repro_build_env_declared and repro_deps_pinned overlook native C/C++ build systems and toolchains

[Jaydeep869]

Description

For projects containing C or C++ source code, repro_build_env_declared and repro_deps_pinned only look for container/script files and high-level package locks (npm, Python, Cargo). They completely ignore native build declarations (Makefile, CMakeLists.txt, CMakePresets.json) and native dependency manifests (Conan, vcpkg).

What We Did

1. Audited a repository containing C code built via Makefile with toolchain variables (CC = gcc-13).
2. Ran darnit audit . --framework reproducibility --show-all.

What It Was Supposed To Do

When C/C++ files are present, the tool should check for C/C++ toolchain declarations and native dependency manifests, or tailor the verification guidance towards compiler version pinning and shared library ABI stability.

What We Got

Both controls returned INCONCLUSIVE (WARN), directing the user only to check for Dockerfiles, Nix files, or language lockfiles like Cargo.lock or uv.lock.

Proposed Enhancement

1. When native code (.c, .cpp, .h) is detected in project context:
   • Check for CMake toolchain presets (CMakePresets.json) or compiler definitions in Makefiles.
   • Check for C/C++ dependency managers (conan.lock, vcpkg.json).
2. Provide verification steps relevant to native code (pinning system toolchain and libc versions).

Reference report: https://github.com/Jaydeep869/darnit/blob/reproducibility-evaluation/reports/experiment_2_c_ctypes.md#bug-report-5-repro_build_env_declared-ignores-makefiles-toolchain-files-and-native-cc-compiler-definitions