https://reproducible-builds.org/ (see mailing list)
Reproducible builds are a set of software development practices that create a verifiable path from human readable source code to the binary code used by computers

How?

First, the build system needs to be made entirely deterministic: transforming a given source must always create the same result. Typically, the current date and time must not be recorded and output always has to be written in the same order.

Second, the set of tools used to perform the build and more generally the build environment should either be recorded or pre-defined.

Third, users should be given a way to recreate a close enough build environment, perform the build process, and verify that the output matches the original build.

...

But Maven plugins in the whole ecosystem (not only provided by Apache Maven team) sometimes adds some variable parts that adds to the problem: timestamp text or username in MANIFEST.MF, ...

reproducible-build-maven-plugin has been created to try to fix issues after packaging.

...

What are the issues to solve?

Debian approach

Debian has a strong reproducible builds structure working on the topic for a few years: see BuildinfoFiles for environment info recording.

...