Include all build environment dependencies in gitian descriptors #4265

I am currently unable to produce a matching 0.9.1 gitian build; I think it is a bug that bitcoin's gitian build does not enforce specific version of packages that are going to affect the deterministic build.

Right now I am doing some scripting experiments to force downgrade to package versions as per the assert files already in repository, once I am finished perhaps I could see how to fit this in existing (or new) gitian-builder features.

I would like to keep this bug open first and foremost to get your feedback but also to be able to close it when we can say that our gitian build contains all the necessary information (including pinned package versions); this may or not may require extra scripts and/or some feature from gitian-build.

See https://gist.github.com/gdm85/d83f6a61b1e21249a558

NOTE: I cannot out of my head imagine the reason for this inconsistency, so far I can only think of linux-libc-dev as a potential culprit and will move on to next step of troubleshooting once I have all packages at same versions

By the way, the URL for Debian 7.4 ISO is broken (https://github.com/bitcoin/bitcoin/blob/master/doc/gitian-building.md)

It could be instead: http://ftp.at.debian.org/debian-jigdo/current/amd64/iso-cd/debian-7.4.0-amd64-netinst.iso

Although the torrent file is the probably the best way to retrieve these old releases for deterministically built software

Yes, the 7.4 link is broken. 7.5 should work just as well, though, the outer VM doesn't need to be deterministic.

I am closing this with the provided rationale that the outer VM doesn't need to be deterministic. Will keep this in mind for future experiments.