repro_hermetic_build ignores compiler invocations and non-deterministic compiler flags (-ffast-math) in Makefiles

[Jaydeep869]

Description

repro_hermetic_build scans Makefiles only for network download keywords. It completely ignores compiler commands (gcc, clang) and unsafe optimization flags (like -ffast-math or -Ofast) that break IEEE 754 floating-point associativity and create divergent binary output.

What We Did

1. Created a C library compiled via Makefile with -O3 -ffast-math:

   all:
       gcc -O3 -ffast-math -fPIC -shared sum.c -o libsum.so

2. Ran darnit audit . --framework reproducibility --show-all.

What It Was Supposed To Do

The check should recognize that C compilation is taking place and flag non-deterministic or non-associative flags like -ffast-math or machine-specific flags like -march=native.

What We Got

The check passed its pattern scan:

"No suspicious patterns found in 1 scanned file(s)"

Neither gcc, -ffast-math, nor native compilation appeared anywhere in the audit output or evidence.

Proposed Fix

Add a check for unsafe compiler flags in build files:

• -ffast-math, -Ofast, -fassociative-math
• -march=native, -mtune=native
  If found, warn the user that these flags break IEEE 754 compliance and binary portability.

Reference report: https://github.com/Jaydeep869/darnit/blob/reproducibility-evaluation/reports/experiment_2_c_ctypes.md#bug-report-4-repro_hermetic_build-ignores-compiler-invocations-and-non-deterministic-compiler-flags-in-makefiles-and-build-scripts