Deterministic builds

To ensure integrity against build machine compromise, we should be able to produce identical binaries on two different identically configured machines and verify that hash is the same for each. Right now, this is not possible, primarily because of two things:

1. gcc uses entropy for symbol mangling
2. The linker inserts timestamps into libraries, especially static ones.

Issue 1 can be solved by giving gcc a specific seed in our makefiles (-frandom-seed=string). If we have no collisions, we can get away with giving the same seed to every gcc invocation.

Issue 2 can be solved for static libraries by passing the -D option to 'ar'. It is unclear if shared libraries can be produced in this way, or if this option is not needed for shared libraries.

On Windows, the problem remains entirely unsolved: http://stackoverflow.com/questions/1180852/deterministic-builds-under-windows

However, if we can do this for Linux and Mac OS using the same build flags, that would still be worth it.