.build-manifest discrepancies

Originally created by @CyrilBrulebois on #17353 (Redmine)

Seen with 4.1.1.

I’m not sure why building from a tag results in different contents in .build-manifest files.

Due to delays documented elsewhere, the build in Jenkins started after the security snapshot was updated, resulting in this diff between the Jenkins build and my official/local one:

kibi@armor:~/work/clients/tails/release/artifacts$ diff -u jenkins/tails-amd64-4.1.1.build-manifest tails-amd64-4.1.1.build-manifest 
--- jenkins/tails-amd64-4.1.1.build-manifest    2019-12-16 02:07:07.101295056 +0100
+++ tails-amd64-4.1.1.build-manifest    2019-12-16 01:18:03.631713792 +0100
@@ -3,7 +3,7 @@
   debian:
     reference: '2019111801'
   debian-security:
-    reference: '2019121504'
+    reference: '2019121503'
   torproject:
     reference: '2019100904'
 packages:

We’re building from a tag, there’s no reason to have irrelevant references pop up in the build results?

Related issues

• Related to #17361 (closed)