While working on reproducible builds for openSUSE, I found that
our warewulf package varies in every build.

8 cpio files in /var/lib/warewulf/initramfs/x86_64/ vary every time:
base
capabilities/provision-adhoc
capabilities/provision-files
capabilities/provision-selinux
capabilities/provision-vnfs
capabilities/setup-filesystems
capabilities/setup-ipmi
capabilities/transport-http

Here is a partial PoC patch that helped to produce bit-reproducible results:

--- a/provision/initramfs/capabilities/transport-http/Makefile.am
+++ b/provision/initramfs/capabilities/transport-http/Makefile.am
@@ -16,7 +16,7 @@ rootfs:
        done

 capability.cpio: rootfs
-       cd rootfs/; find . | cpio -o -H newc -F ../capability.cpio
+       cd rootfs/; find . | xargs touch -d @1690848000 ; find . | sort | cpio
-o -H newc --reproducible -F ../capability.cpio

 install-data-local: capability.cpio
        install -d -m 755
$(DESTDIR)/$(WAREWULF_STATEDIR)/warewulf/initramfs/$(MACHINE)/capabilities



I'm not sure if the mtimes of files in the cpio files matter.
The source tar is from 2018, so not sure if upstream would be interested in
this.