The post itself has a pretty good list of 10 sources of non-determinism:

  1. timestamps
  2. dates/times/authors etc. embedded in source files
  3. timezone sensitive code
  4. directory order/build order
  5. non-sanitized data stored into files
  6. symbolic links/paths
  7. general tool inconsistencies
  8. toolchain
  9. build information / tunables / environment
  10. making sure that the source tree has no local changes

With a bit of info on each.

There's a fairly comprehensive list at https://reproducible-builds.org/docs/. Debian has a detailed list of reproducibility issues and affected packages at https://tests.reproducible-builds.org/debian/index_issues.ht...

Here's a smørbrødliste:

* Non-isolated build environment. This is just asking for all sorts of trouble (users, hostname, network access, etc).

* File system time stamps.

* Recording times in the build process (although even gcc supports SOURCE_DATE_EPOCH since version 7).

* Usage of CPU-specific instructions, e.g. -march=native to GCC.

That's exactly what the article is about.