Hello Ludo,

Sorry for long answer. I have no chance to continue ivestigation last
month, but I'll want to provide my old finding:

1. Rust 1.25 build cargo binary (but not rustc itself) in
non-reproducible manner when compiled with llvm-6.0 and llvm-6.1. In
both cases we got non-reproducible code for next functions:
"<env_logger::Logger as log::Log>::log", "git2::panic::check",
"curl::easy::handler::ssl_ctx_cb".
2. Rust 1.26 with llvm-6.0 build is reproducible regardless of which
rustc 1.25 (with llvm-6.0 or llvm-3.9) was used to bootstrap it.
3. Rust 1.27.0 and Rust 1.27.2 again build rustc itself in reproducible
manner, while "cargo" binary differ build to build. I observed
non-reproducible code in "git2::panic::check" function and in
".gcc_except_table" section of resulting binary.

In attachements you can find patch to move rust-1.25 to llvm-3.9, and
patch to update Rust 1.27 to 1.27.2.