[Git][reproducible-builds/reproducible-website][master] 2026-07: Initial draft
Chris Lamb (@lamby)
gitlab at salsa.debian.org
Thu Aug 6 21:09:54 UTC 2026
Chris Lamb pushed to branch master at Reproducible Builds / reproducible-website
Commits:
af7009c0 by Chris Lamb at 2026-08-06T14:09:48-07:00
2026-07: Initial draft
- - - - -
7 changed files:
- _reports/2026-07.md
- + images/reports/2026-07/debian.png
- + images/reports/2026-07/diffoscope.png
- + images/reports/2026-07/openwrt-rebuilderd.png
- + images/reports/2026-07/openwrt.png
- + images/reports/2026-07/reproducible-builds.png
- + images/reports/2026-07/website.png
Changes:
=====================================
_reports/2026-07.md
=====================================
@@ -6,25 +6,143 @@ title: "Reproducible Builds in July 2026"
draft: true
---
-* [FIXME, more progress](https://rebuilderd.n.aparcar.org/?distro=openwrt-image)
+**Welcome to the June 2026 report from the [Reproducible Builds](https://reproducible-builds.org) project!**
+{: .lead}
-* [disorderfs 0.7.0](https://build.opensuse.org/request/show/1368149)
+[![]({{ "/images/reports/2026-06/reproducible-builds.png#right" | relative_url }})](https://reproducible-builds.org/)
+
+In our reports, we try to outline the most important things that we have been up to over the past month. As a quick recap about what problem our project intends to solve, whilst anyone may inspect the source code of free software for malicious flaws, almost all software is distributed to end users as pre-compiled binaries. The motivation behind the reproducible builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised or not.
+
+If you are interested in contributing to the project, please visit the [*Contribute*]({{ "/contribute/" | relative_url }}) page on our website.
+
+<!--
+
+In this month's report, we cover:
+
+0. FIXME
+
+-->
+
+---
+
+### Tool development
+
+[![]({{ "/images/reports/2026-07/diffoscope.png#right" | relative_url }})](https://diffoscope.org/)
+
+[**diffoscope**](https://diffoscope.org) is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb made the following changes, including preparing and uploading versions `324`, `325` and `326` to Debian:
+
+* Fix tests to work with `zipdetails` 4.0008. ([#1141359](https://bugs.debian.org/1141359))
+* Bump debhelper compatibility level to 13. [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/474f3702)]
+* Update copyright years. [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/4cde19a5)]
+
+In addition, Paul Spooren made changes to allow trailing garbage in Gzip files [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/c8dcbf4a)] and Vagrant Cascadian added an external tool reference for the `pedump` binary to use the `mono` package under [GNU Guix](https://guix.gnu.org/). [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/b79afa9e)]
+
+<br>
+
+[**disorderfs**](https://tracker.debian.org/pkg/disorderfs) is our [FUSE](https://en.wikipedia.org/wiki/Filesystem_in_Userspace)-based filesystem that deliberately introduces non-determinism into system calls to reliably flush out reproducibility issues. This month, Christelle Gloor added the option to sort by `ctime` as returned by the `lstat(2)` [syscall](https://en.wikipedia.org/wiki/System_call). [[…](https://salsa.debian.org/reproducible-builds/disorderfs/commit/68d20f7)], which Chris Lamb uploaded whilst bumping the `Standards-Version` to version 4.7.4 [[…](https://salsa.debian.org/reproducible-builds/disorderfs/commit/240fae0)]. Bernhard Wiedemann also [updated *disorderfs* to version 0.7.0](https://build.opensuse.org/request/show/1368149) in [openSUSE](https://www.opensuse.org/).
+
+<br>
+
+[![]({{ "/images/reports/2026-06/website.png#right" | relative_url }})]({{ "/" | relative_url }})
+
+Yet again, there were a number of improvements made to [**our website**]({{ "/" | relative_url }}) this month as well. For example, Chris Lamb, by request of [Digital Ocean](https://www.digitalocean.com/), changed the target of a referral link so that they can manage incoming referrers [[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/4ac1b2fa)] and pushed a number of changes to the [*Tools*](https://reproducible-builds.org/tools/) page [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/3e3154f2)].
+
+<br>
+
+### Distribution work
+
+[![]({{ "/images/reports/2026-07/debian.png#right" | relative_url }})](https://debian.org/)
+
+In **Debian** this month, 32 reviews of Debian packages were added, 26 were updated and a total of 21 were removed this month, adding to [our extensive knowledge about identified issues](https://tests.reproducible-builds.org/debian/index_issues.html).
+
+A number of issue types were added by Chris Lamb, including:
+
+* `python_towncrier_build_date` [[…](https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/83a0efd3)][[…](https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/6f036b2a)]
+* `log_files_installed_in_package` [[…](https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/c629afdf)]
+* `fontforge_varies_by_timezone` [[…](https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/d76c0f05)][[…](https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/fc4a9fc5)]
+
+Chris also added a further note for the `build_date_in_manpage_generated_by_spf13_cobra` issue. [[…](https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/f7b69082)]
+
+<br>
+
+[![]({{ "/images/reports/2026-07/openwrt.png#right" | relative_url }})](https://openwrt.org/)
+
+In addition, there is [a new page showing verification rebuilds](https://rebuilderd.n.aparcar.org/?distro=openwrt-image) of [OpenWrt](https://openwrt.org/) APK packages and firmware images, powered by [*rebuilderd*](https://github.com/kpcyrd/rebuilderd):
+
+[![]({{ "/images/reports/2026-07/openwrt-rebuilderd.png#center" | relative_url }})](https://rebuilderd.n.aparcar.org/?distro=openwrt-image)
+
+<br>
+
+### Patches
+
+The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where applicable or possible. This month, we wrote a large number of such patches, including:
* [openSUSE monthly](https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/JLAOJP7W6K3P2SL6XT6UYX444XZ5WQPN/)
* Bernhard M. Wiedemann:
- * [`angelfish`](https://build.opensuse.org/request/show/1364030) (rcc race, parallelism)
- * [`zathura*`](https://build.opensuse.org/request/show/1364231) (nocheck)
- * [`python-langsmith`](https://build.opensuse.org/request/show/1364286) (nocheck)
- * [`efl`](https://git.enlightenment.org/enlightenment/efl/pulls/133) (race)
- * [`intel-graphics-compiler`](https://github.com/intel/intel-graphics-compiler/pull/418) (ASLR)
- * [`mono-core`](https://gitlab.winehq.org/mono/mono/-/work_items/33) (various)
- * [`java-21-openjdk`](https://bugzilla.opensuse.org/show_bug.cgi?id=1221224) (CPU core count)
- * [`java-17-openjdk`](https://build.opensuse.org/request/show/1368181) (various backports)
- * [`java-11-openjdk`](https://build.opensuse.org/request/show/1368181) (various backports)
- * [`java-1_8_0-openjdk`](https://build.opensuse.org/request/show/1368504) (various backports+fixes)
- * [`erlang+ex_doc`](https://github.com/erlang/otp/issues/4417#issuecomment-5105267295) (various fixes)
+
+ * [`angelfish`](https://build.opensuse.org/request/show/1364030)
+ * [`cpython`](https://github.com/python/cpython/pull/154988)
+ * [`efl`](https://git.enlightenment.org/enlightenment/efl/pulls/133)
+ * [`erlang+ex_doc`](https://github.com/erlang/otp/issues/4417#issuecomment-5105267295)
+ * [`eww/glib-macros`](https://build.opensuse.org/request/show/1368578)
+ * [`intel-graphics-compiler`](https://github.com/intel/intel-graphics-compiler/pull/418)
+ * [`java-11-openjdk`](https://build.opensuse.org/request/show/1368181)
+ * [`java-17-openjdk`](https://build.opensuse.org/request/show/1368181)
+ * [`java-1_8_0-openjdk`](https://build.opensuse.org/request/show/1368504)
+ * [`java-21-openjdk`](https://bugzilla.opensuse.org/show_bug.cgi?id=1221224)
+ * [`mono-core`](https://gitlab.winehq.org/mono/mono/-/work_items/33)
+ * [`nasm/rav1e`](https://github.com/medek/nasm-rs/pull/47)
+ * [`python-langsmith`](https://build.opensuse.org/request/show/1364286)
+ * [`zathura*`](https://build.opensuse.org/request/show/1364231)
* [`zig0.15`](https://build.opensuse.org/request/show/1368243)
- * [`eww/glib-macros`](https://build.opensuse.org/request/show/1368578) (toolchain)
- * [`nasm/rav1e`](https://github.com/medek/nasm-rs/pull/47) (toolchain)
- * [`cpython`](https://github.com/python/cpython/pull/154988) (python313 backport)
+
+* Chris Lamb:
+
+ * [#1141505](https://bugs.debian.org/1141505) filed against [`golang-github-tidwall-wal`](https://tracker.debian.org/pkg/golang-github-tidwall-wal).
+ * [#1141506](https://bugs.debian.org/1141506) filed against [`lightproof`](https://tracker.debian.org/pkg/lightproof).
+ * [#1141582](https://bugs.debian.org/1141582) filed against [`libslow5lib`](https://tracker.debian.org/pkg/libslow5lib).
+ * [#1141687](https://bugs.debian.org/1141687) filed against [`siso`](https://tracker.debian.org/pkg/siso).
+ * [#1141841](https://bugs.debian.org/1141841) filed against [`grout`](https://tracker.debian.org/pkg/grout).
+ * [#1142126](https://bugs.debian.org/1142126) filed against [`libpsl`](https://tracker.debian.org/pkg/libpsl).
+ * [#1142492](https://bugs.debian.org/1142492) filed against [`node-grunt-contrib-internal`](https://tracker.debian.org/pkg/node-grunt-contrib-internal).
+ * [#1142495](https://bugs.debian.org/1142495) filed against [`fontforge`](https://tracker.debian.org/pkg/fontforge).
+ * [#1142496](https://bugs.debian.org/1142496) filed against [`spopt`](https://tracker.debian.org/pkg/spopt).
+ * [#1142887](https://bugs.debian.org/1142887) filed against [`go-dlib`](https://tracker.debian.org/pkg/go-dlib).
+ * [#1143147](https://bugs.debian.org/1143147) filed against [`towncrier`](https://tracker.debian.org/pkg/towncrier).
+
+* Jochen Sprickerhof:
+
+ * [#1141412](https://bugs.debian.org/1141412) filed against [`python-sphinx-chango`](https://tracker.debian.org/pkg/python-sphinx-chango).
+ * [#1141553](https://bugs.debian.org/1141553) filed against [`gasnet`](https://tracker.debian.org/pkg/gasnet).
+ * [#1141577](https://bugs.debian.org/1141577) filed against [`yubihsm-connector`](https://tracker.debian.org/pkg/yubihsm-connector).
+ * [#1141663](https://bugs.debian.org/1141663) filed against [`dh-fortran`](https://tracker.debian.org/pkg/dh-fortran).
+ * [#1142000](https://bugs.debian.org/1142000) filed against [`watcher`](https://tracker.debian.org/pkg/watcher).
+ * [#1142001](https://bugs.debian.org/1142001) filed against [`rakudo`](https://tracker.debian.org/pkg/rakudo).
+ * [#1142128](https://bugs.debian.org/1142128) filed against [`kf6-breeze-icons`](https://tracker.debian.org/pkg/kf6-breeze-icons).
+ * [#1142141](https://bugs.debian.org/1142141) filed against [`oxygen-icons`](https://tracker.debian.org/pkg/oxygen-icons).
+ * [#1142256](https://bugs.debian.org/1142256) filed against [`gnu-apl`](https://tracker.debian.org/pkg/gnu-apl).
+ * [#1142513](https://bugs.debian.org/1142513) filed against [`barvinok`](https://tracker.debian.org/pkg/barvinok).
+ * [#1143169](https://bugs.debian.org/1143169) filed against [`ecbuild`](https://tracker.debian.org/pkg/ecbuild).
+
+<br>
+
+### Misc news
+
+On [our mailing list](https://lists.reproducible-builds.org/listinfo/rb-general/) this month, Colin Winter of [Markovian Protocol](https://markovianprotocol.com/) wrote to our mailing list on the topic of [*Reproducible verification for retained logs*](https://lists.reproducible-builds.org/pipermail/rb-general/2026-July/004133.html):
+
+> Reproducible builds remove trust in the builder: anyone re-derives the same artifact from the same source, byte for byte. The same shape applies one layer over, to a retained record. Most record-keeping regimes (the [EU AI Act's Article 12](https://artificialintelligenceact.eu/article/12/) logging is the current example) require that events be recorded and logs retained, but not that a retained log be verifiable, by a party who was not present, as unaltered and existing when claimed. That leaves an integrity obligation resting on trusting the party being audited.
+
+([Full thread](https://lists.reproducible-builds.org/pipermail/rb-general/2026-July/thread.html#4133))
+
+<br>
+<br>
+
+Finally, if you are interested in contributing to the Reproducible Builds project, please visit our [*Contribute*](https://reproducible-builds.org/contribute/) page on our website. However, you can get in touch with us via:
+
+ * IRC: `#reproducible-builds` on `irc.oftc.net`.
+
+ * Mastodon: [@reproducible_builds at fosstodon.org](https://fosstodon.org/@reproducible_builds)
+
+ * Mailing list: [`rb-general at lists.reproducible-builds.org`](https://lists.reproducible-builds.org/listinfo/rb-general)
+
=====================================
images/reports/2026-07/debian.png
=====================================
Binary files /dev/null and b/images/reports/2026-07/debian.png differ
=====================================
images/reports/2026-07/diffoscope.png
=====================================
Binary files /dev/null and b/images/reports/2026-07/diffoscope.png differ
=====================================
images/reports/2026-07/openwrt-rebuilderd.png
=====================================
Binary files /dev/null and b/images/reports/2026-07/openwrt-rebuilderd.png differ
=====================================
images/reports/2026-07/openwrt.png
=====================================
Binary files /dev/null and b/images/reports/2026-07/openwrt.png differ
=====================================
images/reports/2026-07/reproducible-builds.png
=====================================
Binary files /dev/null and b/images/reports/2026-07/reproducible-builds.png differ
=====================================
images/reports/2026-07/website.png
=====================================
Binary files /dev/null and b/images/reports/2026-07/website.png differ
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/af7009c0c1b3830b50e05273c56b2613ac93e868
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/af7009c0c1b3830b50e05273c56b2613ac93e868
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-commits/attachments/20260806/68757e02/attachment.htm>
More information about the rb-commits
mailing list