FYI we didn't have an issue open on the topic of reproducible builds until now[0]. While it has been discussed internally, we haven't focused on it. We will have to assess the work involved but will put it on our backlog.
I think "reproducible builds" usually refers to being able to build Brave yourself, then creating a hash of the resulting artefact, and that hash being exactly the same as that of the built version Brave distributes itself.
In other words, being able to verify that the source code that is included in the build of Brave that Brave distributes, is the same as the source code we can view publicly.
Mozilla, however, is different, in that all builds are posted to ftp.mozilla.org, in a versioned manner, and kept there for a while, which, at least in theory, makes it easier to verify or analyse the builds.
What is the situation with Brave? Can I download a version released a few months ago? As it is, the browser is not only not really versioned (at least in the binary form), but there's not even a way to disable it from automatically updating itself. Self-modifying code, where the user has no control over the channel under which the modifications are pushed, is inherently insecure from the reproducibility's perspective.
You can get older (and many incremental) builds from https://github.com/brave/brave-browser/tags. Hope this helps! There is desire within the team for reproducible builds, and I'll see to it that these coals are stoked. Our intent is to be as open, transparent, and accountable as we can be. Brave's mentality is "Can't be evil", as opposed to "Don't be evil." Thank you for the feedback!
Those are Git tags; they have nothing to do with reproducible builds, because you're not providing the executable binaries that are the ones being distributed. It's a huge downgrade in terms of reproducibility of builds compared to Firefox. (It works for Google with Google Chrome because they have an entirely different business model where the whole thing is a walled-garden by design.)
Reproducibile builds would mean that anyone could download the code for a specific release and build a binary that is identical to the one you provide - byte for byte. Is that possible?
[0] https://github.com/brave/brave-browser/issues/5830