<div dir="ltr">It seems like you might run into a lot of trouble with the security hashes because you&#39;re going to need the compile process to be completely determinate down to the last bit.  I imagine this will mean the same version of pretty much the entire tool chain, the same settings on bzip/gzip, etc.  Further, many packages compile in information about their build environment so they can tell you when they were compiled and on what machine.  If you wanted identical hashes, you would have to strip all that information somehow, without having to configure things differently for each package.<br>
It sounds like a great project if you can figure out all the implementation problems, so good luck.<br></div>