes.hash(&mut c_metadata_hasher);
-+    trace_metadata(unit, "dependencies-final-metadata", &c_metadata_hasher, &dep_c_metadata_hashes);
-
-     let mut unit_id_hasher = shared_hasher.clone();
-     // Mix in the target-metadata of all the dependencies of this target.
-@@ -854,6 +896,7 @@ fn has_remap_path_prefix(args: &[String]) -> bool {
-
- /// Hash the version of rustc being used during the build process.
- fn hash_rustc_version(bcx: &BuildContext<'_, '_>, hasher: &mut StableHasher, unit: &Unit) {
-+    trace_metadata(unit, "rustc-version-raw", hasher, &bcx.rustc().verbose_version);
-     let vers = &bcx.rustc().version;
-     if vers.pre.is_empty() || bcx.gctx.cli_unstable().separate_nightlies {
-         // For stable, keep the artifacts separate. This helps if someone is
-@@ -863,7 +906,14 @@ fn hash_rustc_version(bcx: &BuildContext<'_, '_>, hasher: &mut StableHasher, uni
-         // regardless of the host.
+@@ -864,6 +868,12 @@
          for line in bcx.rustc().verbose_version.lines() {
              if unit.kind.is_host() || !line.starts_with("host: ") {
 +                // Normalize hash input only; keep the real host for compilation.
@@ -147,16 +22,11 @@ diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/car
 +                    line
 +                };
                  line.hash(hasher);
-+                trace_metadata(unit, "rustc-version-line", hasher, line);
              }
          }
          return;
-@@ -879,7 +929,7 @@ fn hash_rustc_version(bcx: &BuildContext<'_, '_>, hasher: &mut StableHasher, uni
-     // targets, (like gnu vs musl or gnu vs msvc). In the future, we may want
-     // to consider hashing `unit.kind.short_name()` instead.
+@@ -881,3 +891,3 @@
      if unit.kind.is_host() {
 -        bcx.rustc().host.hash(hasher);
 +        "x86_64-unknown-linux-gnu".hash(hasher);
      }
-     // None of the other lines are important. Currently they are:
-     // binary: rustc  <-- or "rustdoc"
diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index b4b5cc5..be36d34 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -16,7 +16,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: [x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu, x86_64-unknown-freebsd]
+        target: [aarch64-unknown-linux-gnu, x86_64-unknown-freebsd]
     env:
       TARGET: ${{ matrix.target }}
     steps:
@@ -141,9 +141,10 @@ jobs:
           persist-credentials: false
 
       - name: Download patched Cargo
+        if: matrix.runner == 'ubuntu-24.04-arm'
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
-          name: patched-cargo-${{ matrix.runner == 'ubuntu-24.04-arm' && 'aarch64-unknown-linux-gnu' || 'x86_64-unknown-linux-gnu' }}
+          name: patched-cargo-aarch64-unknown-linux-gnu
           path: patched-cargo
 
       - name: Setup Zigbuild
@@ -155,12 +156,14 @@ jobs:
           use_cache: "false"
 
       - name: Select patched Cargo
+        if: matrix.runner == 'ubuntu-24.04-arm'
         run: |
           chmod +x "$GITHUB_WORKSPACE/patched-cargo/cargo"
           echo "$GITHUB_WORKSPACE/patched-cargo" >> "$GITHUB_PATH"
           echo "CARGO=$GITHUB_WORKSPACE/patched-cargo/cargo" >> "$GITHUB_ENV"
 
       - name: Verify patched Cargo selection
+        if: matrix.runner == 'ubuntu-24.04-arm'
         run: |
           test "$(command -v cargo)" = "$CARGO"
           echo "Using patched Cargo: $CARGO"
@@ -183,7 +186,12 @@ jobs:
         run: |
           mkdir -p artifacts
           cp "target/${TARGET}/release/celq" artifacts/celq
-          tar czf artifacts/celq.tar.gz -C "target/${TARGET}/release" celq
+          tar --version
+          gzip --version
+          tar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
+            --owner=0 --group=0 --numeric-owner --mode=0755 \
+            -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
+          gzip -n -9 artifacts/celq.tar
 
       - name: Upload archive and binary
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -196,61 +204,6 @@ jobs:
           if-no-files-found: error
           compression-level: 0
 
-  zigbuild_unpatched:
-    name: Zigbuild unpatched (ubuntu-24.04, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        build: *targets
-    env:
-      TARGET: ${{ matrix.build.target }}
-      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Setup Zigbuild
-        uses: $/.github/actions/setup-zigbuild
-        with:
-          target: ${{ matrix.build.target }}
-          rust_components: rust-src
-          install_target: "true"
-          use_cache: "false"
-
-      - name: Configure reproducible builds
-        run: |
-          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
-          echo "TZ=UTC" >> "$GITHUB_ENV"
-          echo "LC_ALL=C" >> "$GITHUB_ENV"
-          RUST_SYSROOT=$(rustc --print sysroot)
-          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
-
-      - name: Build with Zig
-        run: |
-          rustc -vV
-          cargo -vV
-          cargo zigbuild -vv --locked --release --no-default-features --features from-toml,from-yaml,greppable,from-xml --target "${TARGET}${ZIGTARGETSUFFIX}"
-
-      - name: Create release archive
-        run: |
-          mkdir -p artifacts
-          cp "target/${TARGET}/release/celq" artifacts/celq
-          tar czf artifacts/celq.tar.gz -C "target/${TARGET}/release" celq
-
-      - name: Upload archive and binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-ubuntu-24.04-unpatched
-          retention-days: 1
-          path: |
-            artifacts/celq
-            artifacts/celq.tar.gz
-          if-no-files-found: error
-          compression-level: 0
-
   freebsd:
     name: Zigbuild (FreeBSD x86-64, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
     needs: [patched_cargo, freebsd_tools]
@@ -293,7 +246,7 @@ jobs:
           envs: TARGET ZIGTARGETSUFFIX SOURCE_DATE_EPOCH
           prepare: |
             set -eu
-            pkg install -y ca_root_nss git devel/rustup-init
+            pkg install -y ca_root_nss git devel/rustup-init archivers/gtar archivers/gzip
 
             # Install the official FreeBSD Zig archive directly from ziglang.org.
             cd /tmp
@@ -330,7 +283,12 @@ jobs:
 
             mkdir -p artifacts
             cp "target/${TARGET}/release/celq" artifacts/celq
-            tar czf artifacts/celq.tar.gz -C "target/${TARGET}/release" celq
+            gtar --version
+            /usr/local/bin/gzip --version
+            gtar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
+              --owner=0 --group=0 --numeric-owner --mode=0755 \
+              -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
+            /usr/local/bin/gzip -n -9 artifacts/celq.tar
 
       - name: Upload archive and binary
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -345,7 +303,7 @@ jobs:
 
   hashes:
     name: Print SHA-256 hashes
-    needs: [zigbuild, zigbuild_unpatched, freebsd]
+    needs: [zigbuild, freebsd]
     if: ${{ !cancelled() }}
     runs-on: ubuntu-24.04
     steps:

From e0466b20891edb658d1e67acd156f66f4645e65d Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Mon, 7 Sep 2026 19:00:53 -0400
Subject: [PATCH 05/34] Try to reproduce linux musl builds

---
 .github/workflows/manual_reproducible.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index be36d34..355836e 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -130,6 +130,8 @@ jobs:
         build: &targets
           - target: x86_64-unknown-linux-gnu
             zigtargetsuffix: .2.28
+          - target: x86_64-unknown-linux-musl
+            zigtargetsuffix: ""
     env:
       TARGET: ${{ matrix.build.target }}
       ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}

From cb87d14ca526082628f2d14b6da01b37e66578c5 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Mon, 7 Sep 2026 19:33:57 -0400
Subject: [PATCH 06/34] Update reproducibility patch

---
 .../patches/cargo-linux-x86_64-metadata.patch      | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch b/.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
index 7b6a7bd..1822d0c 100644
--- a/.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
+++ b/.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
@@ -1,18 +1,22 @@
 diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/cargo/core/compiler/build_runner/compilation_files.rs
 --- a/src/cargo/core/compiler/build_runner/compilation_files.rs
 +++ b/src/cargo/core/compiler/build_runner/compilation_files.rs
-@@ -793,6 +793,10 @@
+@@ -793,6 +793,14 @@
                  .links_overrides
                  != unit.links_overrides;
          target_configs_are_different.hash(&mut shared_hasher);
-+    } else if unit.kind.is_host() {
-+        // Reproducible fix: match the Linux x86-64 zigbuild baseline's discriminator.
++    } else if unit.kind.is_host()
++        && bcx.build_config.requested_kinds.iter().any(|kind| {
++            matches!(kind, CompileKind::Target(target) if target.short_name() == "x86_64-unknown-linux-gnu")
++        })
++    {
++        // Reproducible fix: only GNU matches the Linux x86-64 baseline host, not musl.
 +        // Change hash input only, not the actual host configuration or compiler flags.
 +        false.hash(&mut shared_hasher);
      }
 
      let mut c_metadata_hasher = shared_hasher.clone();
-@@ -864,6 +868,12 @@
+@@ -864,6 +872,12 @@
          for line in bcx.rustc().verbose_version.lines() {
              if unit.kind.is_host() || !line.starts_with("host: ") {
 +                // Normalize hash input only; keep the real host for compilation.
@@ -25,7 +29,7 @@ diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/car
              }
          }
          return;
-@@ -881,3 +891,3 @@
+@@ -881,3 +895,3 @@
      if unit.kind.is_host() {
 -        bcx.rustc().host.hash(hasher);
 +        "x86_64-unknown-linux-gnu".hash(hasher);

From ed3e5f2b598b2c3b847777e5668114e760fe1b10 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Mon, 7 Sep 2026 19:51:04 -0400
Subject: [PATCH 07/34] Add entries for aarch64 musl builds

---
 .github/workflows/manual_reproducible.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index 355836e..3c13098 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -132,6 +132,10 @@ jobs:
             zigtargetsuffix: .2.28
           - target: x86_64-unknown-linux-musl
             zigtargetsuffix: ""
+          - target: aarch64-unknown-linux-gnu
+            zigtargetsuffix: .2.28
+          - target: aarch64-unknown-linux-musl
+            zigtargetsuffix: ""
     env:
       TARGET: ${{ matrix.build.target }}
       ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}

From bb193f3aa8aa359baf26ae80e1bdd5c5f3119cb0 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Mon, 7 Sep 2026 22:53:04 -0400
Subject: [PATCH 08/34] Use aarch64 to verify x86-64 and freebsd x86-64 to
 verify aarch64

---
 .github/workflows/manual_reproducible.yml | 55 +++++++++++++++++++----
 1 file changed, 47 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index 3c13098..c26bce1 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -127,7 +127,7 @@ jobs:
       fail-fast: false
       matrix:
         runner: [ubuntu-24.04, ubuntu-24.04-arm]
-        build: &targets
+        build:
           - target: x86_64-unknown-linux-gnu
             zigtargetsuffix: .2.28
           - target: x86_64-unknown-linux-musl
@@ -136,6 +136,15 @@ jobs:
             zigtargetsuffix: .2.28
           - target: aarch64-unknown-linux-musl
             zigtargetsuffix: ""
+        exclude:
+          - runner: ubuntu-24.04-arm
+            build:
+              target: aarch64-unknown-linux-gnu
+              zigtargetsuffix: .2.28
+          - runner: ubuntu-24.04-arm
+            build:
+              target: aarch64-unknown-linux-musl
+              zigtargetsuffix: ""
     env:
       TARGET: ${{ matrix.build.target }}
       ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
@@ -217,7 +226,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        build: *targets
+        build:
+          - target: aarch64-unknown-linux-gnu
+            zigtargetsuffix: .2.28
+          - target: aarch64-unknown-linux-musl
+            zigtargetsuffix: ""
     env:
       TARGET: ${{ matrix.build.target }}
       ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
@@ -308,16 +321,42 @@ jobs:
           compression-level: 0
 
   hashes:
-    name: Print SHA-256 hashes
+    name: SHA-256 (${{ matrix.pair.target }}, ${{ matrix.original }} vs ${{ matrix.pair.verify }})
     needs: [zigbuild, freebsd]
     if: ${{ !cancelled() }}
     runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        original: [ubuntu-24.04]
+        pair:
+          - target: x86_64-unknown-linux-gnu.2.28
+            verify: ubuntu-24.04-arm
+          - target: x86_64-unknown-linux-musl
+            verify: ubuntu-24.04-arm
+          - target: aarch64-unknown-linux-gnu.2.28
+            verify: freebsd-x86_64
+          - target: aarch64-unknown-linux-musl
+            verify: freebsd-x86_64
     steps:
-      - name: Download all host artifacts
+      - name: Download original artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
-          pattern: reproducible-*
-          path: artifacts
+          name: reproducible-${{ matrix.pair.target }}-${{ matrix.original }}
+          path: artifacts/${{ matrix.original }}
 
-      - name: Print SHA-256 hashes
-        run: find artifacts -type f -exec sha256sum {} +
+      - name: Download verification artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-${{ matrix.pair.target }}-${{ matrix.pair.verify }}
+          path: artifacts/${{ matrix.pair.verify }}
+
+      - name: Print and compare SHA-256 hashes
+        env:
+          ORIGINAL: ${{ matrix.original }}
+          VERIFY: ${{ matrix.pair.verify }}
+        run: |
+          find artifacts -type f -exec sha256sum {} +
+          (cd "artifacts/$ORIGINAL" && sha256sum celq celq.tar.gz) > original.sha256
+          (cd "artifacts/$VERIFY" && sha256sum celq celq.tar.gz) > verification.sha256
+          diff -u original.sha256 verification.sha256

From 1805b159f7f4cf66a277672326d45a350bcbf243 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Mon, 7 Sep 2026 23:04:59 -0400
Subject: [PATCH 09/34] Use cargo-auditable for reproducible builds again

---
 .github/workflows/manual_reproducible.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index c26bce1..e6047fd 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -281,8 +281,11 @@ jobs:
           run: |
             set -eu
             . "$HOME/.cargo/env"
-            install -m 755 freebsd-tools/cargo-zigbuild freebsd-tools/cargo-auditable "$HOME/.cargo/bin/"
-            export PATH="/tmp/zig-x86_64-freebsd-0.15.2:$PATH"
+            install -m 755 freebsd-tools/cargo-zigbuild "$HOME/.cargo/bin/"
+            mkdir -p /home/runner/.cargo/bin
+            install -m 755 freebsd-tools/cargo-auditable /home/runner/.cargo/bin/cargo-auditable
+            export PATH="/home/runner/.cargo/bin:/tmp/zig-x86_64-freebsd-0.15.2:$PATH"
+            test "$(command -v cargo-auditable)" = /home/runner/.cargo/bin/cargo-auditable
             rustup target add --toolchain 1.94.1 "$TARGET"
 
             # Host job environment variables are not inherited by the VM.

From f4ff7a2e1b25df0d60f6b2f5f9d8b63c62e94996 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Mon, 7 Sep 2026 23:08:14 -0400
Subject: [PATCH 10/34] Use cargo-auditable for reproducible builds again (pt
 2)

---
 .github/workflows/manual_reproducible.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index e6047fd..56dc110 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -195,7 +195,7 @@ jobs:
         run: |
           rustc -vV
           cargo -vV
-          cargo zigbuild -vv --locked --release --no-default-features --features from-toml,from-yaml,greppable,from-xml --target "${TARGET}${ZIGTARGETSUFFIX}"
+          cargo auditable zigbuild -vv --locked --release --no-default-features --features from-toml,from-yaml,greppable,from-xml --target "${TARGET}${ZIGTARGETSUFFIX}"
 
       - name: Create release archive
         run: |
@@ -301,7 +301,7 @@ jobs:
             echo "Using patched Cargo: $CARGO"
             rustc -vV
             "$CARGO" -vV
-            "$CARGO" zigbuild -vv --locked --release --no-default-features --features from-toml,from-yaml,greppable,from-xml --target "${TARGET}${ZIGTARGETSUFFIX}"
+            "$CARGO" auditable zigbuild -vv --locked --release --no-default-features --features from-toml,from-yaml,greppable,from-xml --target "${TARGET}${ZIGTARGETSUFFIX}"
 
             mkdir -p artifacts
             cp "target/${TARGET}/release/celq" artifacts/celq

From edecd64741f8ade08d5d3041b30029b53b9d1402 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Mon, 7 Sep 2026 23:21:50 -0400
Subject: [PATCH 11/34] Re-enable mimalloc for reproducible build

---
 .github/workflows/manual_reproducible.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index 56dc110..9913f60 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -195,7 +195,7 @@ jobs:
         run: |
           rustc -vV
           cargo -vV
-          cargo auditable zigbuild -vv --locked --release --no-default-features --features from-toml,from-yaml,greppable,from-xml --target "${TARGET}${ZIGTARGETSUFFIX}"
+          cargo auditable zigbuild -vv --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
 
       - name: Create release archive
         run: |
@@ -301,7 +301,7 @@ jobs:
             echo "Using patched Cargo: $CARGO"
             rustc -vV
             "$CARGO" -vV
-            "$CARGO" auditable zigbuild -vv --locked --release --no-default-features --features from-toml,from-yaml,greppable,from-xml --target "${TARGET}${ZIGTARGETSUFFIX}"
+            "$CARGO" auditable zigbuild -vv --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
 
             mkdir -p artifacts
             cp "target/${TARGET}/release/celq" artifacts/celq

From bf6aed740a7066d7cea2e017400c11e12cfddcc5 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 05:52:08 -0400
Subject: [PATCH 12/34] Add xwin to reproducible build setup

---
 .github/workflows/manual_reproducible.yml | 87 +++++++++++++++++++++++
 1 file changed, 87 insertions(+)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index 9913f60..e90d0ce 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -323,6 +323,93 @@ jobs:
           if-no-files-found: error
           compression-level: 0
 
+  xwin:
+    name: Xwin (${{ matrix.runner }}, ${{ matrix.target }})
+    runs-on: ${{ matrix.runner }}
+    defaults:
+      run:
+        shell: bash
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-24.04, windows-2025]
+        target: &xwin_targets
+          - x86_64-pc-windows-msvc
+          - aarch64-pc-windows-msvc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Setup Xwin
+        id: setup-xwin
+        uses: $/.github/actions/setup-xwin
+        with:
+          target: ${{ matrix.target }}
+          rust_components: llvm-tools
+          cache_directory: ${{ github.workspace }}/.xwin-cache
+          use_cache: "false"
+
+      - name: Configure reproducible builds
+        run: |
+          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
+          echo "TZ=UTC" >> "$GITHUB_ENV"
+          echo "LC_ALL=C" >> "$GITHUB_ENV"
+          RUST_SYSROOT=$(rustc --print sysroot)
+          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
+
+      - name: Build with Xwin
+        env:
+          TARGET: ${{ matrix.target }}
+          XWIN_CRT_VERSION: ${{ steps.setup-xwin.outputs.xwin_crt_version }}
+          XWIN_SDK_VERSION: ${{ steps.setup-xwin.outputs.xwin_sdk_version }}
+          XWIN_VERSION: ${{ steps.setup-xwin.outputs.xwin_version }}
+        run: >-
+          cargo xwin build --locked --release --target "${TARGET}"
+          --no-default-features --features from-toml,from-yaml,greppable,from-xml
+          --xwin-version "${XWIN_VERSION}"
+          --xwin-sdk-version "${XWIN_SDK_VERSION}"
+          --xwin-crt-version "${XWIN_CRT_VERSION}"
+
+      - name: Upload Windows binary
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: reproducible-xwin-${{ matrix.target }}-${{ matrix.runner }}
+          path: target/${{ matrix.target }}/release/celq.exe
+          retention-days: 1
+          if-no-files-found: error
+          compression-level: 0
+
+  xwin_hashes:
+    name: Xwin SHA-256 (${{ matrix.target }}, Windows vs Linux)
+    needs: xwin
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        target: *xwin_targets
+    steps:
+      - name: Download Windows-built binary
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-xwin-${{ matrix.target }}-windows-2025
+          path: artifacts/windows-2025
+
+      - name: Download Linux-built binary
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-xwin-${{ matrix.target }}-ubuntu-24.04
+          path: artifacts/ubuntu-24.04
+
+      - name: Print and compare SHA-256 hashes
+        run: |
+          sha256sum artifacts/windows-2025/celq.exe artifacts/ubuntu-24.04/celq.exe
+          (cd artifacts/windows-2025 && sha256sum celq.exe) > original.sha256
+          (cd artifacts/ubuntu-24.04 && sha256sum celq.exe) > verification.sha256
+          diff -u original.sha256 verification.sha256
+
   hashes:
     name: SHA-256 (${{ matrix.pair.target }}, ${{ matrix.original }} vs ${{ matrix.pair.verify }})
     needs: [zigbuild, freebsd]

From 05b2458415dead033ad06ea38bf86f6d029c7f0f Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 06:01:16 -0400
Subject: [PATCH 13/34] Use cache for xwin reproducible build

---
 .github/workflows/manual_reproducible.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index e90d0ce..ad888ea 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -335,7 +335,6 @@ jobs:
         runner: [ubuntu-24.04, windows-2025]
         target: &xwin_targets
           - x86_64-pc-windows-msvc
-          - aarch64-pc-windows-msvc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -349,7 +348,7 @@ jobs:
           target: ${{ matrix.target }}
           rust_components: llvm-tools
           cache_directory: ${{ github.workspace }}/.xwin-cache
-          use_cache: "false"
+          use_cache: "true"
 
       - name: Configure reproducible builds
         run: |
@@ -362,6 +361,7 @@ jobs:
       - name: Build with Xwin
         env:
           TARGET: ${{ matrix.target }}
+          XWIN_CACHE_DIR: ${{ steps.setup-xwin.outputs.cache_directory }}
           XWIN_CRT_VERSION: ${{ steps.setup-xwin.outputs.xwin_crt_version }}
           XWIN_SDK_VERSION: ${{ steps.setup-xwin.outputs.xwin_sdk_version }}
           XWIN_VERSION: ${{ steps.setup-xwin.outputs.xwin_version }}

From eb7bfdbf0fc75dd963b3ee9c581b67d35d3df63d Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 06:18:19 -0400
Subject: [PATCH 14/34] Use xwin from windows arm64 for reproducibility check

---
 .github/actions/setup-xwin/action.yml     |  3 ++-
 .github/workflows/manual_reproducible.yml | 28 ++++++++++++++++-------
 2 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/.github/actions/setup-xwin/action.yml b/.github/actions/setup-xwin/action.yml
index c4f9e8c..be6517e 100644
--- a/.github/actions/setup-xwin/action.yml
+++ b/.github/actions/setup-xwin/action.yml
@@ -36,6 +36,7 @@ runs:
       uses: KyleMayes/install-llvm-action@ebc0426251bc40c7cd31162802432c68818ab8f0 # v2.0.9
       with:
         version: "21.1.8"
+        arch: ${{ runner.arch == 'ARM64' && 'arm64' || 'x64' }}
 
     - name: Calculate seven-day cache bucket
       if: inputs.use_cache == 'true'
@@ -62,7 +63,7 @@ runs:
       uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2
       with:
         tool: cargo-xwin@0.23.1
-        fallback: none
+        fallback: ${{ runner.os == 'Windows' && runner.arch == 'ARM64' && 'cargo-install' || 'none' }}
 
     - name: Install cargo-auditable
       uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2
diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index ad888ea..b122be4 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -332,7 +332,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        runner: [ubuntu-24.04, windows-2025]
+        runner: [windows-2025, windows-11-vs2026-arm]
         target: &xwin_targets
           - x86_64-pc-windows-msvc
     steps:
@@ -341,6 +341,12 @@ jobs:
           ref: ${{ github.sha }}
           persist-credentials: false
 
+      - name: Select native Windows ARM64 Rust host
+        if: runner.arch == 'ARM64'
+        run: |
+          rustup set default-host aarch64-pc-windows-msvc
+          echo "RUSTUP_TOOLCHAIN=1.94.1-aarch64-pc-windows-msvc" >> "$GITHUB_ENV"
+
       - name: Setup Xwin
         id: setup-xwin
         uses: $/.github/actions/setup-xwin
@@ -350,6 +356,12 @@ jobs:
           cache_directory: ${{ github.workspace }}/.xwin-cache
           use_cache: "true"
 
+      - name: Verify native Windows ARM64 compiler
+        if: runner.arch == 'ARM64'
+        run: |
+          rustc -vV
+          test "$(rustc -vV | sed -n 's/^host: //p' | tr -d '\r')" = aarch64-pc-windows-msvc
+
       - name: Configure reproducible builds
         run: |
           echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
@@ -382,7 +394,7 @@ jobs:
           compression-level: 0
 
   xwin_hashes:
-    name: Xwin SHA-256 (${{ matrix.target }}, Windows vs Linux)
+    name: Xwin SHA-256 (${{ matrix.target }}, Windows x86-64 vs ARM64)
     needs: xwin
     if: ${{ !cancelled() }}
     runs-on: ubuntu-24.04
@@ -391,23 +403,23 @@ jobs:
       matrix:
         target: *xwin_targets
     steps:
-      - name: Download Windows-built binary
+      - name: Download Windows x86-64-built binary
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: reproducible-xwin-${{ matrix.target }}-windows-2025
           path: artifacts/windows-2025
 
-      - name: Download Linux-built binary
+      - name: Download Windows ARM64-built binary
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
-          name: reproducible-xwin-${{ matrix.target }}-ubuntu-24.04
-          path: artifacts/ubuntu-24.04
+          name: reproducible-xwin-${{ matrix.target }}-windows-11-vs2026-arm
+          path: artifacts/windows-11-vs2026-arm
 
       - name: Print and compare SHA-256 hashes
         run: |
-          sha256sum artifacts/windows-2025/celq.exe artifacts/ubuntu-24.04/celq.exe
+          sha256sum artifacts/windows-2025/celq.exe artifacts/windows-11-vs2026-arm/celq.exe
           (cd artifacts/windows-2025 && sha256sum celq.exe) > original.sha256
-          (cd artifacts/ubuntu-24.04 && sha256sum celq.exe) > verification.sha256
+          (cd artifacts/windows-11-vs2026-arm && sha256sum celq.exe) > verification.sha256
           diff -u original.sha256 verification.sha256
 
   hashes:

From 35680b05dc56a2b4a50c4695b309704f386cb1b8 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 06:27:24 -0400
Subject: [PATCH 15/34] Verbose mode for cargo-xwin

---
 .github/workflows/manual_reproducible.yml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index b122be4..33dc218 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -370,6 +370,18 @@ jobs:
           RUST_SYSROOT=$(rustc --print sysroot)
           echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
 
+      - name: Print Xwin toolchain diagnostics
+        run: |
+          rustc -vV
+          cargo -vV
+          rustup show active-toolchain
+          command -v cargo-xwin
+          cargo xwin --version
+          command -v clang-cl
+          clang-cl --version
+          command -v lld-link
+          lld-link --version
+
       - name: Build with Xwin
         env:
           TARGET: ${{ matrix.target }}
@@ -378,7 +390,7 @@ jobs:
           XWIN_SDK_VERSION: ${{ steps.setup-xwin.outputs.xwin_sdk_version }}
           XWIN_VERSION: ${{ steps.setup-xwin.outputs.xwin_version }}
         run: >-
-          cargo xwin build --locked --release --target "${TARGET}"
+          cargo xwin build -vv --locked --release --target "${TARGET}"
           --no-default-features --features from-toml,from-yaml,greppable,from-xml
           --xwin-version "${XWIN_VERSION}"
           --xwin-sdk-version "${XWIN_SDK_VERSION}"

From 2b9547bdc93692fb0283fd6485d137299e5c9091 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 06:29:36 -0400
Subject: [PATCH 16/34] Separate manual xwin builds for now

---
 .github/workflows/manual_reproducible.yml     | 111 ----------------
 .../workflows/reproducible_manual_xwin.yml    | 122 ++++++++++++++++++
 2 files changed, 122 insertions(+), 111 deletions(-)
 create mode 100644 .github/workflows/reproducible_manual_xwin.yml

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index 33dc218..9913f60 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -323,117 +323,6 @@ jobs:
           if-no-files-found: error
           compression-level: 0
 
-  xwin:
-    name: Xwin (${{ matrix.runner }}, ${{ matrix.target }})
-    runs-on: ${{ matrix.runner }}
-    defaults:
-      run:
-        shell: bash
-    strategy:
-      fail-fast: false
-      matrix:
-        runner: [windows-2025, windows-11-vs2026-arm]
-        target: &xwin_targets
-          - x86_64-pc-windows-msvc
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Select native Windows ARM64 Rust host
-        if: runner.arch == 'ARM64'
-        run: |
-          rustup set default-host aarch64-pc-windows-msvc
-          echo "RUSTUP_TOOLCHAIN=1.94.1-aarch64-pc-windows-msvc" >> "$GITHUB_ENV"
-
-      - name: Setup Xwin
-        id: setup-xwin
-        uses: $/.github/actions/setup-xwin
-        with:
-          target: ${{ matrix.target }}
-          rust_components: llvm-tools
-          cache_directory: ${{ github.workspace }}/.xwin-cache
-          use_cache: "true"
-
-      - name: Verify native Windows ARM64 compiler
-        if: runner.arch == 'ARM64'
-        run: |
-          rustc -vV
-          test "$(rustc -vV | sed -n 's/^host: //p' | tr -d '\r')" = aarch64-pc-windows-msvc
-
-      - name: Configure reproducible builds
-        run: |
-          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
-          echo "TZ=UTC" >> "$GITHUB_ENV"
-          echo "LC_ALL=C" >> "$GITHUB_ENV"
-          RUST_SYSROOT=$(rustc --print sysroot)
-          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
-
-      - name: Print Xwin toolchain diagnostics
-        run: |
-          rustc -vV
-          cargo -vV
-          rustup show active-toolchain
-          command -v cargo-xwin
-          cargo xwin --version
-          command -v clang-cl
-          clang-cl --version
-          command -v lld-link
-          lld-link --version
-
-      - name: Build with Xwin
-        env:
-          TARGET: ${{ matrix.target }}
-          XWIN_CACHE_DIR: ${{ steps.setup-xwin.outputs.cache_directory }}
-          XWIN_CRT_VERSION: ${{ steps.setup-xwin.outputs.xwin_crt_version }}
-          XWIN_SDK_VERSION: ${{ steps.setup-xwin.outputs.xwin_sdk_version }}
-          XWIN_VERSION: ${{ steps.setup-xwin.outputs.xwin_version }}
-        run: >-
-          cargo xwin build -vv --locked --release --target "${TARGET}"
-          --no-default-features --features from-toml,from-yaml,greppable,from-xml
-          --xwin-version "${XWIN_VERSION}"
-          --xwin-sdk-version "${XWIN_SDK_VERSION}"
-          --xwin-crt-version "${XWIN_CRT_VERSION}"
-
-      - name: Upload Windows binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: reproducible-xwin-${{ matrix.target }}-${{ matrix.runner }}
-          path: target/${{ matrix.target }}/release/celq.exe
-          retention-days: 1
-          if-no-files-found: error
-          compression-level: 0
-
-  xwin_hashes:
-    name: Xwin SHA-256 (${{ matrix.target }}, Windows x86-64 vs ARM64)
-    needs: xwin
-    if: ${{ !cancelled() }}
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        target: *xwin_targets
-    steps:
-      - name: Download Windows x86-64-built binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: reproducible-xwin-${{ matrix.target }}-windows-2025
-          path: artifacts/windows-2025
-
-      - name: Download Windows ARM64-built binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: reproducible-xwin-${{ matrix.target }}-windows-11-vs2026-arm
-          path: artifacts/windows-11-vs2026-arm
-
-      - name: Print and compare SHA-256 hashes
-        run: |
-          sha256sum artifacts/windows-2025/celq.exe artifacts/windows-11-vs2026-arm/celq.exe
-          (cd artifacts/windows-2025 && sha256sum celq.exe) > original.sha256
-          (cd artifacts/windows-11-vs2026-arm && sha256sum celq.exe) > verification.sha256
-          diff -u original.sha256 verification.sha256
-
   hashes:
     name: SHA-256 (${{ matrix.pair.target }}, ${{ matrix.original }} vs ${{ matrix.pair.verify }})
     needs: [zigbuild, freebsd]
diff --git a/.github/workflows/reproducible_manual_xwin.yml b/.github/workflows/reproducible_manual_xwin.yml
new file mode 100644
index 0000000..509330c
--- /dev/null
+++ b/.github/workflows/reproducible_manual_xwin.yml
@@ -0,0 +1,122 @@
+name: Reproducible Xwin builds (Manual)
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  xwin:
+    name: Xwin (${{ matrix.runner }}, ${{ matrix.target }})
+    runs-on: ${{ matrix.runner }}
+    defaults:
+      run:
+        shell: bash
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [windows-2025, windows-11-vs2026-arm]
+        target: &xwin_targets
+          - x86_64-pc-windows-msvc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Select native Windows ARM64 Rust host
+        if: runner.arch == 'ARM64'
+        run: |
+          rustup set default-host aarch64-pc-windows-msvc
+          echo "RUSTUP_TOOLCHAIN=1.94.1-aarch64-pc-windows-msvc" >> "$GITHUB_ENV"
+
+      - name: Setup Xwin
+        id: setup-xwin
+        uses: $/.github/actions/setup-xwin
+        with:
+          target: ${{ matrix.target }}
+          rust_components: llvm-tools
+          cache_directory: ${{ github.workspace }}/.xwin-cache
+          use_cache: "true"
+
+      - name: Verify native Windows ARM64 compiler
+        if: runner.arch == 'ARM64'
+        run: |
+          rustc -vV
+          test "$(rustc -vV | sed -n 's/^host: //p' | tr -d '\r')" = aarch64-pc-windows-msvc
+
+      - name: Configure reproducible builds
+        run: |
+          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
+          echo "TZ=UTC" >> "$GITHUB_ENV"
+          echo "LC_ALL=C" >> "$GITHUB_ENV"
+          RUST_SYSROOT=$(rustc --print sysroot)
+          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
+
+      - name: Print Xwin toolchain diagnostics
+        run: |
+          rustc -vV
+          cargo -vV
+          rustup show active-toolchain
+          command -v cargo-xwin
+          cargo xwin --version
+          command -v clang-cl
+          clang-cl --version
+          command -v lld-link
+          lld-link --version
+
+      - name: Build with Xwin
+        env:
+          TARGET: ${{ matrix.target }}
+          XWIN_CACHE_DIR: ${{ steps.setup-xwin.outputs.cache_directory }}
+          XWIN_CRT_VERSION: ${{ steps.setup-xwin.outputs.xwin_crt_version }}
+          XWIN_SDK_VERSION: ${{ steps.setup-xwin.outputs.xwin_sdk_version }}
+          XWIN_VERSION: ${{ steps.setup-xwin.outputs.xwin_version }}
+        run: >-
+          cargo xwin build -vv --locked --release --target "${TARGET}"
+          --no-default-features --features from-toml,from-yaml,greppable,from-xml
+          --xwin-version "${XWIN_VERSION}"
+          --xwin-sdk-version "${XWIN_SDK_VERSION}"
+          --xwin-crt-version "${XWIN_CRT_VERSION}"
+
+      - name: Upload Windows binary
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: reproducible-xwin-${{ matrix.target }}-${{ matrix.runner }}
+          path: target/${{ matrix.target }}/release/celq.exe
+          retention-days: 1
+          if-no-files-found: error
+          compression-level: 0
+
+  xwin_hashes:
+    name: Xwin SHA-256 (${{ matrix.target }}, Windows x86-64 vs ARM64)
+    needs: xwin
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        target: *xwin_targets
+    steps:
+      - name: Download Windows x86-64-built binary
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-xwin-${{ matrix.target }}-windows-2025
+          path: artifacts/windows-2025
+
+      - name: Download Windows ARM64-built binary
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-xwin-${{ matrix.target }}-windows-11-vs2026-arm
+          path: artifacts/windows-11-vs2026-arm
+
+      - name: Print and compare SHA-256 hashes
+        run: |
+          sha256sum artifacts/windows-2025/celq.exe artifacts/windows-11-vs2026-arm/celq.exe
+          (cd artifacts/windows-2025 && sha256sum celq.exe) > original.sha256
+          (cd artifacts/windows-11-vs2026-arm && sha256sum celq.exe) > verification.sha256
+          diff -u original.sha256 verification.sha256

From 0735d52da44100dfe3e698cdb993e73700b3f174 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 06:38:52 -0400
Subject: [PATCH 17/34] Use patched cargo for Windows arm64 builds

---
 .../cargo-windows-x86_64-metadata.patch       | 36 +++++++++
 .../workflows/reproducible_manual_xwin.yml    | 77 +++++++++++++++++++
 2 files changed, 113 insertions(+)
 create mode 100644 .github/reproducibility/patches/cargo-windows-x86_64-metadata.patch

diff --git a/.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch b/.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
new file mode 100644
index 0000000..7ad9f37
--- /dev/null
+++ b/.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
@@ -0,0 +1,36 @@
+diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/cargo/core/compiler/build_runner/compilation_files.rs
+--- a/src/cargo/core/compiler/build_runner/compilation_files.rs
++++ b/src/cargo/core/compiler/build_runner/compilation_files.rs
+@@ -793,6 +793,14 @@
+                 .links_overrides
+                 != unit.links_overrides;
+         target_configs_are_different.hash(&mut shared_hasher);
++    } else if unit.kind.is_host()
++        && bcx.build_config.requested_kinds.iter().any(|kind| {
++            matches!(kind, CompileKind::Target(target) if target.short_name() == "x86_64-pc-windows-msvc")
++        })
++    {
++        // Reproducible fix: match the Windows x86-64 baseline host hash.
++        // Change hash input only, not the actual host configuration or compiler flags.
++        false.hash(&mut shared_hasher);
+     }
+
+     let mut c_metadata_hasher = shared_hasher.clone();
+@@ -864,6 +872,12 @@
+         for line in bcx.rustc().verbose_version.lines() {
+             if unit.kind.is_host() || !line.starts_with("host: ") {
++                // Normalize hash input only; keep the real host for compilation.
++                let line = if line.starts_with("host: ") {
++                    "host: x86_64-pc-windows-msvc"
++                } else {
++                    line
++                };
+                 line.hash(hasher);
+             }
+         }
+         return;
+@@ -881,3 +895,3 @@
+     if unit.kind.is_host() {
+-        bcx.rustc().host.hash(hasher);
++        "x86_64-pc-windows-msvc".hash(hasher);
+     }
diff --git a/.github/workflows/reproducible_manual_xwin.yml b/.github/workflows/reproducible_manual_xwin.yml
index 509330c..fc3f19a 100644
--- a/.github/workflows/reproducible_manual_xwin.yml
+++ b/.github/workflows/reproducible_manual_xwin.yml
@@ -10,8 +10,66 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
+  patched_cargo:
+    name: Patched Cargo (Windows ARM64)
+    runs-on: windows-2025
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Checkout Cargo source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: rust-lang/cargo
+          ref: 29ea6fb6a5db279426f4cc4e17aa385f05a0cfbc
+          path: cargo-source
+          persist-credentials: false
+          fetch-depth: 1
+          sparse-checkout: |
+            src
+            crates
+            credential
+            benches/benchsuite
+            benches/capture
+
+      - name: Install Rust 1.94.1 with Windows ARM64 target
+        uses: dtolnay/rust-toolchain@9376cdc5a5e25b16da71af47712785cf06b0d6d4 # 1.94.1
+        with:
+          targets: aarch64-pc-windows-msvc
+
+      - name: Patch Cargo metadata
+        working-directory: cargo-source
+        run: |
+          git apply --check ../.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
+          git apply ../.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
+
+      - name: Cross-compile patched Cargo for Windows ARM64
+        working-directory: cargo-source
+        env:
+          CFG_RELEASE: 1.94.1
+          CFG_RELEASE_CHANNEL: stable
+          CFG_VER_DESCRIPTION: windows-x86_64-metadata-patch
+          LIBZ_SYS_STATIC: "1"
+        run: >-
+          cargo build --locked --release --package cargo --bin cargo
+          --features all-static --target aarch64-pc-windows-msvc
+
+      - name: Upload patched Cargo
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: patched-cargo-aarch64-pc-windows-msvc
+          path: cargo-source/target/aarch64-pc-windows-msvc/release/cargo.exe
+          retention-days: 1
+          if-no-files-found: error
+
   xwin:
     name: Xwin (${{ matrix.runner }}, ${{ matrix.target }})
+    needs: patched_cargo
     runs-on: ${{ matrix.runner }}
     defaults:
       run:
@@ -49,6 +107,25 @@ jobs:
           rustc -vV
           test "$(rustc -vV | sed -n 's/^host: //p' | tr -d '\r')" = aarch64-pc-windows-msvc
 
+      - name: Download patched Cargo
+        if: runner.arch == 'ARM64'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: patched-cargo-aarch64-pc-windows-msvc
+          path: patched-cargo
+
+      - name: Select patched Cargo
+        if: runner.arch == 'ARM64'
+        run: |
+          echo "$(cygpath -aw "$GITHUB_WORKSPACE/patched-cargo")" >> "$GITHUB_PATH"
+          echo "CARGO=$(cygpath -aw "$GITHUB_WORKSPACE/patched-cargo/cargo.exe")" >> "$GITHUB_ENV"
+
+      - name: Verify patched Cargo selection
+        if: runner.arch == 'ARM64'
+        run: |
+          test "$(cygpath -aw "$(command -v cargo)")" = "$CARGO"
+          echo "Using patched Cargo: $CARGO"
+
       - name: Configure reproducible builds
         run: |
           echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"

From 23b391ff93dbb2943d16be53ef514370c4c1275c Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 06:41:42 -0400
Subject: [PATCH 18/34] let me trigger the workflow

---
 .github/workflows/manual_reproducible.yml     | 354 +++++------------
 .github/workflows/manual_reproducible.yml.bak | 365 ++++++++++++++++++
 .../workflows/reproducible_manual_xwin.yml    | 199 ----------
 3 files changed, 459 insertions(+), 459 deletions(-)
 create mode 100644 .github/workflows/manual_reproducible.yml.bak
 delete mode 100644 .github/workflows/reproducible_manual_xwin.yml

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index 9913f60..fc3f19a 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -1,4 +1,4 @@
-name: Reproducible builds (Manual)
+name: Reproducible Xwin builds (Manual)
 
 on:
   workflow_dispatch:
@@ -11,14 +11,11 @@ env:
 
 jobs:
   patched_cargo:
-    name: Patched Cargo (${{ matrix.target }})
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        target: [aarch64-unknown-linux-gnu, x86_64-unknown-freebsd]
-    env:
-      TARGET: ${{ matrix.target }}
+    name: Patched Cargo (Windows ARM64)
+    runs-on: windows-2025
+    defaults:
+      run:
+        shell: bash
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -40,147 +37,93 @@ jobs:
             benches/benchsuite
             benches/capture
 
-      - name: Setup Zigbuild
-        uses: $/.github/actions/setup-zigbuild
+      - name: Install Rust 1.94.1 with Windows ARM64 target
+        uses: dtolnay/rust-toolchain@9376cdc5a5e25b16da71af47712785cf06b0d6d4 # 1.94.1
         with:
-          target: ${{ matrix.target }}
-          rust_components: rust-src
-          install_target: "true"
-          use_cache: "false"
+          targets: aarch64-pc-windows-msvc
 
-      - name: Patch Cargo
+      - name: Patch Cargo metadata
         working-directory: cargo-source
         run: |
-          git apply --check ../.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
-          git apply ../.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
+          git apply --check ../.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
+          git apply ../.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
 
-      - name: Build patched Cargo with Zig
+      - name: Cross-compile patched Cargo for Windows ARM64
         working-directory: cargo-source
         env:
           CFG_RELEASE: 1.94.1
           CFG_RELEASE_CHANNEL: stable
-          CFG_VER_DESCRIPTION: linux-x86_64-metadata-patch
+          CFG_VER_DESCRIPTION: windows-x86_64-metadata-patch
           LIBZ_SYS_STATIC: "1"
-        run: |
-          cargo zigbuild --locked --release --package cargo --bin cargo --features all-static --target "$TARGET"
+        run: >-
+          cargo build --locked --release --package cargo --bin cargo
+          --features all-static --target aarch64-pc-windows-msvc
 
       - name: Upload patched Cargo
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: patched-cargo-${{ matrix.target }}
-          path: cargo-source/target/${{ matrix.target }}/release/cargo
+          name: patched-cargo-aarch64-pc-windows-msvc
+          path: cargo-source/target/aarch64-pc-windows-msvc/release/cargo.exe
           retention-days: 1
           if-no-files-found: error
 
-  freebsd_tools:
-    name: Build FreeBSD tools
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Setup Zigbuild
-        uses: $/.github/actions/setup-zigbuild
-        with:
-          target: x86_64-unknown-freebsd
-          rust_components: rust-src
-          install_target: "true"
-          use_cache: "false"
-
-      - name: Install cargo-clone
-        run: |
-          /home/linuxbrew/.linuxbrew/bin/brew install --force-bottle cargo-clone
-          echo "/home/linuxbrew/.linuxbrew/bin" >> "$GITHUB_PATH"
-
-      - name: Download tool sources
-        run: cargo clone cargo-zigbuild@0.23.2 cargo-auditable@0.7.5 -- freebsd-tool-sources/
-
-      - name: Cross-compile cargo-zigbuild
-        run: |
-          cargo zigbuild --locked --release --bin cargo-zigbuild --target x86_64-unknown-freebsd \
-            --manifest-path freebsd-tool-sources/cargo-zigbuild/Cargo.toml \
-            --target-dir "$GITHUB_WORKSPACE/freebsd-tools-build"
-
-      - name: Cross-compile cargo-auditable
-        run: |
-          cargo zigbuild --locked --release --bin cargo-auditable --target x86_64-unknown-freebsd \
-            --manifest-path freebsd-tool-sources/cargo-auditable/Cargo.toml \
-            --target-dir "$GITHUB_WORKSPACE/freebsd-tools-build"
-
-      - name: Upload FreeBSD tools
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: freebsd-tools-x86_64
-          path: |
-            freebsd-tools-build/x86_64-unknown-freebsd/release/cargo-zigbuild
-            freebsd-tools-build/x86_64-unknown-freebsd/release/cargo-auditable
-          retention-days: 1
-          if-no-files-found: error
-
-  zigbuild:
-    name: Zigbuild (${{ matrix.runner }}, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
+  xwin:
+    name: Xwin (${{ matrix.runner }}, ${{ matrix.target }})
     needs: patched_cargo
     runs-on: ${{ matrix.runner }}
+    defaults:
+      run:
+        shell: bash
     strategy:
       fail-fast: false
       matrix:
-        runner: [ubuntu-24.04, ubuntu-24.04-arm]
-        build:
-          - target: x86_64-unknown-linux-gnu
-            zigtargetsuffix: .2.28
-          - target: x86_64-unknown-linux-musl
-            zigtargetsuffix: ""
-          - target: aarch64-unknown-linux-gnu
-            zigtargetsuffix: .2.28
-          - target: aarch64-unknown-linux-musl
-            zigtargetsuffix: ""
-        exclude:
-          - runner: ubuntu-24.04-arm
-            build:
-              target: aarch64-unknown-linux-gnu
-              zigtargetsuffix: .2.28
-          - runner: ubuntu-24.04-arm
-            build:
-              target: aarch64-unknown-linux-musl
-              zigtargetsuffix: ""
-    env:
-      TARGET: ${{ matrix.build.target }}
-      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
+        runner: [windows-2025, windows-11-vs2026-arm]
+        target: &xwin_targets
+          - x86_64-pc-windows-msvc
     steps:
-      # Every host builds the same HEAD captured by the manual dispatch.
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
 
+      - name: Select native Windows ARM64 Rust host
+        if: runner.arch == 'ARM64'
+        run: |
+          rustup set default-host aarch64-pc-windows-msvc
+          echo "RUSTUP_TOOLCHAIN=1.94.1-aarch64-pc-windows-msvc" >> "$GITHUB_ENV"
+
+      - name: Setup Xwin
+        id: setup-xwin
+        uses: $/.github/actions/setup-xwin
+        with:
+          target: ${{ matrix.target }}
+          rust_components: llvm-tools
+          cache_directory: ${{ github.workspace }}/.xwin-cache
+          use_cache: "true"
+
+      - name: Verify native Windows ARM64 compiler
+        if: runner.arch == 'ARM64'
+        run: |
+          rustc -vV
+          test "$(rustc -vV | sed -n 's/^host: //p' | tr -d '\r')" = aarch64-pc-windows-msvc
+
       - name: Download patched Cargo
-        if: matrix.runner == 'ubuntu-24.04-arm'
+        if: runner.arch == 'ARM64'
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
-          name: patched-cargo-aarch64-unknown-linux-gnu
+          name: patched-cargo-aarch64-pc-windows-msvc
           path: patched-cargo
 
-      - name: Setup Zigbuild
-        uses: $/.github/actions/setup-zigbuild
-        with:
-          target: ${{ matrix.build.target }}
-          rust_components: rust-src
-          install_target: "true"
-          use_cache: "false"
-
       - name: Select patched Cargo
-        if: matrix.runner == 'ubuntu-24.04-arm'
+        if: runner.arch == 'ARM64'
         run: |
-          chmod +x "$GITHUB_WORKSPACE/patched-cargo/cargo"
-          echo "$GITHUB_WORKSPACE/patched-cargo" >> "$GITHUB_PATH"
-          echo "CARGO=$GITHUB_WORKSPACE/patched-cargo/cargo" >> "$GITHUB_ENV"
+          echo "$(cygpath -aw "$GITHUB_WORKSPACE/patched-cargo")" >> "$GITHUB_PATH"
+          echo "CARGO=$(cygpath -aw "$GITHUB_WORKSPACE/patched-cargo/cargo.exe")" >> "$GITHUB_ENV"
 
       - name: Verify patched Cargo selection
-        if: matrix.runner == 'ubuntu-24.04-arm'
+        if: runner.arch == 'ARM64'
         run: |
-          test "$(command -v cargo)" = "$CARGO"
+          test "$(cygpath -aw "$(command -v cargo)")" = "$CARGO"
           echo "Using patched Cargo: $CARGO"
 
       - name: Configure reproducible builds
@@ -191,175 +134,66 @@ jobs:
           RUST_SYSROOT=$(rustc --print sysroot)
           echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
 
-      - name: Build with Zig
+      - name: Print Xwin toolchain diagnostics
         run: |
           rustc -vV
           cargo -vV
-          cargo auditable zigbuild -vv --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
-
-      - name: Create release archive
-        run: |
-          mkdir -p artifacts
-          cp "target/${TARGET}/release/celq" artifacts/celq
-          tar --version
-          gzip --version
-          tar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
-            --owner=0 --group=0 --numeric-owner --mode=0755 \
-            -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
-          gzip -n -9 artifacts/celq.tar
-
-      - name: Upload archive and binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-${{ matrix.runner }}
-          retention-days: 1
-          path: |
-            artifacts/celq
-            artifacts/celq.tar.gz
-          if-no-files-found: error
-          compression-level: 0
-
-  freebsd:
-    name: Zigbuild (FreeBSD x86-64, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
-    needs: [patched_cargo, freebsd_tools]
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        build:
-          - target: aarch64-unknown-linux-gnu
-            zigtargetsuffix: .2.28
-          - target: aarch64-unknown-linux-musl
-            zigtargetsuffix: ""
-    env:
-      TARGET: ${{ matrix.build.target }}
-      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Capture commit timestamp
-        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
-
-      - name: Download patched Cargo
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: patched-cargo-x86_64-unknown-freebsd
-          path: patched-cargo
-
-      - name: Download FreeBSD tools
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: freebsd-tools-x86_64
-          path: freebsd-tools
-
-      - name: Build on FreeBSD
-        uses: vmactions/freebsd-vm@f0552d3b69211736abd97f02ff3d4674c56b73b1 # v1.5.5
-        with:
-          release: "14.4"
-          arch: x86_64
-          sync: rsync
-          copyback: true
-          envs: TARGET ZIGTARGETSUFFIX SOURCE_DATE_EPOCH
-          prepare: |
-            set -eu
-            pkg install -y ca_root_nss git devel/rustup-init archivers/gtar archivers/gzip
-
-            # Install the official FreeBSD Zig archive directly from ziglang.org.
-            cd /tmp
-            fetch https://ziglang.org/download/0.15.2/zig-x86_64-freebsd-0.15.2.tar.xz
-            test "$(sha256 -q zig-x86_64-freebsd-0.15.2.tar.xz)" = \
-              "5509ff57cd3f219165caed0da10221739af82742b9edfcda3f7bfaf4da7212dd"
-            tar -xf zig-x86_64-freebsd-0.15.2.tar.xz
-
-            rustup-init -y --profile minimal --default-toolchain 1.94.1
-            . "$HOME/.cargo/env"
-            rustup component add rust-src --toolchain 1.94.1
-
-          run: |
-            set -eu
-            . "$HOME/.cargo/env"
-            install -m 755 freebsd-tools/cargo-zigbuild "$HOME/.cargo/bin/"
-            mkdir -p /home/runner/.cargo/bin
-            install -m 755 freebsd-tools/cargo-auditable /home/runner/.cargo/bin/cargo-auditable
-            export PATH="/home/runner/.cargo/bin:/tmp/zig-x86_64-freebsd-0.15.2:$PATH"
-            test "$(command -v cargo-auditable)" = /home/runner/.cargo/bin/cargo-auditable
-            rustup target add --toolchain 1.94.1 "$TARGET"
-
-            # Host job environment variables are not inherited by the VM.
-            export RUSTUP_TOOLCHAIN=1.94.1
-            export CARGO_TERM_COLOR=always TZ=UTC LC_ALL=C
-            export SOURCE_DATE_EPOCH
-            RUST_SYSROOT=$(rustc --print sysroot)
-            export RUSTFLAGS="--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=$(pwd -P)=/src"
-            export CARGO="$(pwd -P)/patched-cargo/cargo"
-            chmod +x "$CARGO"
-            export PATH="$(pwd -P)/patched-cargo:$PATH"
-            test "$(command -v cargo)" = "$CARGO"
-            echo "Using patched Cargo: $CARGO"
-            rustc -vV
-            "$CARGO" -vV
-            "$CARGO" auditable zigbuild -vv --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
-
-            mkdir -p artifacts
-            cp "target/${TARGET}/release/celq" artifacts/celq
-            gtar --version
-            /usr/local/bin/gzip --version
-            gtar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
-              --owner=0 --group=0 --numeric-owner --mode=0755 \
-              -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
-            /usr/local/bin/gzip -n -9 artifacts/celq.tar
-
-      - name: Upload archive and binary
+          rustup show active-toolchain
+          command -v cargo-xwin
+          cargo xwin --version
+          command -v clang-cl
+          clang-cl --version
+          command -v lld-link
+          lld-link --version
+
+      - name: Build with Xwin
+        env:
+          TARGET: ${{ matrix.target }}
+          XWIN_CACHE_DIR: ${{ steps.setup-xwin.outputs.cache_directory }}
+          XWIN_CRT_VERSION: ${{ steps.setup-xwin.outputs.xwin_crt_version }}
+          XWIN_SDK_VERSION: ${{ steps.setup-xwin.outputs.xwin_sdk_version }}
+          XWIN_VERSION: ${{ steps.setup-xwin.outputs.xwin_version }}
+        run: >-
+          cargo xwin build -vv --locked --release --target "${TARGET}"
+          --no-default-features --features from-toml,from-yaml,greppable,from-xml
+          --xwin-version "${XWIN_VERSION}"
+          --xwin-sdk-version "${XWIN_SDK_VERSION}"
+          --xwin-crt-version "${XWIN_CRT_VERSION}"
+
+      - name: Upload Windows binary
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-freebsd-x86_64
+          name: reproducible-xwin-${{ matrix.target }}-${{ matrix.runner }}
+          path: target/${{ matrix.target }}/release/celq.exe
           retention-days: 1
-          path: |
-            artifacts/celq
-            artifacts/celq.tar.gz
           if-no-files-found: error
           compression-level: 0
 
-  hashes:
-    name: SHA-256 (${{ matrix.pair.target }}, ${{ matrix.original }} vs ${{ matrix.pair.verify }})
-    needs: [zigbuild, freebsd]
+  xwin_hashes:
+    name: Xwin SHA-256 (${{ matrix.target }}, Windows x86-64 vs ARM64)
+    needs: xwin
     if: ${{ !cancelled() }}
     runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
-        original: [ubuntu-24.04]
-        pair:
-          - target: x86_64-unknown-linux-gnu.2.28
-            verify: ubuntu-24.04-arm
-          - target: x86_64-unknown-linux-musl
-            verify: ubuntu-24.04-arm
-          - target: aarch64-unknown-linux-gnu.2.28
-            verify: freebsd-x86_64
-          - target: aarch64-unknown-linux-musl
-            verify: freebsd-x86_64
+        target: *xwin_targets
     steps:
-      - name: Download original artifacts
+      - name: Download Windows x86-64-built binary
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
-          name: reproducible-${{ matrix.pair.target }}-${{ matrix.original }}
-          path: artifacts/${{ matrix.original }}
+          name: reproducible-xwin-${{ matrix.target }}-windows-2025
+          path: artifacts/windows-2025
 
-      - name: Download verification artifacts
+      - name: Download Windows ARM64-built binary
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
-          name: reproducible-${{ matrix.pair.target }}-${{ matrix.pair.verify }}
-          path: artifacts/${{ matrix.pair.verify }}
+          name: reproducible-xwin-${{ matrix.target }}-windows-11-vs2026-arm
+          path: artifacts/windows-11-vs2026-arm
 
       - name: Print and compare SHA-256 hashes
-        env:
-          ORIGINAL: ${{ matrix.original }}
-          VERIFY: ${{ matrix.pair.verify }}
         run: |
-          find artifacts -type f -exec sha256sum {} +
-          (cd "artifacts/$ORIGINAL" && sha256sum celq celq.tar.gz) > original.sha256
-          (cd "artifacts/$VERIFY" && sha256sum celq celq.tar.gz) > verification.sha256
+          sha256sum artifacts/windows-2025/celq.exe artifacts/windows-11-vs2026-arm/celq.exe
+          (cd artifacts/windows-2025 && sha256sum celq.exe) > original.sha256
+          (cd artifacts/windows-11-vs2026-arm && sha256sum celq.exe) > verification.sha256
           diff -u original.sha256 verification.sha256
diff --git a/.github/workflows/manual_reproducible.yml.bak b/.github/workflows/manual_reproducible.yml.bak
new file mode 100644
index 0000000..9913f60
--- /dev/null
+++ b/.github/workflows/manual_reproducible.yml.bak
@@ -0,0 +1,365 @@
+name: Reproducible builds (Manual)
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  patched_cargo:
+    name: Patched Cargo (${{ matrix.target }})
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [aarch64-unknown-linux-gnu, x86_64-unknown-freebsd]
+    env:
+      TARGET: ${{ matrix.target }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Checkout Cargo source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: rust-lang/cargo
+          ref: 29ea6fb6a5db279426f4cc4e17aa385f05a0cfbc
+          path: cargo-source
+          persist-credentials: false
+          fetch-depth: 1
+          sparse-checkout: |
+            src
+            crates
+            credential
+            benches/benchsuite
+            benches/capture
+
+      - name: Setup Zigbuild
+        uses: $/.github/actions/setup-zigbuild
+        with:
+          target: ${{ matrix.target }}
+          rust_components: rust-src
+          install_target: "true"
+          use_cache: "false"
+
+      - name: Patch Cargo
+        working-directory: cargo-source
+        run: |
+          git apply --check ../.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
+          git apply ../.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
+
+      - name: Build patched Cargo with Zig
+        working-directory: cargo-source
+        env:
+          CFG_RELEASE: 1.94.1
+          CFG_RELEASE_CHANNEL: stable
+          CFG_VER_DESCRIPTION: linux-x86_64-metadata-patch
+          LIBZ_SYS_STATIC: "1"
+        run: |
+          cargo zigbuild --locked --release --package cargo --bin cargo --features all-static --target "$TARGET"
+
+      - name: Upload patched Cargo
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: patched-cargo-${{ matrix.target }}
+          path: cargo-source/target/${{ matrix.target }}/release/cargo
+          retention-days: 1
+          if-no-files-found: error
+
+  freebsd_tools:
+    name: Build FreeBSD tools
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Setup Zigbuild
+        uses: $/.github/actions/setup-zigbuild
+        with:
+          target: x86_64-unknown-freebsd
+          rust_components: rust-src
+          install_target: "true"
+          use_cache: "false"
+
+      - name: Install cargo-clone
+        run: |
+          /home/linuxbrew/.linuxbrew/bin/brew install --force-bottle cargo-clone
+          echo "/home/linuxbrew/.linuxbrew/bin" >> "$GITHUB_PATH"
+
+      - name: Download tool sources
+        run: cargo clone cargo-zigbuild@0.23.2 cargo-auditable@0.7.5 -- freebsd-tool-sources/
+
+      - name: Cross-compile cargo-zigbuild
+        run: |
+          cargo zigbuild --locked --release --bin cargo-zigbuild --target x86_64-unknown-freebsd \
+            --manifest-path freebsd-tool-sources/cargo-zigbuild/Cargo.toml \
+            --target-dir "$GITHUB_WORKSPACE/freebsd-tools-build"
+
+      - name: Cross-compile cargo-auditable
+        run: |
+          cargo zigbuild --locked --release --bin cargo-auditable --target x86_64-unknown-freebsd \
+            --manifest-path freebsd-tool-sources/cargo-auditable/Cargo.toml \
+            --target-dir "$GITHUB_WORKSPACE/freebsd-tools-build"
+
+      - name: Upload FreeBSD tools
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: freebsd-tools-x86_64
+          path: |
+            freebsd-tools-build/x86_64-unknown-freebsd/release/cargo-zigbuild
+            freebsd-tools-build/x86_64-unknown-freebsd/release/cargo-auditable
+          retention-days: 1
+          if-no-files-found: error
+
+  zigbuild:
+    name: Zigbuild (${{ matrix.runner }}, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
+    needs: patched_cargo
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-24.04, ubuntu-24.04-arm]
+        build:
+          - target: x86_64-unknown-linux-gnu
+            zigtargetsuffix: .2.28
+          - target: x86_64-unknown-linux-musl
+            zigtargetsuffix: ""
+          - target: aarch64-unknown-linux-gnu
+            zigtargetsuffix: .2.28
+          - target: aarch64-unknown-linux-musl
+            zigtargetsuffix: ""
+        exclude:
+          - runner: ubuntu-24.04-arm
+            build:
+              target: aarch64-unknown-linux-gnu
+              zigtargetsuffix: .2.28
+          - runner: ubuntu-24.04-arm
+            build:
+              target: aarch64-unknown-linux-musl
+              zigtargetsuffix: ""
+    env:
+      TARGET: ${{ matrix.build.target }}
+      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
+    steps:
+      # Every host builds the same HEAD captured by the manual dispatch.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Download patched Cargo
+        if: matrix.runner == 'ubuntu-24.04-arm'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: patched-cargo-aarch64-unknown-linux-gnu
+          path: patched-cargo
+
+      - name: Setup Zigbuild
+        uses: $/.github/actions/setup-zigbuild
+        with:
+          target: ${{ matrix.build.target }}
+          rust_components: rust-src
+          install_target: "true"
+          use_cache: "false"
+
+      - name: Select patched Cargo
+        if: matrix.runner == 'ubuntu-24.04-arm'
+        run: |
+          chmod +x "$GITHUB_WORKSPACE/patched-cargo/cargo"
+          echo "$GITHUB_WORKSPACE/patched-cargo" >> "$GITHUB_PATH"
+          echo "CARGO=$GITHUB_WORKSPACE/patched-cargo/cargo" >> "$GITHUB_ENV"
+
+      - name: Verify patched Cargo selection
+        if: matrix.runner == 'ubuntu-24.04-arm'
+        run: |
+          test "$(command -v cargo)" = "$CARGO"
+          echo "Using patched Cargo: $CARGO"
+
+      - name: Configure reproducible builds
+        run: |
+          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
+          echo "TZ=UTC" >> "$GITHUB_ENV"
+          echo "LC_ALL=C" >> "$GITHUB_ENV"
+          RUST_SYSROOT=$(rustc --print sysroot)
+          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
+
+      - name: Build with Zig
+        run: |
+          rustc -vV
+          cargo -vV
+          cargo auditable zigbuild -vv --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
+
+      - name: Create release archive
+        run: |
+          mkdir -p artifacts
+          cp "target/${TARGET}/release/celq" artifacts/celq
+          tar --version
+          gzip --version
+          tar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
+            --owner=0 --group=0 --numeric-owner --mode=0755 \
+            -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
+          gzip -n -9 artifacts/celq.tar
+
+      - name: Upload archive and binary
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-${{ matrix.runner }}
+          retention-days: 1
+          path: |
+            artifacts/celq
+            artifacts/celq.tar.gz
+          if-no-files-found: error
+          compression-level: 0
+
+  freebsd:
+    name: Zigbuild (FreeBSD x86-64, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
+    needs: [patched_cargo, freebsd_tools]
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        build:
+          - target: aarch64-unknown-linux-gnu
+            zigtargetsuffix: .2.28
+          - target: aarch64-unknown-linux-musl
+            zigtargetsuffix: ""
+    env:
+      TARGET: ${{ matrix.build.target }}
+      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Capture commit timestamp
+        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
+
+      - name: Download patched Cargo
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: patched-cargo-x86_64-unknown-freebsd
+          path: patched-cargo
+
+      - name: Download FreeBSD tools
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: freebsd-tools-x86_64
+          path: freebsd-tools
+
+      - name: Build on FreeBSD
+        uses: vmactions/freebsd-vm@f0552d3b69211736abd97f02ff3d4674c56b73b1 # v1.5.5
+        with:
+          release: "14.4"
+          arch: x86_64
+          sync: rsync
+          copyback: true
+          envs: TARGET ZIGTARGETSUFFIX SOURCE_DATE_EPOCH
+          prepare: |
+            set -eu
+            pkg install -y ca_root_nss git devel/rustup-init archivers/gtar archivers/gzip
+
+            # Install the official FreeBSD Zig archive directly from ziglang.org.
+            cd /tmp
+            fetch https://ziglang.org/download/0.15.2/zig-x86_64-freebsd-0.15.2.tar.xz
+            test "$(sha256 -q zig-x86_64-freebsd-0.15.2.tar.xz)" = \
+              "5509ff57cd3f219165caed0da10221739af82742b9edfcda3f7bfaf4da7212dd"
+            tar -xf zig-x86_64-freebsd-0.15.2.tar.xz
+
+            rustup-init -y --profile minimal --default-toolchain 1.94.1
+            . "$HOME/.cargo/env"
+            rustup component add rust-src --toolchain 1.94.1
+
+          run: |
+            set -eu
+            . "$HOME/.cargo/env"
+            install -m 755 freebsd-tools/cargo-zigbuild "$HOME/.cargo/bin/"
+            mkdir -p /home/runner/.cargo/bin
+            install -m 755 freebsd-tools/cargo-auditable /home/runner/.cargo/bin/cargo-auditable
+            export PATH="/home/runner/.cargo/bin:/tmp/zig-x86_64-freebsd-0.15.2:$PATH"
+            test "$(command -v cargo-auditable)" = /home/runner/.cargo/bin/cargo-auditable
+            rustup target add --toolchain 1.94.1 "$TARGET"
+
+            # Host job environment variables are not inherited by the VM.
+            export RUSTUP_TOOLCHAIN=1.94.1
+            export CARGO_TERM_COLOR=always TZ=UTC LC_ALL=C
+            export SOURCE_DATE_EPOCH
+            RUST_SYSROOT=$(rustc --print sysroot)
+            export RUSTFLAGS="--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=$(pwd -P)=/src"
+            export CARGO="$(pwd -P)/patched-cargo/cargo"
+            chmod +x "$CARGO"
+            export PATH="$(pwd -P)/patched-cargo:$PATH"
+            test "$(command -v cargo)" = "$CARGO"
+            echo "Using patched Cargo: $CARGO"
+            rustc -vV
+            "$CARGO" -vV
+            "$CARGO" auditable zigbuild -vv --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
+
+            mkdir -p artifacts
+            cp "target/${TARGET}/release/celq" artifacts/celq
+            gtar --version
+            /usr/local/bin/gzip --version
+            gtar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
+              --owner=0 --group=0 --numeric-owner --mode=0755 \
+              -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
+            /usr/local/bin/gzip -n -9 artifacts/celq.tar
+
+      - name: Upload archive and binary
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-freebsd-x86_64
+          retention-days: 1
+          path: |
+            artifacts/celq
+            artifacts/celq.tar.gz
+          if-no-files-found: error
+          compression-level: 0
+
+  hashes:
+    name: SHA-256 (${{ matrix.pair.target }}, ${{ matrix.original }} vs ${{ matrix.pair.verify }})
+    needs: [zigbuild, freebsd]
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        original: [ubuntu-24.04]
+        pair:
+          - target: x86_64-unknown-linux-gnu.2.28
+            verify: ubuntu-24.04-arm
+          - target: x86_64-unknown-linux-musl
+            verify: ubuntu-24.04-arm
+          - target: aarch64-unknown-linux-gnu.2.28
+            verify: freebsd-x86_64
+          - target: aarch64-unknown-linux-musl
+            verify: freebsd-x86_64
+    steps:
+      - name: Download original artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-${{ matrix.pair.target }}-${{ matrix.original }}
+          path: artifacts/${{ matrix.original }}
+
+      - name: Download verification artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-${{ matrix.pair.target }}-${{ matrix.pair.verify }}
+          path: artifacts/${{ matrix.pair.verify }}
+
+      - name: Print and compare SHA-256 hashes
+        env:
+          ORIGINAL: ${{ matrix.original }}
+          VERIFY: ${{ matrix.pair.verify }}
+        run: |
+          find artifacts -type f -exec sha256sum {} +
+          (cd "artifacts/$ORIGINAL" && sha256sum celq celq.tar.gz) > original.sha256
+          (cd "artifacts/$VERIFY" && sha256sum celq celq.tar.gz) > verification.sha256
+          diff -u original.sha256 verification.sha256
diff --git a/.github/workflows/reproducible_manual_xwin.yml b/.github/workflows/reproducible_manual_xwin.yml
deleted file mode 100644
index fc3f19a..0000000
--- a/.github/workflows/reproducible_manual_xwin.yml
+++ /dev/null
@@ -1,199 +0,0 @@
-name: Reproducible Xwin builds (Manual)
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  patched_cargo:
-    name: Patched Cargo (Windows ARM64)
-    runs-on: windows-2025
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Checkout Cargo source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          repository: rust-lang/cargo
-          ref: 29ea6fb6a5db279426f4cc4e17aa385f05a0cfbc
-          path: cargo-source
-          persist-credentials: false
-          fetch-depth: 1
-          sparse-checkout: |
-            src
-            crates
-            credential
-            benches/benchsuite
-            benches/capture
-
-      - name: Install Rust 1.94.1 with Windows ARM64 target
-        uses: dtolnay/rust-toolchain@9376cdc5a5e25b16da71af47712785cf06b0d6d4 # 1.94.1
-        with:
-          targets: aarch64-pc-windows-msvc
-
-      - name: Patch Cargo metadata
-        working-directory: cargo-source
-        run: |
-          git apply --check ../.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
-          git apply ../.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
-
-      - name: Cross-compile patched Cargo for Windows ARM64
-        working-directory: cargo-source
-        env:
-          CFG_RELEASE: 1.94.1
-          CFG_RELEASE_CHANNEL: stable
-          CFG_VER_DESCRIPTION: windows-x86_64-metadata-patch
-          LIBZ_SYS_STATIC: "1"
-        run: >-
-          cargo build --locked --release --package cargo --bin cargo
-          --features all-static --target aarch64-pc-windows-msvc
-
-      - name: Upload patched Cargo
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: patched-cargo-aarch64-pc-windows-msvc
-          path: cargo-source/target/aarch64-pc-windows-msvc/release/cargo.exe
-          retention-days: 1
-          if-no-files-found: error
-
-  xwin:
-    name: Xwin (${{ matrix.runner }}, ${{ matrix.target }})
-    needs: patched_cargo
-    runs-on: ${{ matrix.runner }}
-    defaults:
-      run:
-        shell: bash
-    strategy:
-      fail-fast: false
-      matrix:
-        runner: [windows-2025, windows-11-vs2026-arm]
-        target: &xwin_targets
-          - x86_64-pc-windows-msvc
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Select native Windows ARM64 Rust host
-        if: runner.arch == 'ARM64'
-        run: |
-          rustup set default-host aarch64-pc-windows-msvc
-          echo "RUSTUP_TOOLCHAIN=1.94.1-aarch64-pc-windows-msvc" >> "$GITHUB_ENV"
-
-      - name: Setup Xwin
-        id: setup-xwin
-        uses: $/.github/actions/setup-xwin
-        with:
-          target: ${{ matrix.target }}
-          rust_components: llvm-tools
-          cache_directory: ${{ github.workspace }}/.xwin-cache
-          use_cache: "true"
-
-      - name: Verify native Windows ARM64 compiler
-        if: runner.arch == 'ARM64'
-        run: |
-          rustc -vV
-          test "$(rustc -vV | sed -n 's/^host: //p' | tr -d '\r')" = aarch64-pc-windows-msvc
-
-      - name: Download patched Cargo
-        if: runner.arch == 'ARM64'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: patched-cargo-aarch64-pc-windows-msvc
-          path: patched-cargo
-
-      - name: Select patched Cargo
-        if: runner.arch == 'ARM64'
-        run: |
-          echo "$(cygpath -aw "$GITHUB_WORKSPACE/patched-cargo")" >> "$GITHUB_PATH"
-          echo "CARGO=$(cygpath -aw "$GITHUB_WORKSPACE/patched-cargo/cargo.exe")" >> "$GITHUB_ENV"
-
-      - name: Verify patched Cargo selection
-        if: runner.arch == 'ARM64'
-        run: |
-          test "$(cygpath -aw "$(command -v cargo)")" = "$CARGO"
-          echo "Using patched Cargo: $CARGO"
-
-      - name: Configure reproducible builds
-        run: |
-          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
-          echo "TZ=UTC" >> "$GITHUB_ENV"
-          echo "LC_ALL=C" >> "$GITHUB_ENV"
-          RUST_SYSROOT=$(rustc --print sysroot)
-          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
-
-      - name: Print Xwin toolchain diagnostics
-        run: |
-          rustc -vV
-          cargo -vV
-          rustup show active-toolchain
-          command -v cargo-xwin
-          cargo xwin --version
-          command -v clang-cl
-          clang-cl --version
-          command -v lld-link
-          lld-link --version
-
-      - name: Build with Xwin
-        env:
-          TARGET: ${{ matrix.target }}
-          XWIN_CACHE_DIR: ${{ steps.setup-xwin.outputs.cache_directory }}
-          XWIN_CRT_VERSION: ${{ steps.setup-xwin.outputs.xwin_crt_version }}
-          XWIN_SDK_VERSION: ${{ steps.setup-xwin.outputs.xwin_sdk_version }}
-          XWIN_VERSION: ${{ steps.setup-xwin.outputs.xwin_version }}
-        run: >-
-          cargo xwin build -vv --locked --release --target "${TARGET}"
-          --no-default-features --features from-toml,from-yaml,greppable,from-xml
-          --xwin-version "${XWIN_VERSION}"
-          --xwin-sdk-version "${XWIN_SDK_VERSION}"
-          --xwin-crt-version "${XWIN_CRT_VERSION}"
-
-      - name: Upload Windows binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: reproducible-xwin-${{ matrix.target }}-${{ matrix.runner }}
-          path: target/${{ matrix.target }}/release/celq.exe
-          retention-days: 1
-          if-no-files-found: error
-          compression-level: 0
-
-  xwin_hashes:
-    name: Xwin SHA-256 (${{ matrix.target }}, Windows x86-64 vs ARM64)
-    needs: xwin
-    if: ${{ !cancelled() }}
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        target: *xwin_targets
-    steps:
-      - name: Download Windows x86-64-built binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: reproducible-xwin-${{ matrix.target }}-windows-2025
-          path: artifacts/windows-2025
-
-      - name: Download Windows ARM64-built binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: reproducible-xwin-${{ matrix.target }}-windows-11-vs2026-arm
-          path: artifacts/windows-11-vs2026-arm
-
-      - name: Print and compare SHA-256 hashes
-        run: |
-          sha256sum artifacts/windows-2025/celq.exe artifacts/windows-11-vs2026-arm/celq.exe
-          (cd artifacts/windows-2025 && sha256sum celq.exe) > original.sha256
-          (cd artifacts/windows-11-vs2026-arm && sha256sum celq.exe) > verification.sha256
-          diff -u original.sha256 verification.sha256

From e04bb915ff0ac2fd4677db8cca4e6313067a329d Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 06:43:34 -0400
Subject: [PATCH 19/34] Fix cargo patching

---
 .github/workflows/manual_reproducible.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index fc3f19a..a4355ba 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -17,6 +17,9 @@ jobs:
       run:
         shell: bash
     steps:
+      - name: Preserve LF line endings for Cargo patching
+        run: git config --global core.autocrlf false
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ github.sha }}

From 468cf174bc822b5416ba48bcf5e9b3910097253f Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 08:02:16 -0400
Subject: [PATCH 20/34] Another custom cargo patch

---
 .../patches/cargo-windows-x86_64-metadata.patch | 17 +----------------
 1 file changed, 1 insertion(+), 16 deletions(-)

diff --git a/.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch b/.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
index 7ad9f37..4d9bab2 100644
--- a/.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
+++ b/.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
@@ -1,22 +1,7 @@
 diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/cargo/core/compiler/build_runner/compilation_files.rs
 --- a/src/cargo/core/compiler/build_runner/compilation_files.rs
 +++ b/src/cargo/core/compiler/build_runner/compilation_files.rs
-@@ -793,6 +793,14 @@
-                 .links_overrides
-                 != unit.links_overrides;
-         target_configs_are_different.hash(&mut shared_hasher);
-+    } else if unit.kind.is_host()
-+        && bcx.build_config.requested_kinds.iter().any(|kind| {
-+            matches!(kind, CompileKind::Target(target) if target.short_name() == "x86_64-pc-windows-msvc")
-+        })
-+    {
-+        // Reproducible fix: match the Windows x86-64 baseline host hash.
-+        // Change hash input only, not the actual host configuration or compiler flags.
-+        false.hash(&mut shared_hasher);
-     }
-
-     let mut c_metadata_hasher = shared_hasher.clone();
-@@ -864,6 +872,12 @@
+@@ -864,6 +864,12 @@
          for line in bcx.rustc().verbose_version.lines() {
              if unit.kind.is_host() || !line.starts_with("host: ") {
 +                // Normalize hash input only; keep the real host for compilation.

From 4dbc58f13467006a7c93e23e6f0b1dbfb25fab99 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 17:32:33 -0400
Subject: [PATCH 21/34] pdb for debugging

---
 .github/workflows/manual_reproducible.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index a4355ba..4fb5ac0 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -151,6 +151,7 @@ jobs:
 
       - name: Build with Xwin
         env:
+          RUSTC_LOG: rustc_codegen_ssa::back::link=info
           TARGET: ${{ matrix.target }}
           XWIN_CACHE_DIR: ${{ steps.setup-xwin.outputs.cache_directory }}
           XWIN_CRT_VERSION: ${{ steps.setup-xwin.outputs.xwin_crt_version }}
@@ -163,11 +164,13 @@ jobs:
           --xwin-sdk-version "${XWIN_SDK_VERSION}"
           --xwin-crt-version "${XWIN_CRT_VERSION}"
 
-      - name: Upload Windows binary
+      - name: Upload Windows binary and PDB
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: reproducible-xwin-${{ matrix.target }}-${{ matrix.runner }}
-          path: target/${{ matrix.target }}/release/celq.exe
+          path: |
+            target/${{ matrix.target }}/release/celq.exe
+            target/${{ matrix.target }}/release/celq.pdb
           retention-days: 1
           if-no-files-found: error
           compression-level: 0

From 2a6020b327a6d3e26c80033e918c0ac5b0fa9789 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 17:54:54 -0400
Subject: [PATCH 22/34] Do not generate PDB for Windows build

---
 .github/workflows/manual_reproducible.yml | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index 4fb5ac0..47e1561 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -135,7 +135,7 @@ jobs:
           echo "TZ=UTC" >> "$GITHUB_ENV"
           echo "LC_ALL=C" >> "$GITHUB_ENV"
           RUST_SYSROOT=$(rustc --print sysroot)
-          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
+          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src -C link-arg=/DEBUG:NONE" >> "$GITHUB_ENV"
 
       - name: Print Xwin toolchain diagnostics
         run: |
@@ -164,13 +164,11 @@ jobs:
           --xwin-sdk-version "${XWIN_SDK_VERSION}"
           --xwin-crt-version "${XWIN_CRT_VERSION}"
 
-      - name: Upload Windows binary and PDB
+      - name: Upload Windows binary
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: reproducible-xwin-${{ matrix.target }}-${{ matrix.runner }}
-          path: |
-            target/${{ matrix.target }}/release/celq.exe
-            target/${{ matrix.target }}/release/celq.pdb
+          path: target/${{ matrix.target }}/release/celq.exe
           retention-days: 1
           if-no-files-found: error
           compression-level: 0

From 2683ed23229d18d8d2750811315b8b8cc1f5c388 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 18:03:09 -0400
Subject: [PATCH 23/34] Force windows arm64 cargo xwin

---
 .github/actions/setup-xwin/action.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/actions/setup-xwin/action.yml b/.github/actions/setup-xwin/action.yml
index be6517e..ad0871e 100644
--- a/.github/actions/setup-xwin/action.yml
+++ b/.github/actions/setup-xwin/action.yml
@@ -60,10 +60,16 @@ runs:
         components: ${{ inputs.rust_components }}
 
     - name: Install cargo-xwin
+      if: runner.os != 'Windows' || runner.arch != 'ARM64'
       uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2
       with:
         tool: cargo-xwin@0.23.1
-        fallback: ${{ runner.os == 'Windows' && runner.arch == 'ARM64' && 'cargo-install' || 'none' }}
+        fallback: none
+
+    - name: Compile cargo-xwin for Windows ARM64
+      if: runner.os == 'Windows' && runner.arch == 'ARM64'
+      shell: bash
+      run: cargo install --locked --version 0.23.1 --target aarch64-pc-windows-msvc --force cargo-xwin
 
     - name: Install cargo-auditable
       uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2

From 9b027965ea62b7597a38e34ae88f72f8f4bbb5a3 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 18:32:04 -0400
Subject: [PATCH 24/34] Upload zip as well

---
 .github/actions/setup-xwin/action.yml     |  6 -----
 .github/workflows/manual_reproducible.yml | 30 +++++++++++++++++------
 2 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/.github/actions/setup-xwin/action.yml b/.github/actions/setup-xwin/action.yml
index ad0871e..9c3c38b 100644
--- a/.github/actions/setup-xwin/action.yml
+++ b/.github/actions/setup-xwin/action.yml
@@ -60,17 +60,11 @@ runs:
         components: ${{ inputs.rust_components }}
 
     - name: Install cargo-xwin
-      if: runner.os != 'Windows' || runner.arch != 'ARM64'
       uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2
       with:
         tool: cargo-xwin@0.23.1
         fallback: none
 
-    - name: Compile cargo-xwin for Windows ARM64
-      if: runner.os == 'Windows' && runner.arch == 'ARM64'
-      shell: bash
-      run: cargo install --locked --version 0.23.1 --target aarch64-pc-windows-msvc --force cargo-xwin
-
     - name: Install cargo-auditable
       uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2
       with:
diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index 47e1561..ad95a47 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -164,11 +164,27 @@ jobs:
           --xwin-sdk-version "${XWIN_SDK_VERSION}"
           --xwin-crt-version "${XWIN_CRT_VERSION}"
 
-      - name: Upload Windows binary
+      - name: Create release archive
+        env:
+          NAME: celq
+          PRETTY_TARGET: windows-x86_64
+          TARGET: ${{ matrix.target }}
+        run: |
+          BIN_PATH="target/${TARGET}/release/${NAME}.exe"
+          ARCHIVE_NAME="${NAME}-${PRETTY_TARGET}.zip"
+          7z a "${ARCHIVE_NAME}" "./${BIN_PATH}"
+          7z rn "${ARCHIVE_NAME}" "target/${TARGET}/release/${NAME}.exe" "${NAME}.exe"
+
+          mkdir -p artifacts
+          cp "${BIN_PATH}" "${ARCHIVE_NAME}" artifacts/
+
+      - name: Upload Windows binary and archive
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: reproducible-xwin-${{ matrix.target }}-${{ matrix.runner }}
-          path: target/${{ matrix.target }}/release/celq.exe
+          path: |
+            artifacts/celq.exe
+            artifacts/celq-windows-x86_64.zip
           retention-days: 1
           if-no-files-found: error
           compression-level: 0
@@ -183,13 +199,13 @@ jobs:
       matrix:
         target: *xwin_targets
     steps:
-      - name: Download Windows x86-64-built binary
+      - name: Download Windows x86-64 artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: reproducible-xwin-${{ matrix.target }}-windows-2025
           path: artifacts/windows-2025
 
-      - name: Download Windows ARM64-built binary
+      - name: Download Windows ARM64 artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: reproducible-xwin-${{ matrix.target }}-windows-11-vs2026-arm
@@ -197,7 +213,7 @@ jobs:
 
       - name: Print and compare SHA-256 hashes
         run: |
-          sha256sum artifacts/windows-2025/celq.exe artifacts/windows-11-vs2026-arm/celq.exe
-          (cd artifacts/windows-2025 && sha256sum celq.exe) > original.sha256
-          (cd artifacts/windows-11-vs2026-arm && sha256sum celq.exe) > verification.sha256
+          find artifacts -type f -exec sha256sum {} +
+          (cd artifacts/windows-2025 && sha256sum celq.exe celq-windows-x86_64.zip) > original.sha256
+          (cd artifacts/windows-11-vs2026-arm && sha256sum celq.exe celq-windows-x86_64.zip) > verification.sha256
           diff -u original.sha256 verification.sha256

From c6cdce6aef1eb7ae96b5a6af4fcefddb1bda9273 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 18:57:47 -0400
Subject: [PATCH 25/34] Reproducible 7z for zips

---
 .github/workflows/manual_reproducible.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index ad95a47..3ee1fe8 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -172,8 +172,9 @@ jobs:
         run: |
           BIN_PATH="target/${TARGET}/release/${NAME}.exe"
           ARCHIVE_NAME="${NAME}-${PRETTY_TARGET}.zip"
-          7z a "${ARCHIVE_NAME}" "./${BIN_PATH}"
+          7z a -mtm=off -mtc=off -mta=off "${ARCHIVE_NAME}" "./${BIN_PATH}"
           7z rn "${ARCHIVE_NAME}" "target/${TARGET}/release/${NAME}.exe" "${NAME}.exe"
+          7z l -slt "${ARCHIVE_NAME}"
 
           mkdir -p artifacts
           cp "${BIN_PATH}" "${ARCHIVE_NAME}" artifacts/

From 8e5a2ecb2e807eed9c246c35cf13bc0dcbc8cbea Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 19:21:41 -0400
Subject: [PATCH 26/34] Tidy up

---
 .../cargo-windows-x86_64-metadata.patch       |   2 +-
 .github/workflows/manual_reproducible.yml     | 367 +++++++++++++++++-
 .github/workflows/manual_reproducible.yml.bak | 365 -----------------
 .github/workflows/release_github.yml          |   4 +-
 4 files changed, 352 insertions(+), 386 deletions(-)
 delete mode 100644 .github/workflows/manual_reproducible.yml.bak

diff --git a/.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch b/.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
index 4d9bab2..fe32b8b 100644
--- a/.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
+++ b/.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
@@ -14,7 +14,7 @@ diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/car
              }
          }
          return;
-@@ -881,3 +895,3 @@
+@@ -881,3 +887,3 @@
      if unit.kind.is_host() {
 -        bcx.rustc().host.hash(hasher);
 +        "x86_64-pc-windows-msvc".hash(hasher);
diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index 3ee1fe8..ee73a2d 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -1,4 +1,4 @@
-name: Reproducible Xwin builds (Manual)
+name: Reproducible builds (Manual)
 
 on:
   workflow_dispatch:
@@ -11,6 +11,352 @@ env:
 
 jobs:
   patched_cargo:
+    name: Patched Cargo (${{ matrix.target }})
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [aarch64-unknown-linux-gnu, x86_64-unknown-freebsd]
+    env:
+      TARGET: ${{ matrix.target }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Checkout Cargo source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: rust-lang/cargo
+          ref: 29ea6fb6a5db279426f4cc4e17aa385f05a0cfbc
+          path: cargo-source
+          persist-credentials: false
+          fetch-depth: 1
+          sparse-checkout: |
+            src
+            crates
+            credential
+            benches/benchsuite
+            benches/capture
+
+      - name: Setup Zigbuild
+        uses: $/.github/actions/setup-zigbuild
+        with:
+          target: ${{ matrix.target }}
+          rust_components: rust-src
+          install_target: "true"
+          use_cache: "false"
+
+      - name: Patch Cargo
+        working-directory: cargo-source
+        run: |
+          git apply --check ../.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
+          git apply ../.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
+
+      - name: Build patched Cargo with Zig
+        working-directory: cargo-source
+        env:
+          CFG_RELEASE: 1.94.1
+          CFG_RELEASE_CHANNEL: stable
+          CFG_VER_DESCRIPTION: linux-x86_64-metadata-patch
+          LIBZ_SYS_STATIC: "1"
+        run: |
+          cargo zigbuild --locked --release --package cargo --bin cargo --features all-static --target "$TARGET"
+
+      - name: Upload patched Cargo
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: patched-cargo-${{ matrix.target }}
+          path: cargo-source/target/${{ matrix.target }}/release/cargo
+          retention-days: 1
+          if-no-files-found: error
+
+  freebsd_tools:
+    name: Build FreeBSD tools
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Setup Zigbuild
+        uses: $/.github/actions/setup-zigbuild
+        with:
+          target: x86_64-unknown-freebsd
+          rust_components: rust-src
+          install_target: "true"
+          use_cache: "false"
+
+      - name: Install cargo-clone
+        run: |
+          /home/linuxbrew/.linuxbrew/bin/brew install --force-bottle cargo-clone
+          echo "/home/linuxbrew/.linuxbrew/bin" >> "$GITHUB_PATH"
+
+      - name: Download tool sources
+        run: cargo clone cargo-zigbuild@0.23.2 cargo-auditable@0.7.5 -- freebsd-tool-sources/
+
+      - name: Cross-compile cargo-zigbuild
+        run: |
+          cargo zigbuild --locked --release --bin cargo-zigbuild --target x86_64-unknown-freebsd \
+            --manifest-path freebsd-tool-sources/cargo-zigbuild/Cargo.toml \
+            --target-dir "$GITHUB_WORKSPACE/freebsd-tools-build"
+
+      - name: Cross-compile cargo-auditable
+        run: |
+          cargo zigbuild --locked --release --bin cargo-auditable --target x86_64-unknown-freebsd \
+            --manifest-path freebsd-tool-sources/cargo-auditable/Cargo.toml \
+            --target-dir "$GITHUB_WORKSPACE/freebsd-tools-build"
+
+      - name: Upload FreeBSD tools
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: freebsd-tools-x86_64
+          path: |
+            freebsd-tools-build/x86_64-unknown-freebsd/release/cargo-zigbuild
+            freebsd-tools-build/x86_64-unknown-freebsd/release/cargo-auditable
+          retention-days: 1
+          if-no-files-found: error
+
+  zigbuild:
+    name: Zigbuild (${{ matrix.runner }}, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
+    needs: patched_cargo
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-24.04, ubuntu-24.04-arm]
+        build:
+          - target: x86_64-unknown-linux-gnu
+            zigtargetsuffix: .2.28
+          - target: x86_64-unknown-linux-musl
+            zigtargetsuffix: ""
+          - target: aarch64-unknown-linux-gnu
+            zigtargetsuffix: .2.28
+          - target: aarch64-unknown-linux-musl
+            zigtargetsuffix: ""
+        exclude:
+          - runner: ubuntu-24.04-arm
+            build:
+              target: aarch64-unknown-linux-gnu
+              zigtargetsuffix: .2.28
+          - runner: ubuntu-24.04-arm
+            build:
+              target: aarch64-unknown-linux-musl
+              zigtargetsuffix: ""
+    env:
+      TARGET: ${{ matrix.build.target }}
+      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
+    steps:
+      # Every host builds the same HEAD captured by the manual dispatch.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Download patched Cargo
+        if: matrix.runner == 'ubuntu-24.04-arm'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: patched-cargo-aarch64-unknown-linux-gnu
+          path: patched-cargo
+
+      - name: Setup Zigbuild
+        uses: $/.github/actions/setup-zigbuild
+        with:
+          target: ${{ matrix.build.target }}
+          rust_components: rust-src
+          install_target: "true"
+          use_cache: "false"
+
+      - name: Select patched Cargo
+        if: matrix.runner == 'ubuntu-24.04-arm'
+        run: |
+          chmod +x "$GITHUB_WORKSPACE/patched-cargo/cargo"
+          echo "$GITHUB_WORKSPACE/patched-cargo" >> "$GITHUB_PATH"
+          echo "CARGO=$GITHUB_WORKSPACE/patched-cargo/cargo" >> "$GITHUB_ENV"
+
+      - name: Verify patched Cargo selection
+        if: matrix.runner == 'ubuntu-24.04-arm'
+        run: |
+          test "$(command -v cargo)" = "$CARGO"
+          echo "Using patched Cargo: $CARGO"
+
+      - name: Configure reproducible builds
+        run: |
+          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
+          echo "TZ=UTC" >> "$GITHUB_ENV"
+          echo "LC_ALL=C" >> "$GITHUB_ENV"
+          RUST_SYSROOT=$(rustc --print sysroot)
+          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
+
+      - name: Build with Zig
+        run: |
+          cargo auditable zigbuild --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
+
+      - name: Create release archive
+        run: |
+          mkdir -p artifacts
+          cp "target/${TARGET}/release/celq" artifacts/celq
+          tar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
+            --owner=0 --group=0 --numeric-owner --mode=0755 \
+            -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
+          gzip -n -9 artifacts/celq.tar
+
+      - name: Upload archive and binary
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-${{ matrix.runner }}
+          retention-days: 1
+          path: |
+            artifacts/celq
+            artifacts/celq.tar.gz
+          if-no-files-found: error
+          compression-level: 0
+
+  freebsd:
+    name: Zigbuild (FreeBSD x86-64, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
+    needs: [patched_cargo, freebsd_tools]
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        build:
+          - target: aarch64-unknown-linux-gnu
+            zigtargetsuffix: .2.28
+          - target: aarch64-unknown-linux-musl
+            zigtargetsuffix: ""
+    env:
+      TARGET: ${{ matrix.build.target }}
+      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Capture commit timestamp
+        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
+
+      - name: Download patched Cargo
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: patched-cargo-x86_64-unknown-freebsd
+          path: patched-cargo
+
+      - name: Download FreeBSD tools
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: freebsd-tools-x86_64
+          path: freebsd-tools
+
+      - name: Build on FreeBSD
+        uses: vmactions/freebsd-vm@f0552d3b69211736abd97f02ff3d4674c56b73b1 # v1.5.5
+        with:
+          release: "14.4"
+          arch: x86_64
+          sync: rsync
+          copyback: true
+          envs: TARGET ZIGTARGETSUFFIX SOURCE_DATE_EPOCH
+          prepare: |
+            set -eu
+            pkg install -y ca_root_nss git devel/rustup-init archivers/gtar archivers/gzip
+
+            # Install the official FreeBSD Zig archive directly from ziglang.org.
+            cd /tmp
+            fetch https://ziglang.org/download/0.15.2/zig-x86_64-freebsd-0.15.2.tar.xz
+            test "$(sha256 -q zig-x86_64-freebsd-0.15.2.tar.xz)" = \
+              "5509ff57cd3f219165caed0da10221739af82742b9edfcda3f7bfaf4da7212dd"
+            tar -xf zig-x86_64-freebsd-0.15.2.tar.xz
+
+            rustup-init -y --profile minimal --default-toolchain 1.94.1
+            . "$HOME/.cargo/env"
+            rustup component add rust-src --toolchain 1.94.1
+
+          run: |
+            set -eu
+            . "$HOME/.cargo/env"
+            install -m 755 freebsd-tools/cargo-zigbuild "$HOME/.cargo/bin/"
+            mkdir -p /home/runner/.cargo/bin
+            install -m 755 freebsd-tools/cargo-auditable /home/runner/.cargo/bin/cargo-auditable
+            export PATH="/home/runner/.cargo/bin:/tmp/zig-x86_64-freebsd-0.15.2:$PATH"
+            test "$(command -v cargo-auditable)" = /home/runner/.cargo/bin/cargo-auditable
+            rustup target add --toolchain 1.94.1 "$TARGET"
+
+            # Host job environment variables are not inherited by the VM.
+            export RUSTUP_TOOLCHAIN=1.94.1
+            export CARGO_TERM_COLOR=always TZ=UTC LC_ALL=C
+            export SOURCE_DATE_EPOCH
+            RUST_SYSROOT=$(rustc --print sysroot)
+            export RUSTFLAGS="--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=$(pwd -P)=/src"
+            export CARGO="$(pwd -P)/patched-cargo/cargo"
+            chmod +x "$CARGO"
+            export PATH="$(pwd -P)/patched-cargo:$PATH"
+            test "$(command -v cargo)" = "$CARGO"
+            echo "Using patched Cargo: $CARGO"
+            "$CARGO" auditable zigbuild --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
+
+            mkdir -p artifacts
+            cp "target/${TARGET}/release/celq" artifacts/celq
+            gtar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
+              --owner=0 --group=0 --numeric-owner --mode=0755 \
+              -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
+            /usr/local/bin/gzip -n -9 artifacts/celq.tar
+
+      - name: Upload archive and binary
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-freebsd-x86_64
+          retention-days: 1
+          path: |
+            artifacts/celq
+            artifacts/celq.tar.gz
+          if-no-files-found: error
+          compression-level: 0
+
+  hashes:
+    name: SHA-256 (${{ matrix.pair.target }}, ${{ matrix.original }} vs ${{ matrix.pair.verify }})
+    needs: [zigbuild, freebsd]
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        original: [ubuntu-24.04]
+        pair:
+          - target: x86_64-unknown-linux-gnu.2.28
+            verify: ubuntu-24.04-arm
+          - target: x86_64-unknown-linux-musl
+            verify: ubuntu-24.04-arm
+          - target: aarch64-unknown-linux-gnu.2.28
+            verify: freebsd-x86_64
+          - target: aarch64-unknown-linux-musl
+            verify: freebsd-x86_64
+    steps:
+      - name: Download original artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-${{ matrix.pair.target }}-${{ matrix.original }}
+          path: artifacts/${{ matrix.original }}
+
+      - name: Download verification artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-${{ matrix.pair.target }}-${{ matrix.pair.verify }}
+          path: artifacts/${{ matrix.pair.verify }}
+
+      - name: Print and compare SHA-256 hashes
+        env:
+          ORIGINAL: ${{ matrix.original }}
+          VERIFY: ${{ matrix.pair.verify }}
+        run: |
+          find artifacts -type f -exec sha256sum {} +
+          (cd "artifacts/$ORIGINAL" && sha256sum celq celq.tar.gz) > original.sha256
+          (cd "artifacts/$VERIFY" && sha256sum celq celq.tar.gz) > verification.sha256
+          diff -u original.sha256 verification.sha256
+
+  patched_cargo_windows:
     name: Patched Cargo (Windows ARM64)
     runs-on: windows-2025
     defaults:
@@ -72,7 +418,7 @@ jobs:
 
   xwin:
     name: Xwin (${{ matrix.runner }}, ${{ matrix.target }})
-    needs: patched_cargo
+    needs: patched_cargo_windows
     runs-on: ${{ matrix.runner }}
     defaults:
       run:
@@ -107,7 +453,6 @@ jobs:
       - name: Verify native Windows ARM64 compiler
         if: runner.arch == 'ARM64'
         run: |
-          rustc -vV
           test "$(rustc -vV | sed -n 's/^host: //p' | tr -d '\r')" = aarch64-pc-windows-msvc
 
       - name: Download patched Cargo
@@ -137,28 +482,15 @@ jobs:
           RUST_SYSROOT=$(rustc --print sysroot)
           echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src -C link-arg=/DEBUG:NONE" >> "$GITHUB_ENV"
 
-      - name: Print Xwin toolchain diagnostics
-        run: |
-          rustc -vV
-          cargo -vV
-          rustup show active-toolchain
-          command -v cargo-xwin
-          cargo xwin --version
-          command -v clang-cl
-          clang-cl --version
-          command -v lld-link
-          lld-link --version
-
       - name: Build with Xwin
         env:
-          RUSTC_LOG: rustc_codegen_ssa::back::link=info
           TARGET: ${{ matrix.target }}
           XWIN_CACHE_DIR: ${{ steps.setup-xwin.outputs.cache_directory }}
           XWIN_CRT_VERSION: ${{ steps.setup-xwin.outputs.xwin_crt_version }}
           XWIN_SDK_VERSION: ${{ steps.setup-xwin.outputs.xwin_sdk_version }}
           XWIN_VERSION: ${{ steps.setup-xwin.outputs.xwin_version }}
         run: >-
-          cargo xwin build -vv --locked --release --target "${TARGET}"
+          cargo xwin build --locked --release --target "${TARGET}"
           --no-default-features --features from-toml,from-yaml,greppable,from-xml
           --xwin-version "${XWIN_VERSION}"
           --xwin-sdk-version "${XWIN_SDK_VERSION}"
@@ -174,7 +506,6 @@ jobs:
           ARCHIVE_NAME="${NAME}-${PRETTY_TARGET}.zip"
           7z a -mtm=off -mtc=off -mta=off "${ARCHIVE_NAME}" "./${BIN_PATH}"
           7z rn "${ARCHIVE_NAME}" "target/${TARGET}/release/${NAME}.exe" "${NAME}.exe"
-          7z l -slt "${ARCHIVE_NAME}"
 
           mkdir -p artifacts
           cp "${BIN_PATH}" "${ARCHIVE_NAME}" artifacts/
diff --git a/.github/workflows/manual_reproducible.yml.bak b/.github/workflows/manual_reproducible.yml.bak
deleted file mode 100644
index 9913f60..0000000
--- a/.github/workflows/manual_reproducible.yml.bak
+++ /dev/null
@@ -1,365 +0,0 @@
-name: Reproducible builds (Manual)
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  patched_cargo:
-    name: Patched Cargo (${{ matrix.target }})
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        target: [aarch64-unknown-linux-gnu, x86_64-unknown-freebsd]
-    env:
-      TARGET: ${{ matrix.target }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Checkout Cargo source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          repository: rust-lang/cargo
-          ref: 29ea6fb6a5db279426f4cc4e17aa385f05a0cfbc
-          path: cargo-source
-          persist-credentials: false
-          fetch-depth: 1
-          sparse-checkout: |
-            src
-            crates
-            credential
-            benches/benchsuite
-            benches/capture
-
-      - name: Setup Zigbuild
-        uses: $/.github/actions/setup-zigbuild
-        with:
-          target: ${{ matrix.target }}
-          rust_components: rust-src
-          install_target: "true"
-          use_cache: "false"
-
-      - name: Patch Cargo
-        working-directory: cargo-source
-        run: |
-          git apply --check ../.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
-          git apply ../.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
-
-      - name: Build patched Cargo with Zig
-        working-directory: cargo-source
-        env:
-          CFG_RELEASE: 1.94.1
-          CFG_RELEASE_CHANNEL: stable
-          CFG_VER_DESCRIPTION: linux-x86_64-metadata-patch
-          LIBZ_SYS_STATIC: "1"
-        run: |
-          cargo zigbuild --locked --release --package cargo --bin cargo --features all-static --target "$TARGET"
-
-      - name: Upload patched Cargo
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: patched-cargo-${{ matrix.target }}
-          path: cargo-source/target/${{ matrix.target }}/release/cargo
-          retention-days: 1
-          if-no-files-found: error
-
-  freebsd_tools:
-    name: Build FreeBSD tools
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Setup Zigbuild
-        uses: $/.github/actions/setup-zigbuild
-        with:
-          target: x86_64-unknown-freebsd
-          rust_components: rust-src
-          install_target: "true"
-          use_cache: "false"
-
-      - name: Install cargo-clone
-        run: |
-          /home/linuxbrew/.linuxbrew/bin/brew install --force-bottle cargo-clone
-          echo "/home/linuxbrew/.linuxbrew/bin" >> "$GITHUB_PATH"
-
-      - name: Download tool sources
-        run: cargo clone cargo-zigbuild@0.23.2 cargo-auditable@0.7.5 -- freebsd-tool-sources/
-
-      - name: Cross-compile cargo-zigbuild
-        run: |
-          cargo zigbuild --locked --release --bin cargo-zigbuild --target x86_64-unknown-freebsd \
-            --manifest-path freebsd-tool-sources/cargo-zigbuild/Cargo.toml \
-            --target-dir "$GITHUB_WORKSPACE/freebsd-tools-build"
-
-      - name: Cross-compile cargo-auditable
-        run: |
-          cargo zigbuild --locked --release --bin cargo-auditable --target x86_64-unknown-freebsd \
-            --manifest-path freebsd-tool-sources/cargo-auditable/Cargo.toml \
-            --target-dir "$GITHUB_WORKSPACE/freebsd-tools-build"
-
-      - name: Upload FreeBSD tools
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: freebsd-tools-x86_64
-          path: |
-            freebsd-tools-build/x86_64-unknown-freebsd/release/cargo-zigbuild
-            freebsd-tools-build/x86_64-unknown-freebsd/release/cargo-auditable
-          retention-days: 1
-          if-no-files-found: error
-
-  zigbuild:
-    name: Zigbuild (${{ matrix.runner }}, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
-    needs: patched_cargo
-    runs-on: ${{ matrix.runner }}
-    strategy:
-      fail-fast: false
-      matrix:
-        runner: [ubuntu-24.04, ubuntu-24.04-arm]
-        build:
-          - target: x86_64-unknown-linux-gnu
-            zigtargetsuffix: .2.28
-          - target: x86_64-unknown-linux-musl
-            zigtargetsuffix: ""
-          - target: aarch64-unknown-linux-gnu
-            zigtargetsuffix: .2.28
-          - target: aarch64-unknown-linux-musl
-            zigtargetsuffix: ""
-        exclude:
-          - runner: ubuntu-24.04-arm
-            build:
-              target: aarch64-unknown-linux-gnu
-              zigtargetsuffix: .2.28
-          - runner: ubuntu-24.04-arm
-            build:
-              target: aarch64-unknown-linux-musl
-              zigtargetsuffix: ""
-    env:
-      TARGET: ${{ matrix.build.target }}
-      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
-    steps:
-      # Every host builds the same HEAD captured by the manual dispatch.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Download patched Cargo
-        if: matrix.runner == 'ubuntu-24.04-arm'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: patched-cargo-aarch64-unknown-linux-gnu
-          path: patched-cargo
-
-      - name: Setup Zigbuild
-        uses: $/.github/actions/setup-zigbuild
-        with:
-          target: ${{ matrix.build.target }}
-          rust_components: rust-src
-          install_target: "true"
-          use_cache: "false"
-
-      - name: Select patched Cargo
-        if: matrix.runner == 'ubuntu-24.04-arm'
-        run: |
-          chmod +x "$GITHUB_WORKSPACE/patched-cargo/cargo"
-          echo "$GITHUB_WORKSPACE/patched-cargo" >> "$GITHUB_PATH"
-          echo "CARGO=$GITHUB_WORKSPACE/patched-cargo/cargo" >> "$GITHUB_ENV"
-
-      - name: Verify patched Cargo selection
-        if: matrix.runner == 'ubuntu-24.04-arm'
-        run: |
-          test "$(command -v cargo)" = "$CARGO"
-          echo "Using patched Cargo: $CARGO"
-
-      - name: Configure reproducible builds
-        run: |
-          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
-          echo "TZ=UTC" >> "$GITHUB_ENV"
-          echo "LC_ALL=C" >> "$GITHUB_ENV"
-          RUST_SYSROOT=$(rustc --print sysroot)
-          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
-
-      - name: Build with Zig
-        run: |
-          rustc -vV
-          cargo -vV
-          cargo auditable zigbuild -vv --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
-
-      - name: Create release archive
-        run: |
-          mkdir -p artifacts
-          cp "target/${TARGET}/release/celq" artifacts/celq
-          tar --version
-          gzip --version
-          tar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
-            --owner=0 --group=0 --numeric-owner --mode=0755 \
-            -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
-          gzip -n -9 artifacts/celq.tar
-
-      - name: Upload archive and binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-${{ matrix.runner }}
-          retention-days: 1
-          path: |
-            artifacts/celq
-            artifacts/celq.tar.gz
-          if-no-files-found: error
-          compression-level: 0
-
-  freebsd:
-    name: Zigbuild (FreeBSD x86-64, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
-    needs: [patched_cargo, freebsd_tools]
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        build:
-          - target: aarch64-unknown-linux-gnu
-            zigtargetsuffix: .2.28
-          - target: aarch64-unknown-linux-musl
-            zigtargetsuffix: ""
-    env:
-      TARGET: ${{ matrix.build.target }}
-      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Capture commit timestamp
-        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
-
-      - name: Download patched Cargo
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: patched-cargo-x86_64-unknown-freebsd
-          path: patched-cargo
-
-      - name: Download FreeBSD tools
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: freebsd-tools-x86_64
-          path: freebsd-tools
-
-      - name: Build on FreeBSD
-        uses: vmactions/freebsd-vm@f0552d3b69211736abd97f02ff3d4674c56b73b1 # v1.5.5
-        with:
-          release: "14.4"
-          arch: x86_64
-          sync: rsync
-          copyback: true
-          envs: TARGET ZIGTARGETSUFFIX SOURCE_DATE_EPOCH
-          prepare: |
-            set -eu
-            pkg install -y ca_root_nss git devel/rustup-init archivers/gtar archivers/gzip
-
-            # Install the official FreeBSD Zig archive directly from ziglang.org.
-            cd /tmp
-            fetch https://ziglang.org/download/0.15.2/zig-x86_64-freebsd-0.15.2.tar.xz
-            test "$(sha256 -q zig-x86_64-freebsd-0.15.2.tar.xz)" = \
-              "5509ff57cd3f219165caed0da10221739af82742b9edfcda3f7bfaf4da7212dd"
-            tar -xf zig-x86_64-freebsd-0.15.2.tar.xz
-
-            rustup-init -y --profile minimal --default-toolchain 1.94.1
-            . "$HOME/.cargo/env"
-            rustup component add rust-src --toolchain 1.94.1
-
-          run: |
-            set -eu
-            . "$HOME/.cargo/env"
-            install -m 755 freebsd-tools/cargo-zigbuild "$HOME/.cargo/bin/"
-            mkdir -p /home/runner/.cargo/bin
-            install -m 755 freebsd-tools/cargo-auditable /home/runner/.cargo/bin/cargo-auditable
-            export PATH="/home/runner/.cargo/bin:/tmp/zig-x86_64-freebsd-0.15.2:$PATH"
-            test "$(command -v cargo-auditable)" = /home/runner/.cargo/bin/cargo-auditable
-            rustup target add --toolchain 1.94.1 "$TARGET"
-
-            # Host job environment variables are not inherited by the VM.
-            export RUSTUP_TOOLCHAIN=1.94.1
-            export CARGO_TERM_COLOR=always TZ=UTC LC_ALL=C
-            export SOURCE_DATE_EPOCH
-            RUST_SYSROOT=$(rustc --print sysroot)
-            export RUSTFLAGS="--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=$(pwd -P)=/src"
-            export CARGO="$(pwd -P)/patched-cargo/cargo"
-            chmod +x "$CARGO"
-            export PATH="$(pwd -P)/patched-cargo:$PATH"
-            test "$(command -v cargo)" = "$CARGO"
-            echo "Using patched Cargo: $CARGO"
-            rustc -vV
-            "$CARGO" -vV
-            "$CARGO" auditable zigbuild -vv --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
-
-            mkdir -p artifacts
-            cp "target/${TARGET}/release/celq" artifacts/celq
-            gtar --version
-            /usr/local/bin/gzip --version
-            gtar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
-              --owner=0 --group=0 --numeric-owner --mode=0755 \
-              -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
-            /usr/local/bin/gzip -n -9 artifacts/celq.tar
-
-      - name: Upload archive and binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-freebsd-x86_64
-          retention-days: 1
-          path: |
-            artifacts/celq
-            artifacts/celq.tar.gz
-          if-no-files-found: error
-          compression-level: 0
-
-  hashes:
-    name: SHA-256 (${{ matrix.pair.target }}, ${{ matrix.original }} vs ${{ matrix.pair.verify }})
-    needs: [zigbuild, freebsd]
-    if: ${{ !cancelled() }}
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        original: [ubuntu-24.04]
-        pair:
-          - target: x86_64-unknown-linux-gnu.2.28
-            verify: ubuntu-24.04-arm
-          - target: x86_64-unknown-linux-musl
-            verify: ubuntu-24.04-arm
-          - target: aarch64-unknown-linux-gnu.2.28
-            verify: freebsd-x86_64
-          - target: aarch64-unknown-linux-musl
-            verify: freebsd-x86_64
-    steps:
-      - name: Download original artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: reproducible-${{ matrix.pair.target }}-${{ matrix.original }}
-          path: artifacts/${{ matrix.original }}
-
-      - name: Download verification artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: reproducible-${{ matrix.pair.target }}-${{ matrix.pair.verify }}
-          path: artifacts/${{ matrix.pair.verify }}
-
-      - name: Print and compare SHA-256 hashes
-        env:
-          ORIGINAL: ${{ matrix.original }}
-          VERIFY: ${{ matrix.pair.verify }}
-        run: |
-          find artifacts -type f -exec sha256sum {} +
-          (cd "artifacts/$ORIGINAL" && sha256sum celq celq.tar.gz) > original.sha256
-          (cd "artifacts/$VERIFY" && sha256sum celq celq.tar.gz) > verification.sha256
-          diff -u original.sha256 verification.sha256
diff --git a/.github/workflows/release_github.yml b/.github/workflows/release_github.yml
index 1c4ed47..c0a6e20 100644
--- a/.github/workflows/release_github.yml
+++ b/.github/workflows/release_github.yml
@@ -129,7 +129,7 @@ jobs:
           echo "TZ=UTC" >> "$GITHUB_ENV"
           echo "LC_ALL=C" >> "$GITHUB_ENV"
           RUST_SYSROOT=$(rustc --print sysroot)
-          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
+          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src -C link-arg=/DEBUG:NONE" >> "$GITHUB_ENV"
 
       - name: Build with Xwin
         env:
@@ -151,7 +151,7 @@ jobs:
         run: |
           BIN_PATH="target/${TARGET}/release/${NAME}.exe"
           ARCHIVE_NAME="${NAME}-${PRETTY_TARGET}.zip"
-          7z a "${ARCHIVE_NAME}" "./${BIN_PATH}"
+          7z a -mtm=off -mtc=off -mta=off "${ARCHIVE_NAME}" "./${BIN_PATH}"
           7z rn "${ARCHIVE_NAME}" "target/${TARGET}/release/${NAME}.exe" "${NAME}.exe"
 
           echo "BIN_PATH=${BIN_PATH}" >> "$GITHUB_OUTPUT"

From 4703d28d83d7389d9e457ebb3040c1796d0087f6 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 19:43:56 -0400
Subject: [PATCH 27/34] macOS reproducible build attempt #1

---
 .github/workflows/manual_reproducible.yml     | 526 ++---------------
 .github/workflows/manual_reproducible.yml.bak | 551 ++++++++++++++++++
 2 files changed, 592 insertions(+), 485 deletions(-)
 create mode 100644 .github/workflows/manual_reproducible.yml.bak

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index ee73a2d..a09f1b8 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -1,4 +1,4 @@
-name: Reproducible builds (Manual)
+name: Reproducible macOS builds (Manual)
 
 on:
   workflow_dispatch:
@@ -8,417 +8,11 @@ permissions:
 
 env:
   CARGO_TERM_COLOR: always
+  NAME: celq
 
 jobs:
-  patched_cargo:
-    name: Patched Cargo (${{ matrix.target }})
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        target: [aarch64-unknown-linux-gnu, x86_64-unknown-freebsd]
-    env:
-      TARGET: ${{ matrix.target }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Checkout Cargo source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          repository: rust-lang/cargo
-          ref: 29ea6fb6a5db279426f4cc4e17aa385f05a0cfbc
-          path: cargo-source
-          persist-credentials: false
-          fetch-depth: 1
-          sparse-checkout: |
-            src
-            crates
-            credential
-            benches/benchsuite
-            benches/capture
-
-      - name: Setup Zigbuild
-        uses: $/.github/actions/setup-zigbuild
-        with:
-          target: ${{ matrix.target }}
-          rust_components: rust-src
-          install_target: "true"
-          use_cache: "false"
-
-      - name: Patch Cargo
-        working-directory: cargo-source
-        run: |
-          git apply --check ../.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
-          git apply ../.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
-
-      - name: Build patched Cargo with Zig
-        working-directory: cargo-source
-        env:
-          CFG_RELEASE: 1.94.1
-          CFG_RELEASE_CHANNEL: stable
-          CFG_VER_DESCRIPTION: linux-x86_64-metadata-patch
-          LIBZ_SYS_STATIC: "1"
-        run: |
-          cargo zigbuild --locked --release --package cargo --bin cargo --features all-static --target "$TARGET"
-
-      - name: Upload patched Cargo
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: patched-cargo-${{ matrix.target }}
-          path: cargo-source/target/${{ matrix.target }}/release/cargo
-          retention-days: 1
-          if-no-files-found: error
-
-  freebsd_tools:
-    name: Build FreeBSD tools
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Setup Zigbuild
-        uses: $/.github/actions/setup-zigbuild
-        with:
-          target: x86_64-unknown-freebsd
-          rust_components: rust-src
-          install_target: "true"
-          use_cache: "false"
-
-      - name: Install cargo-clone
-        run: |
-          /home/linuxbrew/.linuxbrew/bin/brew install --force-bottle cargo-clone
-          echo "/home/linuxbrew/.linuxbrew/bin" >> "$GITHUB_PATH"
-
-      - name: Download tool sources
-        run: cargo clone cargo-zigbuild@0.23.2 cargo-auditable@0.7.5 -- freebsd-tool-sources/
-
-      - name: Cross-compile cargo-zigbuild
-        run: |
-          cargo zigbuild --locked --release --bin cargo-zigbuild --target x86_64-unknown-freebsd \
-            --manifest-path freebsd-tool-sources/cargo-zigbuild/Cargo.toml \
-            --target-dir "$GITHUB_WORKSPACE/freebsd-tools-build"
-
-      - name: Cross-compile cargo-auditable
-        run: |
-          cargo zigbuild --locked --release --bin cargo-auditable --target x86_64-unknown-freebsd \
-            --manifest-path freebsd-tool-sources/cargo-auditable/Cargo.toml \
-            --target-dir "$GITHUB_WORKSPACE/freebsd-tools-build"
-
-      - name: Upload FreeBSD tools
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: freebsd-tools-x86_64
-          path: |
-            freebsd-tools-build/x86_64-unknown-freebsd/release/cargo-zigbuild
-            freebsd-tools-build/x86_64-unknown-freebsd/release/cargo-auditable
-          retention-days: 1
-          if-no-files-found: error
-
-  zigbuild:
-    name: Zigbuild (${{ matrix.runner }}, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
-    needs: patched_cargo
-    runs-on: ${{ matrix.runner }}
-    strategy:
-      fail-fast: false
-      matrix:
-        runner: [ubuntu-24.04, ubuntu-24.04-arm]
-        build:
-          - target: x86_64-unknown-linux-gnu
-            zigtargetsuffix: .2.28
-          - target: x86_64-unknown-linux-musl
-            zigtargetsuffix: ""
-          - target: aarch64-unknown-linux-gnu
-            zigtargetsuffix: .2.28
-          - target: aarch64-unknown-linux-musl
-            zigtargetsuffix: ""
-        exclude:
-          - runner: ubuntu-24.04-arm
-            build:
-              target: aarch64-unknown-linux-gnu
-              zigtargetsuffix: .2.28
-          - runner: ubuntu-24.04-arm
-            build:
-              target: aarch64-unknown-linux-musl
-              zigtargetsuffix: ""
-    env:
-      TARGET: ${{ matrix.build.target }}
-      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
-    steps:
-      # Every host builds the same HEAD captured by the manual dispatch.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Download patched Cargo
-        if: matrix.runner == 'ubuntu-24.04-arm'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: patched-cargo-aarch64-unknown-linux-gnu
-          path: patched-cargo
-
-      - name: Setup Zigbuild
-        uses: $/.github/actions/setup-zigbuild
-        with:
-          target: ${{ matrix.build.target }}
-          rust_components: rust-src
-          install_target: "true"
-          use_cache: "false"
-
-      - name: Select patched Cargo
-        if: matrix.runner == 'ubuntu-24.04-arm'
-        run: |
-          chmod +x "$GITHUB_WORKSPACE/patched-cargo/cargo"
-          echo "$GITHUB_WORKSPACE/patched-cargo" >> "$GITHUB_PATH"
-          echo "CARGO=$GITHUB_WORKSPACE/patched-cargo/cargo" >> "$GITHUB_ENV"
-
-      - name: Verify patched Cargo selection
-        if: matrix.runner == 'ubuntu-24.04-arm'
-        run: |
-          test "$(command -v cargo)" = "$CARGO"
-          echo "Using patched Cargo: $CARGO"
-
-      - name: Configure reproducible builds
-        run: |
-          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
-          echo "TZ=UTC" >> "$GITHUB_ENV"
-          echo "LC_ALL=C" >> "$GITHUB_ENV"
-          RUST_SYSROOT=$(rustc --print sysroot)
-          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
-
-      - name: Build with Zig
-        run: |
-          cargo auditable zigbuild --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
-
-      - name: Create release archive
-        run: |
-          mkdir -p artifacts
-          cp "target/${TARGET}/release/celq" artifacts/celq
-          tar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
-            --owner=0 --group=0 --numeric-owner --mode=0755 \
-            -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
-          gzip -n -9 artifacts/celq.tar
-
-      - name: Upload archive and binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-${{ matrix.runner }}
-          retention-days: 1
-          path: |
-            artifacts/celq
-            artifacts/celq.tar.gz
-          if-no-files-found: error
-          compression-level: 0
-
-  freebsd:
-    name: Zigbuild (FreeBSD x86-64, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
-    needs: [patched_cargo, freebsd_tools]
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        build:
-          - target: aarch64-unknown-linux-gnu
-            zigtargetsuffix: .2.28
-          - target: aarch64-unknown-linux-musl
-            zigtargetsuffix: ""
-    env:
-      TARGET: ${{ matrix.build.target }}
-      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Capture commit timestamp
-        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
-
-      - name: Download patched Cargo
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: patched-cargo-x86_64-unknown-freebsd
-          path: patched-cargo
-
-      - name: Download FreeBSD tools
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: freebsd-tools-x86_64
-          path: freebsd-tools
-
-      - name: Build on FreeBSD
-        uses: vmactions/freebsd-vm@f0552d3b69211736abd97f02ff3d4674c56b73b1 # v1.5.5
-        with:
-          release: "14.4"
-          arch: x86_64
-          sync: rsync
-          copyback: true
-          envs: TARGET ZIGTARGETSUFFIX SOURCE_DATE_EPOCH
-          prepare: |
-            set -eu
-            pkg install -y ca_root_nss git devel/rustup-init archivers/gtar archivers/gzip
-
-            # Install the official FreeBSD Zig archive directly from ziglang.org.
-            cd /tmp
-            fetch https://ziglang.org/download/0.15.2/zig-x86_64-freebsd-0.15.2.tar.xz
-            test "$(sha256 -q zig-x86_64-freebsd-0.15.2.tar.xz)" = \
-              "5509ff57cd3f219165caed0da10221739af82742b9edfcda3f7bfaf4da7212dd"
-            tar -xf zig-x86_64-freebsd-0.15.2.tar.xz
-
-            rustup-init -y --profile minimal --default-toolchain 1.94.1
-            . "$HOME/.cargo/env"
-            rustup component add rust-src --toolchain 1.94.1
-
-          run: |
-            set -eu
-            . "$HOME/.cargo/env"
-            install -m 755 freebsd-tools/cargo-zigbuild "$HOME/.cargo/bin/"
-            mkdir -p /home/runner/.cargo/bin
-            install -m 755 freebsd-tools/cargo-auditable /home/runner/.cargo/bin/cargo-auditable
-            export PATH="/home/runner/.cargo/bin:/tmp/zig-x86_64-freebsd-0.15.2:$PATH"
-            test "$(command -v cargo-auditable)" = /home/runner/.cargo/bin/cargo-auditable
-            rustup target add --toolchain 1.94.1 "$TARGET"
-
-            # Host job environment variables are not inherited by the VM.
-            export RUSTUP_TOOLCHAIN=1.94.1
-            export CARGO_TERM_COLOR=always TZ=UTC LC_ALL=C
-            export SOURCE_DATE_EPOCH
-            RUST_SYSROOT=$(rustc --print sysroot)
-            export RUSTFLAGS="--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=$(pwd -P)=/src"
-            export CARGO="$(pwd -P)/patched-cargo/cargo"
-            chmod +x "$CARGO"
-            export PATH="$(pwd -P)/patched-cargo:$PATH"
-            test "$(command -v cargo)" = "$CARGO"
-            echo "Using patched Cargo: $CARGO"
-            "$CARGO" auditable zigbuild --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
-
-            mkdir -p artifacts
-            cp "target/${TARGET}/release/celq" artifacts/celq
-            gtar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
-              --owner=0 --group=0 --numeric-owner --mode=0755 \
-              -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
-            /usr/local/bin/gzip -n -9 artifacts/celq.tar
-
-      - name: Upload archive and binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-freebsd-x86_64
-          retention-days: 1
-          path: |
-            artifacts/celq
-            artifacts/celq.tar.gz
-          if-no-files-found: error
-          compression-level: 0
-
-  hashes:
-    name: SHA-256 (${{ matrix.pair.target }}, ${{ matrix.original }} vs ${{ matrix.pair.verify }})
-    needs: [zigbuild, freebsd]
-    if: ${{ !cancelled() }}
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        original: [ubuntu-24.04]
-        pair:
-          - target: x86_64-unknown-linux-gnu.2.28
-            verify: ubuntu-24.04-arm
-          - target: x86_64-unknown-linux-musl
-            verify: ubuntu-24.04-arm
-          - target: aarch64-unknown-linux-gnu.2.28
-            verify: freebsd-x86_64
-          - target: aarch64-unknown-linux-musl
-            verify: freebsd-x86_64
-    steps:
-      - name: Download original artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: reproducible-${{ matrix.pair.target }}-${{ matrix.original }}
-          path: artifacts/${{ matrix.original }}
-
-      - name: Download verification artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: reproducible-${{ matrix.pair.target }}-${{ matrix.pair.verify }}
-          path: artifacts/${{ matrix.pair.verify }}
-
-      - name: Print and compare SHA-256 hashes
-        env:
-          ORIGINAL: ${{ matrix.original }}
-          VERIFY: ${{ matrix.pair.verify }}
-        run: |
-          find artifacts -type f -exec sha256sum {} +
-          (cd "artifacts/$ORIGINAL" && sha256sum celq celq.tar.gz) > original.sha256
-          (cd "artifacts/$VERIFY" && sha256sum celq celq.tar.gz) > verification.sha256
-          diff -u original.sha256 verification.sha256
-
-  patched_cargo_windows:
-    name: Patched Cargo (Windows ARM64)
-    runs-on: windows-2025
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - name: Preserve LF line endings for Cargo patching
-        run: git config --global core.autocrlf false
-
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Checkout Cargo source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          repository: rust-lang/cargo
-          ref: 29ea6fb6a5db279426f4cc4e17aa385f05a0cfbc
-          path: cargo-source
-          persist-credentials: false
-          fetch-depth: 1
-          sparse-checkout: |
-            src
-            crates
-            credential
-            benches/benchsuite
-            benches/capture
-
-      - name: Install Rust 1.94.1 with Windows ARM64 target
-        uses: dtolnay/rust-toolchain@9376cdc5a5e25b16da71af47712785cf06b0d6d4 # 1.94.1
-        with:
-          targets: aarch64-pc-windows-msvc
-
-      - name: Patch Cargo metadata
-        working-directory: cargo-source
-        run: |
-          git apply --check ../.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
-          git apply ../.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
-
-      - name: Cross-compile patched Cargo for Windows ARM64
-        working-directory: cargo-source
-        env:
-          CFG_RELEASE: 1.94.1
-          CFG_RELEASE_CHANNEL: stable
-          CFG_VER_DESCRIPTION: windows-x86_64-metadata-patch
-          LIBZ_SYS_STATIC: "1"
-        run: >-
-          cargo build --locked --release --package cargo --bin cargo
-          --features all-static --target aarch64-pc-windows-msvc
-
-      - name: Upload patched Cargo
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: patched-cargo-aarch64-pc-windows-msvc
-          path: cargo-source/target/aarch64-pc-windows-msvc/release/cargo.exe
-          retention-days: 1
-          if-no-files-found: error
-
-  xwin:
-    name: Xwin (${{ matrix.runner }}, ${{ matrix.target }})
-    needs: patched_cargo_windows
+  build_mac:
+    name: macOS (${{ matrix.runner }}, ${{ matrix.target }})
     runs-on: ${{ matrix.runner }}
     defaults:
       run:
@@ -426,53 +20,32 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        runner: [windows-2025, windows-11-vs2026-arm]
-        target: &xwin_targets
-          - x86_64-pc-windows-msvc
+        runner: [macos-15, macos-15-intel]
+        target: [aarch64-apple-darwin]
+    env:
+      DEVELOPER_DIR: /Applications/Xcode_16.4.app/Contents/Developer
+      MACOSX_DEPLOYMENT_TARGET: "11.0"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
 
-      - name: Select native Windows ARM64 Rust host
-        if: runner.arch == 'ARM64'
+      - name: Select pinned macOS SDK
         run: |
-          rustup set default-host aarch64-pc-windows-msvc
-          echo "RUSTUP_TOOLCHAIN=1.94.1-aarch64-pc-windows-msvc" >> "$GITHUB_ENV"
+          xcodebuild -version
+          echo "SDKROOT=$(xcrun --sdk macosx15.5 --show-sdk-path)" >> "$GITHUB_ENV"
 
-      - name: Setup Xwin
-        id: setup-xwin
-        uses: $/.github/actions/setup-xwin
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@9376cdc5a5e25b16da71af47712785cf06b0d6d4 # 1.94.1
         with:
-          target: ${{ matrix.target }}
-          rust_components: llvm-tools
-          cache_directory: ${{ github.workspace }}/.xwin-cache
-          use_cache: "true"
-
-      - name: Verify native Windows ARM64 compiler
-        if: runner.arch == 'ARM64'
-        run: |
-          test "$(rustc -vV | sed -n 's/^host: //p' | tr -d '\r')" = aarch64-pc-windows-msvc
+          targets: ${{ matrix.target }}
 
-      - name: Download patched Cargo
-        if: runner.arch == 'ARM64'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+      - name: Install cargo-auditable
+        uses: taiki-e/install-action@1ed6d7be6168f6c9046541087ff549b6bc581fdf # v2.87.2
         with:
-          name: patched-cargo-aarch64-pc-windows-msvc
-          path: patched-cargo
-
-      - name: Select patched Cargo
-        if: runner.arch == 'ARM64'
-        run: |
-          echo "$(cygpath -aw "$GITHUB_WORKSPACE/patched-cargo")" >> "$GITHUB_PATH"
-          echo "CARGO=$(cygpath -aw "$GITHUB_WORKSPACE/patched-cargo/cargo.exe")" >> "$GITHUB_ENV"
-
-      - name: Verify patched Cargo selection
-        if: runner.arch == 'ARM64'
-        run: |
-          test "$(cygpath -aw "$(command -v cargo)")" = "$CARGO"
-          echo "Using patched Cargo: $CARGO"
+          tool: cargo-auditable@0.7.5
+          fallback: none
 
       - name: Configure reproducible builds
         run: |
@@ -480,72 +53,55 @@ jobs:
           echo "TZ=UTC" >> "$GITHUB_ENV"
           echo "LC_ALL=C" >> "$GITHUB_ENV"
           RUST_SYSROOT=$(rustc --print sysroot)
-          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src -C link-arg=/DEBUG:NONE" >> "$GITHUB_ENV"
+          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
 
-      - name: Build with Xwin
-        env:
-          TARGET: ${{ matrix.target }}
-          XWIN_CACHE_DIR: ${{ steps.setup-xwin.outputs.cache_directory }}
-          XWIN_CRT_VERSION: ${{ steps.setup-xwin.outputs.xwin_crt_version }}
-          XWIN_SDK_VERSION: ${{ steps.setup-xwin.outputs.xwin_sdk_version }}
-          XWIN_VERSION: ${{ steps.setup-xwin.outputs.xwin_version }}
-        run: >-
-          cargo xwin build --locked --release --target "${TARGET}"
-          --no-default-features --features from-toml,from-yaml,greppable,from-xml
-          --xwin-version "${XWIN_VERSION}"
-          --xwin-sdk-version "${XWIN_SDK_VERSION}"
-          --xwin-crt-version "${XWIN_CRT_VERSION}"
+      - name: Build
+        run: cargo auditable build --locked --release --target ${{ matrix.target }}
 
       - name: Create release archive
         env:
-          NAME: celq
-          PRETTY_TARGET: windows-x86_64
           TARGET: ${{ matrix.target }}
+          PRETTY_TARGET: macos-aarch64
         run: |
-          BIN_PATH="target/${TARGET}/release/${NAME}.exe"
-          ARCHIVE_NAME="${NAME}-${PRETTY_TARGET}.zip"
-          7z a -mtm=off -mtc=off -mta=off "${ARCHIVE_NAME}" "./${BIN_PATH}"
-          7z rn "${ARCHIVE_NAME}" "target/${TARGET}/release/${NAME}.exe" "${NAME}.exe"
+          BIN_PATH="target/${TARGET}/release/${NAME}"
+          ARCHIVE_NAME="${NAME}-${PRETTY_TARGET}.tar.gz"
+          tar czf "${ARCHIVE_NAME}" -C "target/${TARGET}/release" "${NAME}"
 
           mkdir -p artifacts
           cp "${BIN_PATH}" "${ARCHIVE_NAME}" artifacts/
 
-      - name: Upload Windows binary and archive
+      - name: Upload archive and binary
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          name: reproducible-xwin-${{ matrix.target }}-${{ matrix.runner }}
+          name: reproducible-aarch64-apple-darwin-${{ matrix.runner }}
           path: |
-            artifacts/celq.exe
-            artifacts/celq-windows-x86_64.zip
+            artifacts/celq
+            artifacts/celq-macos-aarch64.tar.gz
           retention-days: 1
           if-no-files-found: error
           compression-level: 0
 
-  xwin_hashes:
-    name: Xwin SHA-256 (${{ matrix.target }}, Windows x86-64 vs ARM64)
-    needs: xwin
+  hashes:
+    name: SHA-256 (macOS ARM64 vs Intel hosts)
+    needs: build_mac
     if: ${{ !cancelled() }}
     runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        target: *xwin_targets
     steps:
-      - name: Download Windows x86-64 artifacts
+      - name: Download ARM64-host artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
-          name: reproducible-xwin-${{ matrix.target }}-windows-2025
-          path: artifacts/windows-2025
+          name: reproducible-aarch64-apple-darwin-macos-15
+          path: artifacts/macos-15
 
-      - name: Download Windows ARM64 artifacts
+      - name: Download Intel-host artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
-          name: reproducible-xwin-${{ matrix.target }}-windows-11-vs2026-arm
-          path: artifacts/windows-11-vs2026-arm
+          name: reproducible-aarch64-apple-darwin-macos-15-intel
+          path: artifacts/macos-15-intel
 
       - name: Print and compare SHA-256 hashes
         run: |
           find artifacts -type f -exec sha256sum {} +
-          (cd artifacts/windows-2025 && sha256sum celq.exe celq-windows-x86_64.zip) > original.sha256
-          (cd artifacts/windows-11-vs2026-arm && sha256sum celq.exe celq-windows-x86_64.zip) > verification.sha256
+          (cd artifacts/macos-15 && sha256sum celq celq-macos-aarch64.tar.gz) > original.sha256
+          (cd artifacts/macos-15-intel && sha256sum celq celq-macos-aarch64.tar.gz) > verification.sha256
           diff -u original.sha256 verification.sha256
diff --git a/.github/workflows/manual_reproducible.yml.bak b/.github/workflows/manual_reproducible.yml.bak
new file mode 100644
index 0000000..ee73a2d
--- /dev/null
+++ b/.github/workflows/manual_reproducible.yml.bak
@@ -0,0 +1,551 @@
+name: Reproducible builds (Manual)
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  patched_cargo:
+    name: Patched Cargo (${{ matrix.target }})
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [aarch64-unknown-linux-gnu, x86_64-unknown-freebsd]
+    env:
+      TARGET: ${{ matrix.target }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Checkout Cargo source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: rust-lang/cargo
+          ref: 29ea6fb6a5db279426f4cc4e17aa385f05a0cfbc
+          path: cargo-source
+          persist-credentials: false
+          fetch-depth: 1
+          sparse-checkout: |
+            src
+            crates
+            credential
+            benches/benchsuite
+            benches/capture
+
+      - name: Setup Zigbuild
+        uses: $/.github/actions/setup-zigbuild
+        with:
+          target: ${{ matrix.target }}
+          rust_components: rust-src
+          install_target: "true"
+          use_cache: "false"
+
+      - name: Patch Cargo
+        working-directory: cargo-source
+        run: |
+          git apply --check ../.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
+          git apply ../.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
+
+      - name: Build patched Cargo with Zig
+        working-directory: cargo-source
+        env:
+          CFG_RELEASE: 1.94.1
+          CFG_RELEASE_CHANNEL: stable
+          CFG_VER_DESCRIPTION: linux-x86_64-metadata-patch
+          LIBZ_SYS_STATIC: "1"
+        run: |
+          cargo zigbuild --locked --release --package cargo --bin cargo --features all-static --target "$TARGET"
+
+      - name: Upload patched Cargo
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: patched-cargo-${{ matrix.target }}
+          path: cargo-source/target/${{ matrix.target }}/release/cargo
+          retention-days: 1
+          if-no-files-found: error
+
+  freebsd_tools:
+    name: Build FreeBSD tools
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Setup Zigbuild
+        uses: $/.github/actions/setup-zigbuild
+        with:
+          target: x86_64-unknown-freebsd
+          rust_components: rust-src
+          install_target: "true"
+          use_cache: "false"
+
+      - name: Install cargo-clone
+        run: |
+          /home/linuxbrew/.linuxbrew/bin/brew install --force-bottle cargo-clone
+          echo "/home/linuxbrew/.linuxbrew/bin" >> "$GITHUB_PATH"
+
+      - name: Download tool sources
+        run: cargo clone cargo-zigbuild@0.23.2 cargo-auditable@0.7.5 -- freebsd-tool-sources/
+
+      - name: Cross-compile cargo-zigbuild
+        run: |
+          cargo zigbuild --locked --release --bin cargo-zigbuild --target x86_64-unknown-freebsd \
+            --manifest-path freebsd-tool-sources/cargo-zigbuild/Cargo.toml \
+            --target-dir "$GITHUB_WORKSPACE/freebsd-tools-build"
+
+      - name: Cross-compile cargo-auditable
+        run: |
+          cargo zigbuild --locked --release --bin cargo-auditable --target x86_64-unknown-freebsd \
+            --manifest-path freebsd-tool-sources/cargo-auditable/Cargo.toml \
+            --target-dir "$GITHUB_WORKSPACE/freebsd-tools-build"
+
+      - name: Upload FreeBSD tools
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: freebsd-tools-x86_64
+          path: |
+            freebsd-tools-build/x86_64-unknown-freebsd/release/cargo-zigbuild
+            freebsd-tools-build/x86_64-unknown-freebsd/release/cargo-auditable
+          retention-days: 1
+          if-no-files-found: error
+
+  zigbuild:
+    name: Zigbuild (${{ matrix.runner }}, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
+    needs: patched_cargo
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-24.04, ubuntu-24.04-arm]
+        build:
+          - target: x86_64-unknown-linux-gnu
+            zigtargetsuffix: .2.28
+          - target: x86_64-unknown-linux-musl
+            zigtargetsuffix: ""
+          - target: aarch64-unknown-linux-gnu
+            zigtargetsuffix: .2.28
+          - target: aarch64-unknown-linux-musl
+            zigtargetsuffix: ""
+        exclude:
+          - runner: ubuntu-24.04-arm
+            build:
+              target: aarch64-unknown-linux-gnu
+              zigtargetsuffix: .2.28
+          - runner: ubuntu-24.04-arm
+            build:
+              target: aarch64-unknown-linux-musl
+              zigtargetsuffix: ""
+    env:
+      TARGET: ${{ matrix.build.target }}
+      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
+    steps:
+      # Every host builds the same HEAD captured by the manual dispatch.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Download patched Cargo
+        if: matrix.runner == 'ubuntu-24.04-arm'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: patched-cargo-aarch64-unknown-linux-gnu
+          path: patched-cargo
+
+      - name: Setup Zigbuild
+        uses: $/.github/actions/setup-zigbuild
+        with:
+          target: ${{ matrix.build.target }}
+          rust_components: rust-src
+          install_target: "true"
+          use_cache: "false"
+
+      - name: Select patched Cargo
+        if: matrix.runner == 'ubuntu-24.04-arm'
+        run: |
+          chmod +x "$GITHUB_WORKSPACE/patched-cargo/cargo"
+          echo "$GITHUB_WORKSPACE/patched-cargo" >> "$GITHUB_PATH"
+          echo "CARGO=$GITHUB_WORKSPACE/patched-cargo/cargo" >> "$GITHUB_ENV"
+
+      - name: Verify patched Cargo selection
+        if: matrix.runner == 'ubuntu-24.04-arm'
+        run: |
+          test "$(command -v cargo)" = "$CARGO"
+          echo "Using patched Cargo: $CARGO"
+
+      - name: Configure reproducible builds
+        run: |
+          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
+          echo "TZ=UTC" >> "$GITHUB_ENV"
+          echo "LC_ALL=C" >> "$GITHUB_ENV"
+          RUST_SYSROOT=$(rustc --print sysroot)
+          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
+
+      - name: Build with Zig
+        run: |
+          cargo auditable zigbuild --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
+
+      - name: Create release archive
+        run: |
+          mkdir -p artifacts
+          cp "target/${TARGET}/release/celq" artifacts/celq
+          tar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
+            --owner=0 --group=0 --numeric-owner --mode=0755 \
+            -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
+          gzip -n -9 artifacts/celq.tar
+
+      - name: Upload archive and binary
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-${{ matrix.runner }}
+          retention-days: 1
+          path: |
+            artifacts/celq
+            artifacts/celq.tar.gz
+          if-no-files-found: error
+          compression-level: 0
+
+  freebsd:
+    name: Zigbuild (FreeBSD x86-64, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
+    needs: [patched_cargo, freebsd_tools]
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        build:
+          - target: aarch64-unknown-linux-gnu
+            zigtargetsuffix: .2.28
+          - target: aarch64-unknown-linux-musl
+            zigtargetsuffix: ""
+    env:
+      TARGET: ${{ matrix.build.target }}
+      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Capture commit timestamp
+        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
+
+      - name: Download patched Cargo
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: patched-cargo-x86_64-unknown-freebsd
+          path: patched-cargo
+
+      - name: Download FreeBSD tools
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: freebsd-tools-x86_64
+          path: freebsd-tools
+
+      - name: Build on FreeBSD
+        uses: vmactions/freebsd-vm@f0552d3b69211736abd97f02ff3d4674c56b73b1 # v1.5.5
+        with:
+          release: "14.4"
+          arch: x86_64
+          sync: rsync
+          copyback: true
+          envs: TARGET ZIGTARGETSUFFIX SOURCE_DATE_EPOCH
+          prepare: |
+            set -eu
+            pkg install -y ca_root_nss git devel/rustup-init archivers/gtar archivers/gzip
+
+            # Install the official FreeBSD Zig archive directly from ziglang.org.
+            cd /tmp
+            fetch https://ziglang.org/download/0.15.2/zig-x86_64-freebsd-0.15.2.tar.xz
+            test "$(sha256 -q zig-x86_64-freebsd-0.15.2.tar.xz)" = \
+              "5509ff57cd3f219165caed0da10221739af82742b9edfcda3f7bfaf4da7212dd"
+            tar -xf zig-x86_64-freebsd-0.15.2.tar.xz
+
+            rustup-init -y --profile minimal --default-toolchain 1.94.1
+            . "$HOME/.cargo/env"
+            rustup component add rust-src --toolchain 1.94.1
+
+          run: |
+            set -eu
+            . "$HOME/.cargo/env"
+            install -m 755 freebsd-tools/cargo-zigbuild "$HOME/.cargo/bin/"
+            mkdir -p /home/runner/.cargo/bin
+            install -m 755 freebsd-tools/cargo-auditable /home/runner/.cargo/bin/cargo-auditable
+            export PATH="/home/runner/.cargo/bin:/tmp/zig-x86_64-freebsd-0.15.2:$PATH"
+            test "$(command -v cargo-auditable)" = /home/runner/.cargo/bin/cargo-auditable
+            rustup target add --toolchain 1.94.1 "$TARGET"
+
+            # Host job environment variables are not inherited by the VM.
+            export RUSTUP_TOOLCHAIN=1.94.1
+            export CARGO_TERM_COLOR=always TZ=UTC LC_ALL=C
+            export SOURCE_DATE_EPOCH
+            RUST_SYSROOT=$(rustc --print sysroot)
+            export RUSTFLAGS="--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=$(pwd -P)=/src"
+            export CARGO="$(pwd -P)/patched-cargo/cargo"
+            chmod +x "$CARGO"
+            export PATH="$(pwd -P)/patched-cargo:$PATH"
+            test "$(command -v cargo)" = "$CARGO"
+            echo "Using patched Cargo: $CARGO"
+            "$CARGO" auditable zigbuild --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
+
+            mkdir -p artifacts
+            cp "target/${TARGET}/release/celq" artifacts/celq
+            gtar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
+              --owner=0 --group=0 --numeric-owner --mode=0755 \
+              -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
+            /usr/local/bin/gzip -n -9 artifacts/celq.tar
+
+      - name: Upload archive and binary
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-freebsd-x86_64
+          retention-days: 1
+          path: |
+            artifacts/celq
+            artifacts/celq.tar.gz
+          if-no-files-found: error
+          compression-level: 0
+
+  hashes:
+    name: SHA-256 (${{ matrix.pair.target }}, ${{ matrix.original }} vs ${{ matrix.pair.verify }})
+    needs: [zigbuild, freebsd]
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        original: [ubuntu-24.04]
+        pair:
+          - target: x86_64-unknown-linux-gnu.2.28
+            verify: ubuntu-24.04-arm
+          - target: x86_64-unknown-linux-musl
+            verify: ubuntu-24.04-arm
+          - target: aarch64-unknown-linux-gnu.2.28
+            verify: freebsd-x86_64
+          - target: aarch64-unknown-linux-musl
+            verify: freebsd-x86_64
+    steps:
+      - name: Download original artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-${{ matrix.pair.target }}-${{ matrix.original }}
+          path: artifacts/${{ matrix.original }}
+
+      - name: Download verification artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-${{ matrix.pair.target }}-${{ matrix.pair.verify }}
+          path: artifacts/${{ matrix.pair.verify }}
+
+      - name: Print and compare SHA-256 hashes
+        env:
+          ORIGINAL: ${{ matrix.original }}
+          VERIFY: ${{ matrix.pair.verify }}
+        run: |
+          find artifacts -type f -exec sha256sum {} +
+          (cd "artifacts/$ORIGINAL" && sha256sum celq celq.tar.gz) > original.sha256
+          (cd "artifacts/$VERIFY" && sha256sum celq celq.tar.gz) > verification.sha256
+          diff -u original.sha256 verification.sha256
+
+  patched_cargo_windows:
+    name: Patched Cargo (Windows ARM64)
+    runs-on: windows-2025
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Preserve LF line endings for Cargo patching
+        run: git config --global core.autocrlf false
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Checkout Cargo source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: rust-lang/cargo
+          ref: 29ea6fb6a5db279426f4cc4e17aa385f05a0cfbc
+          path: cargo-source
+          persist-credentials: false
+          fetch-depth: 1
+          sparse-checkout: |
+            src
+            crates
+            credential
+            benches/benchsuite
+            benches/capture
+
+      - name: Install Rust 1.94.1 with Windows ARM64 target
+        uses: dtolnay/rust-toolchain@9376cdc5a5e25b16da71af47712785cf06b0d6d4 # 1.94.1
+        with:
+          targets: aarch64-pc-windows-msvc
+
+      - name: Patch Cargo metadata
+        working-directory: cargo-source
+        run: |
+          git apply --check ../.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
+          git apply ../.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
+
+      - name: Cross-compile patched Cargo for Windows ARM64
+        working-directory: cargo-source
+        env:
+          CFG_RELEASE: 1.94.1
+          CFG_RELEASE_CHANNEL: stable
+          CFG_VER_DESCRIPTION: windows-x86_64-metadata-patch
+          LIBZ_SYS_STATIC: "1"
+        run: >-
+          cargo build --locked --release --package cargo --bin cargo
+          --features all-static --target aarch64-pc-windows-msvc
+
+      - name: Upload patched Cargo
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: patched-cargo-aarch64-pc-windows-msvc
+          path: cargo-source/target/aarch64-pc-windows-msvc/release/cargo.exe
+          retention-days: 1
+          if-no-files-found: error
+
+  xwin:
+    name: Xwin (${{ matrix.runner }}, ${{ matrix.target }})
+    needs: patched_cargo_windows
+    runs-on: ${{ matrix.runner }}
+    defaults:
+      run:
+        shell: bash
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [windows-2025, windows-11-vs2026-arm]
+        target: &xwin_targets
+          - x86_64-pc-windows-msvc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Select native Windows ARM64 Rust host
+        if: runner.arch == 'ARM64'
+        run: |
+          rustup set default-host aarch64-pc-windows-msvc
+          echo "RUSTUP_TOOLCHAIN=1.94.1-aarch64-pc-windows-msvc" >> "$GITHUB_ENV"
+
+      - name: Setup Xwin
+        id: setup-xwin
+        uses: $/.github/actions/setup-xwin
+        with:
+          target: ${{ matrix.target }}
+          rust_components: llvm-tools
+          cache_directory: ${{ github.workspace }}/.xwin-cache
+          use_cache: "true"
+
+      - name: Verify native Windows ARM64 compiler
+        if: runner.arch == 'ARM64'
+        run: |
+          test "$(rustc -vV | sed -n 's/^host: //p' | tr -d '\r')" = aarch64-pc-windows-msvc
+
+      - name: Download patched Cargo
+        if: runner.arch == 'ARM64'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: patched-cargo-aarch64-pc-windows-msvc
+          path: patched-cargo
+
+      - name: Select patched Cargo
+        if: runner.arch == 'ARM64'
+        run: |
+          echo "$(cygpath -aw "$GITHUB_WORKSPACE/patched-cargo")" >> "$GITHUB_PATH"
+          echo "CARGO=$(cygpath -aw "$GITHUB_WORKSPACE/patched-cargo/cargo.exe")" >> "$GITHUB_ENV"
+
+      - name: Verify patched Cargo selection
+        if: runner.arch == 'ARM64'
+        run: |
+          test "$(cygpath -aw "$(command -v cargo)")" = "$CARGO"
+          echo "Using patched Cargo: $CARGO"
+
+      - name: Configure reproducible builds
+        run: |
+          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
+          echo "TZ=UTC" >> "$GITHUB_ENV"
+          echo "LC_ALL=C" >> "$GITHUB_ENV"
+          RUST_SYSROOT=$(rustc --print sysroot)
+          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src -C link-arg=/DEBUG:NONE" >> "$GITHUB_ENV"
+
+      - name: Build with Xwin
+        env:
+          TARGET: ${{ matrix.target }}
+          XWIN_CACHE_DIR: ${{ steps.setup-xwin.outputs.cache_directory }}
+          XWIN_CRT_VERSION: ${{ steps.setup-xwin.outputs.xwin_crt_version }}
+          XWIN_SDK_VERSION: ${{ steps.setup-xwin.outputs.xwin_sdk_version }}
+          XWIN_VERSION: ${{ steps.setup-xwin.outputs.xwin_version }}
+        run: >-
+          cargo xwin build --locked --release --target "${TARGET}"
+          --no-default-features --features from-toml,from-yaml,greppable,from-xml
+          --xwin-version "${XWIN_VERSION}"
+          --xwin-sdk-version "${XWIN_SDK_VERSION}"
+          --xwin-crt-version "${XWIN_CRT_VERSION}"
+
+      - name: Create release archive
+        env:
+          NAME: celq
+          PRETTY_TARGET: windows-x86_64
+          TARGET: ${{ matrix.target }}
+        run: |
+          BIN_PATH="target/${TARGET}/release/${NAME}.exe"
+          ARCHIVE_NAME="${NAME}-${PRETTY_TARGET}.zip"
+          7z a -mtm=off -mtc=off -mta=off "${ARCHIVE_NAME}" "./${BIN_PATH}"
+          7z rn "${ARCHIVE_NAME}" "target/${TARGET}/release/${NAME}.exe" "${NAME}.exe"
+
+          mkdir -p artifacts
+          cp "${BIN_PATH}" "${ARCHIVE_NAME}" artifacts/
+
+      - name: Upload Windows binary and archive
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: reproducible-xwin-${{ matrix.target }}-${{ matrix.runner }}
+          path: |
+            artifacts/celq.exe
+            artifacts/celq-windows-x86_64.zip
+          retention-days: 1
+          if-no-files-found: error
+          compression-level: 0
+
+  xwin_hashes:
+    name: Xwin SHA-256 (${{ matrix.target }}, Windows x86-64 vs ARM64)
+    needs: xwin
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        target: *xwin_targets
+    steps:
+      - name: Download Windows x86-64 artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-xwin-${{ matrix.target }}-windows-2025
+          path: artifacts/windows-2025
+
+      - name: Download Windows ARM64 artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-xwin-${{ matrix.target }}-windows-11-vs2026-arm
+          path: artifacts/windows-11-vs2026-arm
+
+      - name: Print and compare SHA-256 hashes
+        run: |
+          find artifacts -type f -exec sha256sum {} +
+          (cd artifacts/windows-2025 && sha256sum celq.exe celq-windows-x86_64.zip) > original.sha256
+          (cd artifacts/windows-11-vs2026-arm && sha256sum celq.exe celq-windows-x86_64.zip) > verification.sha256
+          diff -u original.sha256 verification.sha256

From 0ce3574beb5ce0615da72948581b219032397b81 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 23:08:47 -0400
Subject: [PATCH 28/34] Verbose macOS build

---
 .github/workflows/manual_reproducible.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index a09f1b8..fe5675d 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -56,7 +56,7 @@ jobs:
           echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
 
       - name: Build
-        run: cargo auditable build --locked --release --target ${{ matrix.target }}
+        run: cargo auditable build -vv --locked --release --target ${{ matrix.target }}
 
       - name: Create release archive
         env:

From 6861fcb79188efdcaaf486698add87d09b608399 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 23:25:13 -0400
Subject: [PATCH 29/34] Patch cargo for macOS as well

---
 .../cargo-macos-aarch64-metadata.patch        | 36 +++++++++
 .github/workflows/manual_reproducible.yml     | 76 +++++++++++++++++++
 2 files changed, 112 insertions(+)
 create mode 100644 .github/reproducibility/patches/cargo-macos-aarch64-metadata.patch

diff --git a/.github/reproducibility/patches/cargo-macos-aarch64-metadata.patch b/.github/reproducibility/patches/cargo-macos-aarch64-metadata.patch
new file mode 100644
index 0000000..660f7f5
--- /dev/null
+++ b/.github/reproducibility/patches/cargo-macos-aarch64-metadata.patch
@@ -0,0 +1,36 @@
+diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/cargo/core/compiler/build_runner/compilation_files.rs
+--- a/src/cargo/core/compiler/build_runner/compilation_files.rs
++++ b/src/cargo/core/compiler/build_runner/compilation_files.rs
+@@ -793,6 +793,14 @@
+                 .links_overrides
+                 != unit.links_overrides;
+         target_configs_are_different.hash(&mut shared_hasher);
++    } else if unit.kind.is_host()
++        && bcx.build_config.requested_kinds.iter().any(|kind| {
++            matches!(kind, CompileKind::Target(target) if target.short_name() == "aarch64-apple-darwin")
++        })
++    {
++        // Reproducible fix: match the macOS ARM64 baseline host.
++        // Change hash input only, not the actual host configuration or compiler flags.
++        false.hash(&mut shared_hasher);
+     }
+
+     let mut c_metadata_hasher = shared_hasher.clone();
+@@ -864,6 +872,12 @@
+         for line in bcx.rustc().verbose_version.lines() {
+             if unit.kind.is_host() || !line.starts_with("host: ") {
++                // Normalize hash input only; keep the real host for compilation.
++                let line = if line.starts_with("host: ") {
++                    "host: aarch64-apple-darwin"
++                } else {
++                    line
++                };
+                 line.hash(hasher);
+             }
+         }
+         return;
+@@ -881,3 +895,3 @@
+     if unit.kind.is_host() {
+-        bcx.rustc().host.hash(hasher);
++        "aarch64-apple-darwin".hash(hasher);
+     }
diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index fe5675d..d07212c 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -11,8 +11,70 @@ env:
   NAME: celq
 
 jobs:
+  patched_cargo:
+    name: Patched Cargo (x86_64-apple-darwin)
+    runs-on: macos-15
+    defaults:
+      run:
+        shell: bash
+    env:
+      DEVELOPER_DIR: /Applications/Xcode_16.4.app/Contents/Developer
+      MACOSX_DEPLOYMENT_TARGET: "11.0"
+      TARGET: x86_64-apple-darwin
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Checkout Cargo source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: rust-lang/cargo
+          ref: 29ea6fb6a5db279426f4cc4e17aa385f05a0cfbc
+          path: cargo-source
+          persist-credentials: false
+          fetch-depth: 1
+          sparse-checkout: |
+            src
+            crates
+            credential
+            benches/benchsuite
+            benches/capture
+
+      - name: Select pinned macOS SDK
+        run: echo "SDKROOT=$(xcrun --sdk macosx15.5 --show-sdk-path)" >> "$GITHUB_ENV"
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@9376cdc5a5e25b16da71af47712785cf06b0d6d4 # 1.94.1
+        with:
+          targets: ${{ env.TARGET }}
+
+      - name: Patch Cargo
+        working-directory: cargo-source
+        run: |
+          git apply --check ../.github/reproducibility/patches/cargo-macos-aarch64-metadata.patch
+          git apply ../.github/reproducibility/patches/cargo-macos-aarch64-metadata.patch
+
+      - name: Cross-compile patched Cargo
+        working-directory: cargo-source
+        env:
+          CFG_RELEASE: 1.94.1
+          CFG_RELEASE_CHANNEL: stable
+          CFG_VER_DESCRIPTION: macos-aarch64-metadata-patch
+        run: cargo build --locked --release --package cargo --bin cargo --target "$TARGET"
+
+      - name: Upload patched Cargo
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: patched-cargo-x86_64-apple-darwin
+          path: cargo-source/target/x86_64-apple-darwin/release/cargo
+          retention-days: 1
+          if-no-files-found: error
+
   build_mac:
     name: macOS (${{ matrix.runner }}, ${{ matrix.target }})
+    needs: patched_cargo
     runs-on: ${{ matrix.runner }}
     defaults:
       run:
@@ -47,6 +109,20 @@ jobs:
           tool: cargo-auditable@0.7.5
           fallback: none
 
+      - name: Download patched Cargo
+        if: matrix.runner == 'macos-15-intel'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: patched-cargo-x86_64-apple-darwin
+          path: patched-cargo
+
+      - name: Select patched Cargo
+        if: matrix.runner == 'macos-15-intel'
+        run: |
+          chmod +x "$GITHUB_WORKSPACE/patched-cargo/cargo"
+          echo "$GITHUB_WORKSPACE/patched-cargo" >> "$GITHUB_PATH"
+          echo "CARGO=$GITHUB_WORKSPACE/patched-cargo/cargo" >> "$GITHUB_ENV"
+
       - name: Configure reproducible builds
         run: |
           echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"

From 752af9704e6757026909ef77ba2d767a9faf6daf Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 23:31:32 -0400
Subject: [PATCH 30/34] Use all-static feature from cargo

---
 .github/workflows/manual_reproducible.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index d07212c..4a56f78 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -62,7 +62,7 @@ jobs:
           CFG_RELEASE: 1.94.1
           CFG_RELEASE_CHANNEL: stable
           CFG_VER_DESCRIPTION: macos-aarch64-metadata-patch
-        run: cargo build --locked --release --package cargo --bin cargo --target "$TARGET"
+        run: cargo build --locked --release --package cargo --bin cargo --features all-static --target "$TARGET"
 
       - name: Upload patched Cargo
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

From b399093ee656c92cea9d10fd95bf4b439df0f6ea Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Tue, 8 Sep 2026 23:47:49 -0400
Subject: [PATCH 31/34] Fix miscompilation for macOS intel

---
 .github/workflows/manual_reproducible.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index 4a56f78..6468578 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -122,6 +122,8 @@ jobs:
           chmod +x "$GITHUB_WORKSPACE/patched-cargo/cargo"
           echo "$GITHUB_WORKSPACE/patched-cargo" >> "$GITHUB_PATH"
           echo "CARGO=$GITHUB_WORKSPACE/patched-cargo/cargo" >> "$GITHUB_ENV"
+          echo "RUSTC=$(rustup which rustc)" >> "$GITHUB_ENV"
+          echo "RUSTDOC=$(rustup which rustdoc)" >> "$GITHUB_ENV"
 
       - name: Configure reproducible builds
         run: |

From 8b100b0a0dc86c4f57d9d01ac5bbdde12541b1b0 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Wed, 9 Sep 2026 00:15:32 -0400
Subject: [PATCH 32/34] Update patchh

---
 .../cargo-macos-aarch64-metadata.patch        | 19 ++-----------------
 1 file changed, 2 insertions(+), 17 deletions(-)

diff --git a/.github/reproducibility/patches/cargo-macos-aarch64-metadata.patch b/.github/reproducibility/patches/cargo-macos-aarch64-metadata.patch
index 660f7f5..bc3eec6 100644
--- a/.github/reproducibility/patches/cargo-macos-aarch64-metadata.patch
+++ b/.github/reproducibility/patches/cargo-macos-aarch64-metadata.patch
@@ -1,22 +1,7 @@
 diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/cargo/core/compiler/build_runner/compilation_files.rs
 --- a/src/cargo/core/compiler/build_runner/compilation_files.rs
 +++ b/src/cargo/core/compiler/build_runner/compilation_files.rs
-@@ -793,6 +793,14 @@
-                 .links_overrides
-                 != unit.links_overrides;
-         target_configs_are_different.hash(&mut shared_hasher);
-+    } else if unit.kind.is_host()
-+        && bcx.build_config.requested_kinds.iter().any(|kind| {
-+            matches!(kind, CompileKind::Target(target) if target.short_name() == "aarch64-apple-darwin")
-+        })
-+    {
-+        // Reproducible fix: match the macOS ARM64 baseline host.
-+        // Change hash input only, not the actual host configuration or compiler flags.
-+        false.hash(&mut shared_hasher);
-     }
-
-     let mut c_metadata_hasher = shared_hasher.clone();
-@@ -864,6 +872,12 @@
+@@ -864,6 +864,12 @@
          for line in bcx.rustc().verbose_version.lines() {
              if unit.kind.is_host() || !line.starts_with("host: ") {
 +                // Normalize hash input only; keep the real host for compilation.
@@ -29,7 +14,7 @@ diff --git a/src/cargo/core/compiler/build_runner/compilation_files.rs b/src/car
              }
          }
          return;
-@@ -881,3 +895,3 @@
+@@ -881,3 +887,3 @@
      if unit.kind.is_host() {
 -        bcx.rustc().host.hash(hasher);
 +        "aarch64-apple-darwin".hash(hasher);

From 21ad83ab38e6ebe5640f9143196349d28d549869 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Wed, 9 Sep 2026 00:34:08 -0400
Subject: [PATCH 33/34] Use reproducible gtar command

---
 .github/workflows/manual_reproducible.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index 6468578..03cec99 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -136,6 +136,9 @@ jobs:
       - name: Build
         run: cargo auditable build -vv --locked --release --target ${{ matrix.target }}
 
+      - name: Install GNU tar
+        run: brew install gnu-tar
+
       - name: Create release archive
         env:
           TARGET: ${{ matrix.target }}
@@ -143,7 +146,10 @@ jobs:
         run: |
           BIN_PATH="target/${TARGET}/release/${NAME}"
           ARCHIVE_NAME="${NAME}-${PRETTY_TARGET}.tar.gz"
-          tar czf "${ARCHIVE_NAME}" -C "target/${TARGET}/release" "${NAME}"
+          gtar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
+            --owner=0 --group=0 --numeric-owner --mode=0755 \
+            -cf "${ARCHIVE_NAME%.gz}" -C "target/${TARGET}/release" "${NAME}"
+          gzip -n -9 "${ARCHIVE_NAME%.gz}"
 
           mkdir -p artifacts
           cp "${BIN_PATH}" "${ARCHIVE_NAME}" artifacts/

From 859b96ea1538120c11f5ac5cbab09be33d1a1c90 Mon Sep 17 00:00:00 2001
From: Ivan Carvalho <ivancarvalho@gatech.edu>
Date: Wed, 9 Sep 2026 14:01:03 -0400
Subject: [PATCH 34/34] macOS reproducible builds

---
 .github/workflows/main.yml                    |   9 +
 .github/workflows/manual_reproducible.yml     | 553 +++++++++++++++++-
 .github/workflows/manual_reproducible.yml.bak | 551 -----------------
 .github/workflows/release_github.yml          |  20 +-
 .github/zizmor.yml                            |   8 +-
 5 files changed, 575 insertions(+), 566 deletions(-)
 delete mode 100644 .github/workflows/manual_reproducible.yml.bak

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 75aabd7..18dee84 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -149,6 +149,15 @@ jobs:
       - name: Restore Cargo downloads
         if: runner.os == 'Linux'
         uses: $/.github/actions/restore-cargo-downloads
+
+      - name: Select pinned macOS SDK
+        if: runner.os == 'macOS'
+        env:
+          DEVELOPER_DIR: /Applications/Xcode_16.4.app/Contents/Developer
+        run: |
+          echo "DEVELOPER_DIR=${DEVELOPER_DIR}" >> "$GITHUB_ENV"
+          echo "MACOSX_DEPLOYMENT_TARGET=11.0" >> "$GITHUB_ENV"
+          echo "SDKROOT=$(xcrun --sdk macosx15.5 --show-sdk-path)" >> "$GITHUB_ENV"
       
       - name: Install Rust ${{ matrix.rust }}
         uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
diff --git a/.github/workflows/manual_reproducible.yml b/.github/workflows/manual_reproducible.yml
index 03cec99..992f8fa 100644
--- a/.github/workflows/manual_reproducible.yml
+++ b/.github/workflows/manual_reproducible.yml
@@ -1,4 +1,4 @@
-name: Reproducible macOS builds (Manual)
+name: Reproducible builds (Manual)
 
 on:
   workflow_dispatch:
@@ -8,10 +8,548 @@ permissions:
 
 env:
   CARGO_TERM_COLOR: always
-  NAME: celq
 
 jobs:
   patched_cargo:
+    name: Patched Cargo (${{ matrix.target }})
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [aarch64-unknown-linux-gnu, x86_64-unknown-freebsd]
+    env:
+      TARGET: ${{ matrix.target }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Checkout Cargo source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: rust-lang/cargo
+          ref: 29ea6fb6a5db279426f4cc4e17aa385f05a0cfbc
+          path: cargo-source
+          persist-credentials: false
+          fetch-depth: 1
+          sparse-checkout: |
+            src
+            crates
+            credential
+            benches/benchsuite
+            benches/capture
+
+      - name: Setup Zigbuild
+        uses: $/.github/actions/setup-zigbuild
+        with:
+          target: ${{ matrix.target }}
+          rust_components: rust-src
+          install_target: "true"
+          use_cache: "false"
+
+      - name: Patch Cargo
+        working-directory: cargo-source
+        run: |
+          git apply --check ../.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
+          git apply ../.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
+
+      - name: Build patched Cargo with Zig
+        working-directory: cargo-source
+        env:
+          CFG_RELEASE: 1.94.1
+          CFG_RELEASE_CHANNEL: stable
+          CFG_VER_DESCRIPTION: linux-x86_64-metadata-patch
+          LIBZ_SYS_STATIC: "1"
+        run: |
+          cargo zigbuild --locked --release --package cargo --bin cargo --features all-static --target "$TARGET"
+
+      - name: Upload patched Cargo
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: patched-cargo-${{ matrix.target }}
+          path: cargo-source/target/${{ matrix.target }}/release/cargo
+          retention-days: 1
+          if-no-files-found: error
+
+  freebsd_tools:
+    name: Build FreeBSD tools
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Setup Zigbuild
+        uses: $/.github/actions/setup-zigbuild
+        with:
+          target: x86_64-unknown-freebsd
+          rust_components: rust-src
+          install_target: "true"
+          use_cache: "false"
+
+      - name: Install cargo-clone
+        run: |
+          /home/linuxbrew/.linuxbrew/bin/brew install --force-bottle cargo-clone
+          echo "/home/linuxbrew/.linuxbrew/bin" >> "$GITHUB_PATH"
+
+      - name: Download tool sources
+        run: cargo clone cargo-zigbuild@0.23.2 cargo-auditable@0.7.5 -- freebsd-tool-sources/
+
+      - name: Cross-compile cargo-zigbuild
+        run: |
+          cargo zigbuild --locked --release --bin cargo-zigbuild --target x86_64-unknown-freebsd \
+            --manifest-path freebsd-tool-sources/cargo-zigbuild/Cargo.toml \
+            --target-dir "$GITHUB_WORKSPACE/freebsd-tools-build"
+
+      - name: Cross-compile cargo-auditable
+        run: |
+          cargo zigbuild --locked --release --bin cargo-auditable --target x86_64-unknown-freebsd \
+            --manifest-path freebsd-tool-sources/cargo-auditable/Cargo.toml \
+            --target-dir "$GITHUB_WORKSPACE/freebsd-tools-build"
+
+      - name: Upload FreeBSD tools
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: freebsd-tools-x86_64
+          path: |
+            freebsd-tools-build/x86_64-unknown-freebsd/release/cargo-zigbuild
+            freebsd-tools-build/x86_64-unknown-freebsd/release/cargo-auditable
+          retention-days: 1
+          if-no-files-found: error
+
+  zigbuild:
+    name: Zigbuild (${{ matrix.runner }}, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
+    needs: patched_cargo
+    runs-on: ${{ matrix.runner }}
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-24.04, ubuntu-24.04-arm]
+        build:
+          - target: x86_64-unknown-linux-gnu
+            zigtargetsuffix: .2.28
+          - target: x86_64-unknown-linux-musl
+            zigtargetsuffix: ""
+          - target: aarch64-unknown-linux-gnu
+            zigtargetsuffix: .2.28
+          - target: aarch64-unknown-linux-musl
+            zigtargetsuffix: ""
+        exclude:
+          - runner: ubuntu-24.04-arm
+            build:
+              target: aarch64-unknown-linux-gnu
+              zigtargetsuffix: .2.28
+          - runner: ubuntu-24.04-arm
+            build:
+              target: aarch64-unknown-linux-musl
+              zigtargetsuffix: ""
+    env:
+      TARGET: ${{ matrix.build.target }}
+      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
+    steps:
+      # Every host builds the same HEAD captured by the manual dispatch.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Download patched Cargo
+        if: matrix.runner == 'ubuntu-24.04-arm'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: patched-cargo-aarch64-unknown-linux-gnu
+          path: patched-cargo
+
+      - name: Setup Zigbuild
+        uses: $/.github/actions/setup-zigbuild
+        with:
+          target: ${{ matrix.build.target }}
+          rust_components: rust-src
+          install_target: "true"
+          use_cache: "false"
+
+      - name: Select patched Cargo
+        if: matrix.runner == 'ubuntu-24.04-arm'
+        run: |
+          chmod +x "$GITHUB_WORKSPACE/patched-cargo/cargo"
+          echo "$GITHUB_WORKSPACE/patched-cargo" >> "$GITHUB_PATH"
+          echo "CARGO=$GITHUB_WORKSPACE/patched-cargo/cargo" >> "$GITHUB_ENV"
+
+      - name: Verify patched Cargo selection
+        if: matrix.runner == 'ubuntu-24.04-arm'
+        run: |
+          test "$(command -v cargo)" = "$CARGO"
+          echo "Using patched Cargo: $CARGO"
+
+      - name: Configure reproducible builds
+        run: |
+          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
+          echo "TZ=UTC" >> "$GITHUB_ENV"
+          echo "LC_ALL=C" >> "$GITHUB_ENV"
+          RUST_SYSROOT=$(rustc --print sysroot)
+          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
+
+      - name: Build with Zig
+        run: |
+          cargo auditable zigbuild --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
+
+      - name: Create release archive
+        run: |
+          mkdir -p artifacts
+          cp "target/${TARGET}/release/celq" artifacts/celq
+          tar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
+            --owner=0 --group=0 --numeric-owner --mode=0755 \
+            -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
+          gzip -n -9 artifacts/celq.tar
+
+      - name: Upload archive and binary
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-${{ matrix.runner }}
+          retention-days: 1
+          path: |
+            artifacts/celq
+            artifacts/celq.tar.gz
+          if-no-files-found: error
+          compression-level: 0
+
+  freebsd:
+    name: Zigbuild (FreeBSD x86-64, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
+    needs: [patched_cargo, freebsd_tools]
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        build:
+          - target: aarch64-unknown-linux-gnu
+            zigtargetsuffix: .2.28
+          - target: aarch64-unknown-linux-musl
+            zigtargetsuffix: ""
+    env:
+      TARGET: ${{ matrix.build.target }}
+      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Capture commit timestamp
+        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
+
+      - name: Download patched Cargo
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: patched-cargo-x86_64-unknown-freebsd
+          path: patched-cargo
+
+      - name: Download FreeBSD tools
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: freebsd-tools-x86_64
+          path: freebsd-tools
+
+      - name: Build on FreeBSD
+        uses: vmactions/freebsd-vm@f0552d3b69211736abd97f02ff3d4674c56b73b1 # v1.5.5
+        with:
+          release: "14.4"
+          arch: x86_64
+          sync: rsync
+          copyback: true
+          envs: TARGET ZIGTARGETSUFFIX SOURCE_DATE_EPOCH
+          prepare: |
+            set -eu
+            pkg install -y ca_root_nss git devel/rustup-init archivers/gtar archivers/gzip
+
+            # Install the official FreeBSD Zig archive directly from ziglang.org.
+            cd /tmp
+            fetch https://ziglang.org/download/0.15.2/zig-x86_64-freebsd-0.15.2.tar.xz
+            test "$(sha256 -q zig-x86_64-freebsd-0.15.2.tar.xz)" = \
+              "5509ff57cd3f219165caed0da10221739af82742b9edfcda3f7bfaf4da7212dd"
+            tar -xf zig-x86_64-freebsd-0.15.2.tar.xz
+
+            rustup-init -y --profile minimal --default-toolchain 1.94.1
+            . "$HOME/.cargo/env"
+            rustup component add rust-src --toolchain 1.94.1
+
+          run: |
+            set -eu
+            . "$HOME/.cargo/env"
+            install -m 755 freebsd-tools/cargo-zigbuild "$HOME/.cargo/bin/"
+            mkdir -p /home/runner/.cargo/bin
+            install -m 755 freebsd-tools/cargo-auditable /home/runner/.cargo/bin/cargo-auditable
+            export PATH="/home/runner/.cargo/bin:/tmp/zig-x86_64-freebsd-0.15.2:$PATH"
+            test "$(command -v cargo-auditable)" = /home/runner/.cargo/bin/cargo-auditable
+            rustup target add --toolchain 1.94.1 "$TARGET"
+
+            # Host job environment variables are not inherited by the VM.
+            export RUSTUP_TOOLCHAIN=1.94.1
+            export CARGO_TERM_COLOR=always TZ=UTC LC_ALL=C
+            export SOURCE_DATE_EPOCH
+            RUST_SYSROOT=$(rustc --print sysroot)
+            export RUSTFLAGS="--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=$(pwd -P)=/src"
+            export CARGO="$(pwd -P)/patched-cargo/cargo"
+            chmod +x "$CARGO"
+            export PATH="$(pwd -P)/patched-cargo:$PATH"
+            test "$(command -v cargo)" = "$CARGO"
+            echo "Using patched Cargo: $CARGO"
+            "$CARGO" auditable zigbuild --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
+
+            mkdir -p artifacts
+            cp "target/${TARGET}/release/celq" artifacts/celq
+            gtar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
+              --owner=0 --group=0 --numeric-owner --mode=0755 \
+              -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
+            /usr/local/bin/gzip -n -9 artifacts/celq.tar
+
+      - name: Upload archive and binary
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-freebsd-x86_64
+          retention-days: 1
+          path: |
+            artifacts/celq
+            artifacts/celq.tar.gz
+          if-no-files-found: error
+          compression-level: 0
+
+  hashes:
+    name: SHA-256 (${{ matrix.pair.target }}, ${{ matrix.original }} vs ${{ matrix.pair.verify }})
+    needs: [zigbuild, freebsd]
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        original: [ubuntu-24.04]
+        pair:
+          - target: x86_64-unknown-linux-gnu.2.28
+            verify: ubuntu-24.04-arm
+          - target: x86_64-unknown-linux-musl
+            verify: ubuntu-24.04-arm
+          - target: aarch64-unknown-linux-gnu.2.28
+            verify: freebsd-x86_64
+          - target: aarch64-unknown-linux-musl
+            verify: freebsd-x86_64
+    steps:
+      - name: Download original artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-${{ matrix.pair.target }}-${{ matrix.original }}
+          path: artifacts/${{ matrix.original }}
+
+      - name: Download verification artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-${{ matrix.pair.target }}-${{ matrix.pair.verify }}
+          path: artifacts/${{ matrix.pair.verify }}
+
+      - name: Print and compare SHA-256 hashes
+        env:
+          ORIGINAL: ${{ matrix.original }}
+          VERIFY: ${{ matrix.pair.verify }}
+        run: |
+          find artifacts -type f -exec sha256sum {} +
+          (cd "artifacts/$ORIGINAL" && sha256sum celq celq.tar.gz) > original.sha256
+          (cd "artifacts/$VERIFY" && sha256sum celq celq.tar.gz) > verification.sha256
+          diff -u original.sha256 verification.sha256
+
+  patched_cargo_windows:
+    name: Patched Cargo (Windows ARM64)
+    runs-on: windows-2025
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Preserve LF line endings for Cargo patching
+        run: git config --global core.autocrlf false
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Checkout Cargo source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: rust-lang/cargo
+          ref: 29ea6fb6a5db279426f4cc4e17aa385f05a0cfbc
+          path: cargo-source
+          persist-credentials: false
+          fetch-depth: 1
+          sparse-checkout: |
+            src
+            crates
+            credential
+            benches/benchsuite
+            benches/capture
+
+      - name: Install Rust 1.94.1 with Windows ARM64 target
+        uses: dtolnay/rust-toolchain@9376cdc5a5e25b16da71af47712785cf06b0d6d4 # 1.94.1
+        with:
+          targets: aarch64-pc-windows-msvc
+
+      - name: Patch Cargo metadata
+        working-directory: cargo-source
+        run: |
+          git apply --check ../.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
+          git apply ../.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
+
+      - name: Cross-compile patched Cargo for Windows ARM64
+        working-directory: cargo-source
+        env:
+          CFG_RELEASE: 1.94.1
+          CFG_RELEASE_CHANNEL: stable
+          CFG_VER_DESCRIPTION: windows-x86_64-metadata-patch
+          LIBZ_SYS_STATIC: "1"
+        run: >-
+          cargo build --locked --release --package cargo --bin cargo
+          --features all-static --target aarch64-pc-windows-msvc
+
+      - name: Upload patched Cargo
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: patched-cargo-aarch64-pc-windows-msvc
+          path: cargo-source/target/aarch64-pc-windows-msvc/release/cargo.exe
+          retention-days: 1
+          if-no-files-found: error
+
+  xwin:
+    name: Xwin (${{ matrix.runner }}, ${{ matrix.target }})
+    needs: patched_cargo_windows
+    runs-on: ${{ matrix.runner }}
+    defaults:
+      run:
+        shell: bash
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [windows-2025, windows-11-vs2026-arm]
+        target: &xwin_targets
+          - x86_64-pc-windows-msvc
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Select native Windows ARM64 Rust host
+        if: runner.arch == 'ARM64'
+        run: |
+          rustup set default-host aarch64-pc-windows-msvc
+          echo "RUSTUP_TOOLCHAIN=1.94.1-aarch64-pc-windows-msvc" >> "$GITHUB_ENV"
+
+      - name: Setup Xwin
+        id: setup-xwin
+        uses: $/.github/actions/setup-xwin
+        with:
+          target: ${{ matrix.target }}
+          rust_components: llvm-tools
+          cache_directory: ${{ github.workspace }}/.xwin-cache
+          use_cache: "true"
+
+      - name: Verify native Windows ARM64 compiler
+        if: runner.arch == 'ARM64'
+        run: |
+          test "$(rustc -vV | sed -n 's/^host: //p' | tr -d '\r')" = aarch64-pc-windows-msvc
+
+      - name: Download patched Cargo
+        if: runner.arch == 'ARM64'
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: patched-cargo-aarch64-pc-windows-msvc
+          path: patched-cargo
+
+      - name: Select patched Cargo
+        if: runner.arch == 'ARM64'
+        run: |
+          echo "$(cygpath -aw "$GITHUB_WORKSPACE/patched-cargo")" >> "$GITHUB_PATH"
+          echo "CARGO=$(cygpath -aw "$GITHUB_WORKSPACE/patched-cargo/cargo.exe")" >> "$GITHUB_ENV"
+
+      - name: Verify patched Cargo selection
+        if: runner.arch == 'ARM64'
+        run: |
+          test "$(cygpath -aw "$(command -v cargo)")" = "$CARGO"
+          echo "Using patched Cargo: $CARGO"
+
+      - name: Configure reproducible builds
+        run: |
+          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
+          echo "TZ=UTC" >> "$GITHUB_ENV"
+          echo "LC_ALL=C" >> "$GITHUB_ENV"
+          RUST_SYSROOT=$(rustc --print sysroot)
+          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src -C link-arg=/DEBUG:NONE" >> "$GITHUB_ENV"
+
+      - name: Build with Xwin
+        env:
+          TARGET: ${{ matrix.target }}
+          XWIN_CACHE_DIR: ${{ steps.setup-xwin.outputs.cache_directory }}
+          XWIN_CRT_VERSION: ${{ steps.setup-xwin.outputs.xwin_crt_version }}
+          XWIN_SDK_VERSION: ${{ steps.setup-xwin.outputs.xwin_sdk_version }}
+          XWIN_VERSION: ${{ steps.setup-xwin.outputs.xwin_version }}
+        run: >-
+          cargo auditable xwin build --locked --release --target "${TARGET}"
+          --xwin-version "${XWIN_VERSION}"
+          --xwin-sdk-version "${XWIN_SDK_VERSION}"
+          --xwin-crt-version "${XWIN_CRT_VERSION}"
+
+      - name: Create release archive
+        env:
+          NAME: celq
+          PRETTY_TARGET: windows-x86_64
+          TARGET: ${{ matrix.target }}
+        run: |
+          BIN_PATH="target/${TARGET}/release/${NAME}.exe"
+          ARCHIVE_NAME="${NAME}-${PRETTY_TARGET}.zip"
+          7z a -mtm=off -mtc=off -mta=off "${ARCHIVE_NAME}" "./${BIN_PATH}"
+          7z rn "${ARCHIVE_NAME}" "target/${TARGET}/release/${NAME}.exe" "${NAME}.exe"
+
+          mkdir -p artifacts
+          cp "${BIN_PATH}" "${ARCHIVE_NAME}" artifacts/
+
+      - name: Upload Windows binary and archive
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: reproducible-xwin-${{ matrix.target }}-${{ matrix.runner }}
+          path: |
+            artifacts/celq.exe
+            artifacts/celq-windows-x86_64.zip
+          retention-days: 1
+          if-no-files-found: error
+          compression-level: 0
+
+  xwin_hashes:
+    name: Xwin SHA-256 (${{ matrix.target }}, Windows x86-64 vs ARM64)
+    needs: xwin
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        target: *xwin_targets
+    steps:
+      - name: Download Windows x86-64 artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-xwin-${{ matrix.target }}-windows-2025
+          path: artifacts/windows-2025
+
+      - name: Download Windows ARM64 artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: reproducible-xwin-${{ matrix.target }}-windows-11-vs2026-arm
+          path: artifacts/windows-11-vs2026-arm
+
+      - name: Print and compare SHA-256 hashes
+        run: |
+          find artifacts -type f -exec sha256sum {} +
+          (cd artifacts/windows-2025 && sha256sum celq.exe celq-windows-x86_64.zip) > original.sha256
+          (cd artifacts/windows-11-vs2026-arm && sha256sum celq.exe celq-windows-x86_64.zip) > verification.sha256
+          diff -u original.sha256 verification.sha256
+
+  patched_cargo_mac:
     name: Patched Cargo (x86_64-apple-darwin)
     runs-on: macos-15
     defaults:
@@ -72,9 +610,9 @@ jobs:
           retention-days: 1
           if-no-files-found: error
 
-  build_mac:
+  macos:
     name: macOS (${{ matrix.runner }}, ${{ matrix.target }})
-    needs: patched_cargo
+    needs: patched_cargo_mac
     runs-on: ${{ matrix.runner }}
     defaults:
       run:
@@ -87,6 +625,7 @@ jobs:
     env:
       DEVELOPER_DIR: /Applications/Xcode_16.4.app/Contents/Developer
       MACOSX_DEPLOYMENT_TARGET: "11.0"
+      NAME: celq
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -134,7 +673,7 @@ jobs:
           echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
 
       - name: Build
-        run: cargo auditable build -vv --locked --release --target ${{ matrix.target }}
+        run: cargo auditable build --locked --release --target ${{ matrix.target }}
 
       - name: Install GNU tar
         run: brew install gnu-tar
@@ -165,9 +704,9 @@ jobs:
           if-no-files-found: error
           compression-level: 0
 
-  hashes:
+  macos_hashes:
     name: SHA-256 (macOS ARM64 vs Intel hosts)
-    needs: build_mac
+    needs: macos
     if: ${{ !cancelled() }}
     runs-on: ubuntu-24.04
     steps:
diff --git a/.github/workflows/manual_reproducible.yml.bak b/.github/workflows/manual_reproducible.yml.bak
deleted file mode 100644
index ee73a2d..0000000
--- a/.github/workflows/manual_reproducible.yml.bak
+++ /dev/null
@@ -1,551 +0,0 @@
-name: Reproducible builds (Manual)
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  patched_cargo:
-    name: Patched Cargo (${{ matrix.target }})
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        target: [aarch64-unknown-linux-gnu, x86_64-unknown-freebsd]
-    env:
-      TARGET: ${{ matrix.target }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Checkout Cargo source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          repository: rust-lang/cargo
-          ref: 29ea6fb6a5db279426f4cc4e17aa385f05a0cfbc
-          path: cargo-source
-          persist-credentials: false
-          fetch-depth: 1
-          sparse-checkout: |
-            src
-            crates
-            credential
-            benches/benchsuite
-            benches/capture
-
-      - name: Setup Zigbuild
-        uses: $/.github/actions/setup-zigbuild
-        with:
-          target: ${{ matrix.target }}
-          rust_components: rust-src
-          install_target: "true"
-          use_cache: "false"
-
-      - name: Patch Cargo
-        working-directory: cargo-source
-        run: |
-          git apply --check ../.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
-          git apply ../.github/reproducibility/patches/cargo-linux-x86_64-metadata.patch
-
-      - name: Build patched Cargo with Zig
-        working-directory: cargo-source
-        env:
-          CFG_RELEASE: 1.94.1
-          CFG_RELEASE_CHANNEL: stable
-          CFG_VER_DESCRIPTION: linux-x86_64-metadata-patch
-          LIBZ_SYS_STATIC: "1"
-        run: |
-          cargo zigbuild --locked --release --package cargo --bin cargo --features all-static --target "$TARGET"
-
-      - name: Upload patched Cargo
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: patched-cargo-${{ matrix.target }}
-          path: cargo-source/target/${{ matrix.target }}/release/cargo
-          retention-days: 1
-          if-no-files-found: error
-
-  freebsd_tools:
-    name: Build FreeBSD tools
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Setup Zigbuild
-        uses: $/.github/actions/setup-zigbuild
-        with:
-          target: x86_64-unknown-freebsd
-          rust_components: rust-src
-          install_target: "true"
-          use_cache: "false"
-
-      - name: Install cargo-clone
-        run: |
-          /home/linuxbrew/.linuxbrew/bin/brew install --force-bottle cargo-clone
-          echo "/home/linuxbrew/.linuxbrew/bin" >> "$GITHUB_PATH"
-
-      - name: Download tool sources
-        run: cargo clone cargo-zigbuild@0.23.2 cargo-auditable@0.7.5 -- freebsd-tool-sources/
-
-      - name: Cross-compile cargo-zigbuild
-        run: |
-          cargo zigbuild --locked --release --bin cargo-zigbuild --target x86_64-unknown-freebsd \
-            --manifest-path freebsd-tool-sources/cargo-zigbuild/Cargo.toml \
-            --target-dir "$GITHUB_WORKSPACE/freebsd-tools-build"
-
-      - name: Cross-compile cargo-auditable
-        run: |
-          cargo zigbuild --locked --release --bin cargo-auditable --target x86_64-unknown-freebsd \
-            --manifest-path freebsd-tool-sources/cargo-auditable/Cargo.toml \
-            --target-dir "$GITHUB_WORKSPACE/freebsd-tools-build"
-
-      - name: Upload FreeBSD tools
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: freebsd-tools-x86_64
-          path: |
-            freebsd-tools-build/x86_64-unknown-freebsd/release/cargo-zigbuild
-            freebsd-tools-build/x86_64-unknown-freebsd/release/cargo-auditable
-          retention-days: 1
-          if-no-files-found: error
-
-  zigbuild:
-    name: Zigbuild (${{ matrix.runner }}, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
-    needs: patched_cargo
-    runs-on: ${{ matrix.runner }}
-    strategy:
-      fail-fast: false
-      matrix:
-        runner: [ubuntu-24.04, ubuntu-24.04-arm]
-        build:
-          - target: x86_64-unknown-linux-gnu
-            zigtargetsuffix: .2.28
-          - target: x86_64-unknown-linux-musl
-            zigtargetsuffix: ""
-          - target: aarch64-unknown-linux-gnu
-            zigtargetsuffix: .2.28
-          - target: aarch64-unknown-linux-musl
-            zigtargetsuffix: ""
-        exclude:
-          - runner: ubuntu-24.04-arm
-            build:
-              target: aarch64-unknown-linux-gnu
-              zigtargetsuffix: .2.28
-          - runner: ubuntu-24.04-arm
-            build:
-              target: aarch64-unknown-linux-musl
-              zigtargetsuffix: ""
-    env:
-      TARGET: ${{ matrix.build.target }}
-      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
-    steps:
-      # Every host builds the same HEAD captured by the manual dispatch.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Download patched Cargo
-        if: matrix.runner == 'ubuntu-24.04-arm'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: patched-cargo-aarch64-unknown-linux-gnu
-          path: patched-cargo
-
-      - name: Setup Zigbuild
-        uses: $/.github/actions/setup-zigbuild
-        with:
-          target: ${{ matrix.build.target }}
-          rust_components: rust-src
-          install_target: "true"
-          use_cache: "false"
-
-      - name: Select patched Cargo
-        if: matrix.runner == 'ubuntu-24.04-arm'
-        run: |
-          chmod +x "$GITHUB_WORKSPACE/patched-cargo/cargo"
-          echo "$GITHUB_WORKSPACE/patched-cargo" >> "$GITHUB_PATH"
-          echo "CARGO=$GITHUB_WORKSPACE/patched-cargo/cargo" >> "$GITHUB_ENV"
-
-      - name: Verify patched Cargo selection
-        if: matrix.runner == 'ubuntu-24.04-arm'
-        run: |
-          test "$(command -v cargo)" = "$CARGO"
-          echo "Using patched Cargo: $CARGO"
-
-      - name: Configure reproducible builds
-        run: |
-          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
-          echo "TZ=UTC" >> "$GITHUB_ENV"
-          echo "LC_ALL=C" >> "$GITHUB_ENV"
-          RUST_SYSROOT=$(rustc --print sysroot)
-          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src" >> "$GITHUB_ENV"
-
-      - name: Build with Zig
-        run: |
-          cargo auditable zigbuild --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
-
-      - name: Create release archive
-        run: |
-          mkdir -p artifacts
-          cp "target/${TARGET}/release/celq" artifacts/celq
-          tar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
-            --owner=0 --group=0 --numeric-owner --mode=0755 \
-            -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
-          gzip -n -9 artifacts/celq.tar
-
-      - name: Upload archive and binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-${{ matrix.runner }}
-          retention-days: 1
-          path: |
-            artifacts/celq
-            artifacts/celq.tar.gz
-          if-no-files-found: error
-          compression-level: 0
-
-  freebsd:
-    name: Zigbuild (FreeBSD x86-64, ${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }})
-    needs: [patched_cargo, freebsd_tools]
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        build:
-          - target: aarch64-unknown-linux-gnu
-            zigtargetsuffix: .2.28
-          - target: aarch64-unknown-linux-musl
-            zigtargetsuffix: ""
-    env:
-      TARGET: ${{ matrix.build.target }}
-      ZIGTARGETSUFFIX: ${{ matrix.build.zigtargetsuffix }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Capture commit timestamp
-        run: echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
-
-      - name: Download patched Cargo
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: patched-cargo-x86_64-unknown-freebsd
-          path: patched-cargo
-
-      - name: Download FreeBSD tools
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: freebsd-tools-x86_64
-          path: freebsd-tools
-
-      - name: Build on FreeBSD
-        uses: vmactions/freebsd-vm@f0552d3b69211736abd97f02ff3d4674c56b73b1 # v1.5.5
-        with:
-          release: "14.4"
-          arch: x86_64
-          sync: rsync
-          copyback: true
-          envs: TARGET ZIGTARGETSUFFIX SOURCE_DATE_EPOCH
-          prepare: |
-            set -eu
-            pkg install -y ca_root_nss git devel/rustup-init archivers/gtar archivers/gzip
-
-            # Install the official FreeBSD Zig archive directly from ziglang.org.
-            cd /tmp
-            fetch https://ziglang.org/download/0.15.2/zig-x86_64-freebsd-0.15.2.tar.xz
-            test "$(sha256 -q zig-x86_64-freebsd-0.15.2.tar.xz)" = \
-              "5509ff57cd3f219165caed0da10221739af82742b9edfcda3f7bfaf4da7212dd"
-            tar -xf zig-x86_64-freebsd-0.15.2.tar.xz
-
-            rustup-init -y --profile minimal --default-toolchain 1.94.1
-            . "$HOME/.cargo/env"
-            rustup component add rust-src --toolchain 1.94.1
-
-          run: |
-            set -eu
-            . "$HOME/.cargo/env"
-            install -m 755 freebsd-tools/cargo-zigbuild "$HOME/.cargo/bin/"
-            mkdir -p /home/runner/.cargo/bin
-            install -m 755 freebsd-tools/cargo-auditable /home/runner/.cargo/bin/cargo-auditable
-            export PATH="/home/runner/.cargo/bin:/tmp/zig-x86_64-freebsd-0.15.2:$PATH"
-            test "$(command -v cargo-auditable)" = /home/runner/.cargo/bin/cargo-auditable
-            rustup target add --toolchain 1.94.1 "$TARGET"
-
-            # Host job environment variables are not inherited by the VM.
-            export RUSTUP_TOOLCHAIN=1.94.1
-            export CARGO_TERM_COLOR=always TZ=UTC LC_ALL=C
-            export SOURCE_DATE_EPOCH
-            RUST_SYSROOT=$(rustc --print sysroot)
-            export RUSTFLAGS="--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=$(pwd -P)=/src"
-            export CARGO="$(pwd -P)/patched-cargo/cargo"
-            chmod +x "$CARGO"
-            export PATH="$(pwd -P)/patched-cargo:$PATH"
-            test "$(command -v cargo)" = "$CARGO"
-            echo "Using patched Cargo: $CARGO"
-            "$CARGO" auditable zigbuild --locked --release --target "${TARGET}${ZIGTARGETSUFFIX}"
-
-            mkdir -p artifacts
-            cp "target/${TARGET}/release/celq" artifacts/celq
-            gtar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
-              --owner=0 --group=0 --numeric-owner --mode=0755 \
-              -cf artifacts/celq.tar -C "target/${TARGET}/release" celq
-            /usr/local/bin/gzip -n -9 artifacts/celq.tar
-
-      - name: Upload archive and binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: reproducible-${{ matrix.build.target }}${{ matrix.build.zigtargetsuffix }}-freebsd-x86_64
-          retention-days: 1
-          path: |
-            artifacts/celq
-            artifacts/celq.tar.gz
-          if-no-files-found: error
-          compression-level: 0
-
-  hashes:
-    name: SHA-256 (${{ matrix.pair.target }}, ${{ matrix.original }} vs ${{ matrix.pair.verify }})
-    needs: [zigbuild, freebsd]
-    if: ${{ !cancelled() }}
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        original: [ubuntu-24.04]
-        pair:
-          - target: x86_64-unknown-linux-gnu.2.28
-            verify: ubuntu-24.04-arm
-          - target: x86_64-unknown-linux-musl
-            verify: ubuntu-24.04-arm
-          - target: aarch64-unknown-linux-gnu.2.28
-            verify: freebsd-x86_64
-          - target: aarch64-unknown-linux-musl
-            verify: freebsd-x86_64
-    steps:
-      - name: Download original artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: reproducible-${{ matrix.pair.target }}-${{ matrix.original }}
-          path: artifacts/${{ matrix.original }}
-
-      - name: Download verification artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: reproducible-${{ matrix.pair.target }}-${{ matrix.pair.verify }}
-          path: artifacts/${{ matrix.pair.verify }}
-
-      - name: Print and compare SHA-256 hashes
-        env:
-          ORIGINAL: ${{ matrix.original }}
-          VERIFY: ${{ matrix.pair.verify }}
-        run: |
-          find artifacts -type f -exec sha256sum {} +
-          (cd "artifacts/$ORIGINAL" && sha256sum celq celq.tar.gz) > original.sha256
-          (cd "artifacts/$VERIFY" && sha256sum celq celq.tar.gz) > verification.sha256
-          diff -u original.sha256 verification.sha256
-
-  patched_cargo_windows:
-    name: Patched Cargo (Windows ARM64)
-    runs-on: windows-2025
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - name: Preserve LF line endings for Cargo patching
-        run: git config --global core.autocrlf false
-
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Checkout Cargo source
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          repository: rust-lang/cargo
-          ref: 29ea6fb6a5db279426f4cc4e17aa385f05a0cfbc
-          path: cargo-source
-          persist-credentials: false
-          fetch-depth: 1
-          sparse-checkout: |
-            src
-            crates
-            credential
-            benches/benchsuite
-            benches/capture
-
-      - name: Install Rust 1.94.1 with Windows ARM64 target
-        uses: dtolnay/rust-toolchain@9376cdc5a5e25b16da71af47712785cf06b0d6d4 # 1.94.1
-        with:
-          targets: aarch64-pc-windows-msvc
-
-      - name: Patch Cargo metadata
-        working-directory: cargo-source
-        run: |
-          git apply --check ../.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
-          git apply ../.github/reproducibility/patches/cargo-windows-x86_64-metadata.patch
-
-      - name: Cross-compile patched Cargo for Windows ARM64
-        working-directory: cargo-source
-        env:
-          CFG_RELEASE: 1.94.1
-          CFG_RELEASE_CHANNEL: stable
-          CFG_VER_DESCRIPTION: windows-x86_64-metadata-patch
-          LIBZ_SYS_STATIC: "1"
-        run: >-
-          cargo build --locked --release --package cargo --bin cargo
-          --features all-static --target aarch64-pc-windows-msvc
-
-      - name: Upload patched Cargo
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: patched-cargo-aarch64-pc-windows-msvc
-          path: cargo-source/target/aarch64-pc-windows-msvc/release/cargo.exe
-          retention-days: 1
-          if-no-files-found: error
-
-  xwin:
-    name: Xwin (${{ matrix.runner }}, ${{ matrix.target }})
-    needs: patched_cargo_windows
-    runs-on: ${{ matrix.runner }}
-    defaults:
-      run:
-        shell: bash
-    strategy:
-      fail-fast: false
-      matrix:
-        runner: [windows-2025, windows-11-vs2026-arm]
-        target: &xwin_targets
-          - x86_64-pc-windows-msvc
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-
-      - name: Select native Windows ARM64 Rust host
-        if: runner.arch == 'ARM64'
-        run: |
-          rustup set default-host aarch64-pc-windows-msvc
-          echo "RUSTUP_TOOLCHAIN=1.94.1-aarch64-pc-windows-msvc" >> "$GITHUB_ENV"
-
-      - name: Setup Xwin
-        id: setup-xwin
-        uses: $/.github/actions/setup-xwin
-        with:
-          target: ${{ matrix.target }}
-          rust_components: llvm-tools
-          cache_directory: ${{ github.workspace }}/.xwin-cache
-          use_cache: "true"
-
-      - name: Verify native Windows ARM64 compiler
-        if: runner.arch == 'ARM64'
-        run: |
-          test "$(rustc -vV | sed -n 's/^host: //p' | tr -d '\r')" = aarch64-pc-windows-msvc
-
-      - name: Download patched Cargo
-        if: runner.arch == 'ARM64'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: patched-cargo-aarch64-pc-windows-msvc
-          path: patched-cargo
-
-      - name: Select patched Cargo
-        if: runner.arch == 'ARM64'
-        run: |
-          echo "$(cygpath -aw "$GITHUB_WORKSPACE/patched-cargo")" >> "$GITHUB_PATH"
-          echo "CARGO=$(cygpath -aw "$GITHUB_WORKSPACE/patched-cargo/cargo.exe")" >> "$GITHUB_ENV"
-
-      - name: Verify patched Cargo selection
-        if: runner.arch == 'ARM64'
-        run: |
-          test "$(cygpath -aw "$(command -v cargo)")" = "$CARGO"
-          echo "Using patched Cargo: $CARGO"
-
-      - name: Configure reproducible builds
-        run: |
-          echo "SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)" >> "$GITHUB_ENV"
-          echo "TZ=UTC" >> "$GITHUB_ENV"
-          echo "LC_ALL=C" >> "$GITHUB_ENV"
-          RUST_SYSROOT=$(rustc --print sysroot)
-          echo "RUSTFLAGS=--remap-path-prefix=${CARGO_HOME:-$HOME/.cargo}=/cargo --remap-path-prefix=${RUST_SYSROOT}=/rust-toolchain --remap-path-prefix=${GITHUB_WORKSPACE}=/src -C link-arg=/DEBUG:NONE" >> "$GITHUB_ENV"
-
-      - name: Build with Xwin
-        env:
-          TARGET: ${{ matrix.target }}
-          XWIN_CACHE_DIR: ${{ steps.setup-xwin.outputs.cache_directory }}
-          XWIN_CRT_VERSION: ${{ steps.setup-xwin.outputs.xwin_crt_version }}
-          XWIN_SDK_VERSION: ${{ steps.setup-xwin.outputs.xwin_sdk_version }}
-          XWIN_VERSION: ${{ steps.setup-xwin.outputs.xwin_version }}
-        run: >-
-          cargo xwin build --locked --release --target "${TARGET}"
-          --no-default-features --features from-toml,from-yaml,greppable,from-xml
-          --xwin-version "${XWIN_VERSION}"
-          --xwin-sdk-version "${XWIN_SDK_VERSION}"
-          --xwin-crt-version "${XWIN_CRT_VERSION}"
-
-      - name: Create release archive
-        env:
-          NAME: celq
-          PRETTY_TARGET: windows-x86_64
-          TARGET: ${{ matrix.target }}
-        run: |
-          BIN_PATH="target/${TARGET}/release/${NAME}.exe"
-          ARCHIVE_NAME="${NAME}-${PRETTY_TARGET}.zip"
-          7z a -mtm=off -mtc=off -mta=off "${ARCHIVE_NAME}" "./${BIN_PATH}"
-          7z rn "${ARCHIVE_NAME}" "target/${TARGET}/release/${NAME}.exe" "${NAME}.exe"
-
-          mkdir -p artifacts
-          cp "${BIN_PATH}" "${ARCHIVE_NAME}" artifacts/
-
-      - name: Upload Windows binary and archive
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: reproducible-xwin-${{ matrix.target }}-${{ matrix.runner }}
-          path: |
-            artifacts/celq.exe
-            artifacts/celq-windows-x86_64.zip
-          retention-days: 1
-          if-no-files-found: error
-          compression-level: 0
-
-  xwin_hashes:
-    name: Xwin SHA-256 (${{ matrix.target }}, Windows x86-64 vs ARM64)
-    needs: xwin
-    if: ${{ !cancelled() }}
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        target: *xwin_targets
-    steps:
-      - name: Download Windows x86-64 artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: reproducible-xwin-${{ matrix.target }}-windows-2025
-          path: artifacts/windows-2025
-
-      - name: Download Windows ARM64 artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
-        with:
-          name: reproducible-xwin-${{ matrix.target }}-windows-11-vs2026-arm
-          path: artifacts/windows-11-vs2026-arm
-
-      - name: Print and compare SHA-256 hashes
-        run: |
-          find artifacts -type f -exec sha256sum {} +
-          (cd artifacts/windows-2025 && sha256sum celq.exe celq-windows-x86_64.zip) > original.sha256
-          (cd artifacts/windows-11-vs2026-arm && sha256sum celq.exe celq-windows-x86_64.zip) > verification.sha256
-          diff -u original.sha256 verification.sha256
diff --git a/.github/workflows/release_github.yml b/.github/workflows/release_github.yml
index c0a6e20..6aeca3b 100644
--- a/.github/workflows/release_github.yml
+++ b/.github/workflows/release_github.yml
@@ -27,6 +27,9 @@ jobs:
     name: ${{ matrix.target }}
     runs-on: ${{ matrix.os }}
     environment: github_release
+    env:
+      DEVELOPER_DIR: /Applications/Xcode_16.4.app/Contents/Developer
+      MACOSX_DEPLOYMENT_TARGET: "11.0"
     permissions:
       contents: write
       id-token: write
@@ -47,6 +50,9 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Select pinned macOS SDK
+        run: echo "SDKROOT=$(xcrun --sdk macosx15.5 --show-sdk-path)" >> "$GITHUB_ENV"
+
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@9376cdc5a5e25b16da71af47712785cf06b0d6d4 # 1.94.1
         with:
@@ -69,15 +75,21 @@ jobs:
       - name: Build
         run: cargo auditable build --locked --release --target ${{ matrix.target }}
 
+      - name: Install GNU tar
+        run: brew install gnu-tar
+
       - name: Create release archive
         id: archive
         run: |
           BIN_PATH="target/${{ matrix.target }}/release/${NAME}"
           ARCHIVE_NAME="${NAME}-${{ matrix.pretty_target }}.tar.gz"
-          tar czf "${ARCHIVE_NAME}" -C "target/${{ matrix.target }}/release" "${NAME}"
+          gtar --format=gnu --sort=name --mtime="@${SOURCE_DATE_EPOCH}" \
+            --owner=0 --group=0 --numeric-owner --mode=0755 \
+            -cf "${ARCHIVE_NAME%.gz}" -C "target/${{ matrix.target }}/release" "${NAME}"
+          gzip -n -9 "${ARCHIVE_NAME%.gz}"
           
-          echo "BIN_PATH=${BIN_PATH}" >> $GITHUB_OUTPUT
-          echo "ARCHIVE_NAME=${ARCHIVE_NAME}" >> $GITHUB_OUTPUT
+          echo "BIN_PATH=${BIN_PATH}" >> "$GITHUB_OUTPUT"
+          echo "ARCHIVE_NAME=${ARCHIVE_NAME}" >> "$GITHUB_OUTPUT"
 
       - name: Generate attestation for release binary
         uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
@@ -92,7 +104,7 @@ jobs:
       - name: Upload release archive
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release upload ${VERSION} ${{ steps.archive.outputs.ARCHIVE_NAME }}
+        run: gh release upload "${VERSION}" "${{ steps.archive.outputs.ARCHIVE_NAME }}"
 
   build_xwin:
     name: ${{ matrix.target }}
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index 12cbadb..1476e3f 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -4,10 +4,10 @@ rules:
   template-injection:
     ignore:
       - release_choco.yml
-      - release_github.yml:95
-      - release_github.yml:275
-      - release_github.yml:302
-      - release_github.yml:340
+      - release_github.yml:107
+      - release_github.yml:287
+      - release_github.yml:314
+      - release_github.yml:352
       - release_sub_homebrew.yml:29
       - release_sub_homebrew.yml:56
       - release_sub_homebrew.yml:69