Currently the MediaWiki release tarballs are generated by an individual person on their local workstation and then directly uploaded to releases.wikimedia.org for public usage. Having that process be bit-for-bit reproducible would allow setting up automated tests to ensure that those tarballs match what we expect them to match.

I ran diffoscope to compare the "official" 1.43.1 tarball and one I generated with makerelease2.py locally. The diff is here: https://people.wikimedia.org/~taavi/misc/diffoscope-mw-1.43-1/

Seemingly the main issue is that files include local usernames and file modification timestamps. I think we could for example use the date of the Git tag as a consistent timestamp?