Why we record every licence and source RPM

Reproducible builds give you a claim you can check; recorded provenance gives you one you can prove.

A reproducible build means the same inputs produce the same output. But a verifier still has to know what went in. That is what the licence and source records are for.

Without recorded provenance, “this is the image we tested” is a claim rather than something you can independently check.

Pralvo rebuilds a package only when it carries a Pralvo patch or cannot be supplied under the required provenance; unmodified packages keep verified upstream builds.