GitLab

In makexpi.sh, https-everywhere does:

# Used for figuring out which branch to pull from when viewing source for rules
GIT_OBJECT_FILE=".git/refs/heads/master"
export GIT_COMMIT_ID="HEAD"
if [ -e "$GIT_OBJECT_FILE" ]; then
    export GIT_COMMIT_ID=$(cat "$GIT_OBJECT_FILE")
fi

Unfortunately, this process extracts whatever master is pointing at, regarless of the release you are building.

merge-rulesets.py then reads in the env var $GIT_COMMIT_ID to shove it into the resulting default.rulesets file.

This makes reproducible builds difficult, because that random 'master' commit hash ends up in the ruleset file in the resulting xpi, which has obviously no relation to whatever release tag you're building.