[Git][reproducible-builds/reproducible-website][master] published as https://reproducible-builds.org/reports/2026-07/

Sun Aug 9 19:12:16 UTC 2026


Chris Lamb pushed to branch master at Reproducible Builds / reproducible-website


Commits:
b57c893f by Chris Lamb at 2026-08-09T12:12:10-07:00
published as https://reproducible-builds.org/reports/2026-07/

- - - - -


1 changed file:

- _reports/2026-07.md


Changes:

=====================================
_reports/2026-07.md
=====================================
@@ -3,7 +3,8 @@ layout: report
 year: "2026"
 month: "07"
 title: "Reproducible Builds in July 2026"
-draft: true
+draft: false
+date: 2026-08-09 19:12:10
 ---
 
 **Welcome to the July 2026 report from the [Reproducible Builds](https://reproducible-builds.org) project!**
@@ -15,13 +16,13 @@ In our reports, we try to outline the most important things that we have been up
 
 If you are interested in contributing to the project, please visit the [*Contribute*]({{ "/contribute/" | relative_url }}) page on our website.
 
-<!--
-
 In this month's report, we cover:
 
-0. FIXME
-
--->
+0. [Tool development](#tool-development)
+0. [Distribution work](#distribution-work)
+0. [Three new scholarly papers](#three-new-scholarly-papers)
+0. [Patches](#patches)
+0. [Misc news](#misc-news)
 
 ---
 
@@ -73,6 +74,33 @@ In addition, there is [a new page showing verification rebuilds](https://rebuild
 
 <br>
 
+
+### Three new scholarly papers
+
+[![]({{ "/images/reports/2026-07/paper-vcaligner.png#right" | relative_url }})](https://ieeexplore.ieee.org/abstract/document/11593337)
+
+Yan Li, Nan Jiang, Qihang Zhou, Shaowen Xu, Yamin Xie and Xiaoqi Jia of the [Chinese Academy of Sciences](https://english.cas.cn/) published a paper titled [*VCAligner: Aligning Source Distribution Versions with Upstream Git Commits to Secure Supply Chain*](https://ieeexplore.ieee.org/abstract/document/11593337):
+
+> We present VCAligner, a content-based alignment methodology that constructs inverted indexes over VCS histories to precisely map released artifacts to their originating commits, independent of fragile version tags. We evaluated VCAligner on a dataset of 2,984 verifiable PyPI packages derived from the 4,000 most-downloaded projects linked to public GitHub upstreams. **Our results reveal a critical weakness in conventional tag-based heuristics: while they appear effective on 85% of the dataset, the residual 15% failure rate generates a catastrophic downstream audit workload of over 10.3 million commits. In contrast, VCAligner reduces this burden by two orders of magnitude (≈ 158×), bounding the total workload to under 65,000 commits.** Furthermore, we provide the large-scale characterization of "Packaging Noise," classifying artifact divergence into structural additions (Path Phantoms) and content mutations (Blob Phantoms), thereby isolating the distinct attack surfaces of malicious injection and code tampering.
+
+<br>
+
+[![]({{ "/images/reports/2026-07/paper-snakeoil.png#right" | relative_url }})](https://doi.org/10.48550/ARXIV.2607.21888)
+
+Jens Dietrich and Spencer Sun from the [Victoria University of Wellington](https://www.wgtn.ac.nz/) together with Tim W. White and Behnaz Hassanshahi from [Oracle Inc](https://www.oracle.com) pre-published their paper [*No Snake Oil: Verifying Python Package Builds*](https://arxiv.org/pdf/2607.21888) (PDF):
+
+> Python has become the default language for interacting with AI, with packages being distributed through registries like the Python Package Index (PyPI). This creates a need to analyse supply chains comprising such packages. One such analysis is to rebuild packages in order to identify compromised builds injecting malware. Independent rebuilds in hardened environments have the added advantage that they can generate and record provenance in order to increase the trustworthiness of packages. Two tools that are designed to automate such rebuilds and run them at scale are macaron and oss-rebuild. We study 12,180 popular releases from PyPI and find that the byte-for-byte equivalence rate is generally low. We analyse the reasons why they produce different wheels, and find that equivalence between the original and rebuilt wheels can often still be established, preserving most of the guarantees users expect from rebuildable releases. We present and evaluate daleq4py, a tool to establish the equivalence of Python wheels through the kernel of a normalisation function that is based on provenance-preserving datalog rules. Experimental results show that daleq4py substantially expands the set of rebuilds that can be accepted as equivalent. **Although only 15.4% of macaron rebuilds and 19.1% of oss-rebuild rebuilds are byte-for-byte identical to the published PyPI wheels, daleq4py establishes wheel equivalence for 60.2% and 78.9% of source-equivalent rebuilds, respectively.**
+
+<br>
+
+[![]({{ "/images/reports/2026-07/paper-fdroid.png#right" | relative_url }})](https://arxiv.org/abs/2607.01890)
+
+Denise Nanni, Julien Malka, Stefano Zacchiroli and Théo Zimmermann from [Télécom Paris](https://www.telecom-paris.fr/en/home) together with Gabriele D'Angelo from the [University of Bologna](https://www.unibo.it/en/homepage) pre-published their paper [*Understanding Build Reproducibility in the F-Droid Ecosystem*](https://arxiv.org/pdf/2607.01890) (PDF), which was accepted at the [2026 ACM Conference on Reproducibility and Replicability](https://acm-rep.github.io/2026/accepted/):
+
+> The security of open source applications benefits considerably from the possibility of rebuilding their source and verifying the output. F-Droid, a prominent distribution for open source Android applications, systematically rebuilds them from source and tests their bitwise reproducibility at app publishing time. However, F-Droid offers no guarantee that app reproducibility will continue to hold in the future. As software ecosystems evolve, reproducibility may degrade, with potential negative consequences for software preservation and security. We present the first empirical study of build reproducibility in the F-Droid app ecosystem. Analyzing historical reproducibility logs, we find that the overall bitwise reproducibility rate has been steadily increasing over time (as new versions of apps are published). We then evaluate how reproducibility holds in time for fixed app versions, by attempting to rebuild 18 904 app versions that F-Droid had previously confirmed bitwise reproducible, published between September 2018 and February 2026, **achieving an 83% rebuild success rate, and identify missing dependencies as the dominant cause of failure, accounting for 76% of non-rebuildable cases. Among successfully rebuilt apps, 94% are also bitwise reproducible**-i.e., they still yield bitwise identical artifacts upon rebuild. Together, these results show that while bitwise reproducibility largely holds for apps that can be rebuilt, rebuildability itself is highly sensitive to temporal decay.
+
+<br>
+
 ### Patches
 
 The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where applicable or possible. This month, we wrote a large number of such patches, including:
@@ -134,30 +162,6 @@ The Reproducible Builds project detects, dissects and attempts to fix as many cu
 
 <br>
 
-### Three new scholarly papers
-
-[![]({{ "/images/reports/2026-07/paper-vcaligner.png#right" | relative_url }})](https://ieeexplore.ieee.org/abstract/document/11593337)
-
-Yan Li, Nan Jiang, Qihang Zhou, Shaowen Xu, Yamin Xie and Xiaoqi Jia of the [Chinese Academy of Sciences](https://english.cas.cn/) published a paper titled [*VCAligner: Aligning Source Distribution Versions with Upstream Git Commits to Secure Supply Chain*](https://ieeexplore.ieee.org/abstract/document/11593337):
-
-> We present VCAligner, a content-based alignment methodology that constructs inverted indexes over VCS histories to precisely map released artifacts to their originating commits, independent of fragile version tags. We evaluated VCAligner on a dataset of 2,984 verifiable PyPI packages derived from the 4,000 most-downloaded projects linked to public GitHub upstreams. **Our results reveal a critical weakness in conventional tag-based heuristics: while they appear effective on 85% of the dataset, the residual 15% failure rate generates a catastrophic downstream audit workload of over 10.3 million commits. In contrast, VCAligner reduces this burden by two orders of magnitude (≈ 158×), bounding the total workload to under 65,000 commits.** Furthermore, we provide the large-scale characterization of "Packaging Noise," classifying artifact divergence into structural additions (Path Phantoms) and content mutations (Blob Phantoms), thereby isolating the distinct attack surfaces of malicious injection and code tampering.
-
-<br>
-
-[![]({{ "/images/reports/2026-07/paper-snakeoil.png#right" | relative_url }})](https://doi.org/10.48550/ARXIV.2607.21888)
-
-Jens Dietrich and Spencer Sun from the [Victoria University of Wellington](https://www.wgtn.ac.nz/) together with Tim W. White and Behnaz Hassanshahi from [Oracle Inc](https://www.oracle.com) pre-published their paper [*No Snake Oil: Verifying Python Package Builds*](https://arxiv.org/pdf/2607.21888) (PDF):
-
-> Python has become the default language for interacting with AI, with packages being distributed through registries like the Python Package Index (PyPI). This creates a need to analyse supply chains comprising such packages. One such analysis is to rebuild packages in order to identify compromised builds injecting malware. Independent rebuilds in hardened environments have the added advantage that they can generate and record provenance in order to increase the trustworthiness of packages. Two tools that are designed to automate such rebuilds and run them at scale are macaron and oss-rebuild. We study 12,180 popular releases from PyPI and find that the byte-for-byte equivalence rate is generally low. We analyse the reasons why they produce different wheels, and find that equivalence between the original and rebuilt wheels can often still be established, preserving most of the guarantees users expect from rebuildable releases. We present and evaluate daleq4py, a tool to establish the equivalence of Python wheels through the kernel of a normalisation function that is based on provenance-preserving datalog rules. Experimental results show that daleq4py substantially expands the set of rebuilds that can be accepted as equivalent. **Although only 15.4% of macaron rebuilds and 19.1% of oss-rebuild rebuilds are byte-for-byte identical to the published PyPI wheels, daleq4py establishes wheel equivalence for 60.2% and 78.9% of source-equivalent rebuilds, respectively.**
-
-<br>
-
-[![]({{ "/images/reports/2026-07/paper-fdroid.png#right" | relative_url }})](https://arxiv.org/abs/2607.01890)
-
-Denise Nanni, Julien Malka, Stefano Zacchiroli and Théo Zimmermann from [Télécom Paris](https://www.telecom-paris.fr/en/home) together with Gabriele D'Angelo from the [University of Bologna](https://www.unibo.it/en/homepage) pre-published their paper [*Understanding Build Reproducibility in the F-Droid Ecosystem*](https://arxiv.org/pdf/2607.01890) (PDF), which was accepted at the [2026 ACM Conference on Reproducibility and Replicability](https://acm-rep.github.io/2026/accepted/):
-
-> The security of open source applications benefits considerably from the possibility of rebuilding their source and verifying the output. F-Droid, a prominent distribution for open source Android applications, systematically rebuilds them from source and tests their bitwise reproducibility at app publishing time. However, F-Droid offers no guarantee that app reproducibility will continue to hold in the future. As software ecosystems evolve, reproducibility may degrade, with potential negative consequences for software preservation and security. We present the first empirical study of build reproducibility in the F-Droid app ecosystem. Analyzing historical reproducibility logs, we find that the overall bitwise reproducibility rate has been steadily increasing over time (as new versions of apps are published). We then evaluate how reproducibility holds in time for fixed app versions, by attempting to rebuild 18 904 app versions that F-Droid had previously confirmed bitwise reproducible, published between September 2018 and February 2026, **achieving an 83% rebuild success rate, and identify missing dependencies as the dominant cause of failure, accounting for 76% of non-rebuildable cases. Among successfully rebuilt apps, 94% are also bitwise reproducible**-i.e., they still yield bitwise identical artifacts upon rebuild. Together, these results show that while bitwise reproducibility largely holds for apps that can be rebuilt, rebuildability itself is highly sensitive to temporal decay.
-
 ### Misc news
 
 On [our mailing list](https://lists.reproducible-builds.org/listinfo/rb-general/) this month, Colin Winter of [Markovian Protocol](https://markovianprotocol.com/) wrote to our mailing list on the topic of [*Reproducible verification for retained logs*](https://lists.reproducible-builds.org/pipermail/rb-general/2026-July/004133.html):



View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/b57c893f52f92057fc903f68671a9282a49f6840

-- 
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/b57c893f52f92057fc903f68671a9282a49f6840
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-commits/attachments/20260809/b0b7b42e/attachment.htm>
