[Git][reproducible-builds/reproducible-website][master] 2 commits: 2026-01: Misc changes prior to publication.

Fri Feb 6 20:04:41 UTC 2026


Chris Lamb pushed to branch master at Reproducible Builds / reproducible-website


Commits:
45b0087d by Chris Lamb at 2026-02-06T12:03:37-08:00
2026-01: Misc changes prior to publication.

- - - - -
4fce4960 by Chris Lamb at 2026-02-06T12:04:31-08:00
published as https://reproducible-builds.org/reports/2026-01/

- - - - -


3 changed files:

- _reports/2026-01.md
- + images/reports/2026-01/conda-forge.png
- + images/reports/2026-01/nixos.png


Changes:

=====================================
_reports/2026-01.md
=====================================
@@ -3,7 +3,8 @@ layout: report
 year: "2026"
 month: "01"
 title: "Reproducible Builds in January 2026"
-draft: true
+draft: false
+date: 2026-02-06 20:04:31
 ---
 
 **Welcome to the first monthly report in 2026 from the [Reproducible Builds](https://reproducible-builds.org) project!**
@@ -13,11 +14,18 @@ draft: true
 
 These reports outline what we've been up to over the past month, highlighting items of news from elsewhere in the increasingly-important area of software supply-chain security. As ever, if you are interested in contributing to the Reproducible Builds project, please see the [*Contribute*]({{ "/contribute/" | relative_url }}) page on our website.
 
+0. [Flathub now testing for reproducibility](#flathub-now-testing-for-reproducibility)
+0. [Reproducibility identifying projects that will fail to build in 2038](#reproducibility-identifying-software-projects-that-will-fail-to-build-in-2038)
+0. [Distribution work](#distribution-work)
+0. [Tool development](#tool-development)
+0. [Two new academic papers](#two-new-academic-papers)
+0. [Upstream patches](#upstream-patches)
+
 ---
 
 ### Flathub now testing for reproducibility
 
-[![]({{ "/images/reports/2026-01/flathub.png#right" | relative_url }})](https://www.opensuse.org/)
+[![]({{ "/images/reports/2026-01/flathub.png#right" | relative_url }})](https://flathub.org/)
 
 [Flathub](https://flathub.org/), the primary repository/app store for [Flatpak](https://flatpak.org/)-based applications, has begun checking for build reproducibility. [According to a recent blog post](https://docs.flathub.org/blog/vorarbeiter-2026):
 
@@ -27,7 +35,7 @@ The test results and status is available on their [reproducible builds page](htt
 
 <br>
 
-### Reproducibility identifying countless software that will fail to build in 2038
+### Reproducibility identifying software projects that will fail to build in 2038
 
 Longtime Reproducible Builds developer Bernhard M. Wiedemann [posted on Reddit on "Y2K38 commemoration day T-12"](https://www.reddit.com/r/linux/comments/1qfw17a/today_is_y2k38_commemoration_day_t12/) — that is to say, twelve years to the day before the UNIX Epoch will no longer fit into a signed 32-bit integer variable on 19th January 2038.
 
@@ -39,6 +47,14 @@ At the time of publication, Bernard's topic had generated [50 comments in respon
 
 ### Distribution work
 
+[![]({{ "/images/reports/2026-01/conda-forge.png#right" | relative_url }})](https://conda-forge.org/)
+
+[**Conda**](https://conda.org/) is language-agnostic package manager which was originally developed to help Python data scientists and is now a popular package manager for Python and R.
+
+[*conda-forge*](https://conda-forge.org/), a community-led infrastructure for Conda recently revamped their [dashboards to rebuild packages straight to track reproducibility](https://prefix-dev.github.io/reproducible-builds/v1.html). There have been changes over the past two years to make the *conda-forge* build tooling fully reproducible by embedding the 'lockfile' of the entire build environment inside the packages.
+
+<br>
+
 [![]({{ "/images/reports/2026-01/debian.png#right" | relative_url }})](https://debian.org/)
 
 In **Debian** this month:
@@ -55,6 +71,12 @@ In **Debian** this month:
 
 <br>
 
+[![]({{ "/images/reports/2026-01/nixos.png#right" | relative_url }})](https://reproducible.nixos.org/)
+
+In **NixOS** this month, it was [announced](https://todon.nl/@nzbr@chaos.social/115973847890479025) that the [GNU Guix Full Source Bootstrap](https://guix.gnu.org/blog/2023/the-full-source-bootstrap-building-from-source-all-the-way-down/) was [ported to NixOS](https://github.com/nzbr/nixos-full-source-bootstrap) as part of [Wire Jansen bachelor's thesis](https://chaos.social/@nzbr/115973847897716839) ([PDF](https://nzbr.github.io/nixos-full-source-bootstrap/thesis.pdf)). At the time of publication, this [change has landed](https://github.com/NixOS/nixpkgs/pull/479322) in NiX' [`stdev`](https://nixos.org/guides/nix-pills/19-fundamentals-of-stdenv.html) distribution.
+
+<br>
+
 [![]({{ "/images/reports/2026-01/opensuse.png#right" | relative_url }})](https://www.opensuse.org/)
 
 Lastly, Bernhard M. Wiedemann posted another [**openSUSE**](https://www.opensuse.org/) [monthly update](https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/WGWBPINHEGH4MBKRJHFQJGEX6OZ7VWDU/) for his work there.
@@ -76,7 +98,7 @@ Lastly, Bernhard M. Wiedemann posted another [**openSUSE**](https://www.opensuse
 
 <br>
 
-In addition, Holger Levsen uploaded two versions of **disorderfs**, first updating the package from FUSE 2 to [FUSE 3](https://salsa.debian.org/reproducible-builds/disorderfs/-/merge_requests/8) as described in [last months report]({{ "/reports/2025-12/" | relative_url }}), as well as updating the packaging to the latest Debian standards. A [second upload](https://tracker.debian.org/news/1703912/accepted-disorderfs-062-1-source-into-unstable/) (`0.6.2-1`) was subsequently made, with Holger adding instructions on how to add the upstream release to our release archive and incorporating changes by Roland Clobus to set `_FILE_OFFSET_BITS` on 32-bit platforms, fixing a build failure on 32-bit systems. Vagrant Cascadian updated *diffoscope* in GNU Guix to version [311-2-ge4ec97f7](https://codeberg.org/guix/guix/commit/1718f0349536a83a76d0b4c6760d16ab147e3694) and *disorderfs* to [0.6.2](https://codeberg.org/guix/guix/commit/60a507264d8b0d3b49ea802e5089449109028da4).
+In addition, Holger Levsen uploaded two versions of **disorderfs**, first updating the package from FUSE 2 to [FUSE 3](https://salsa.debian.org/reproducible-builds/disorderfs/-/merge_requests/8) as described in [last months report]({{ "/reports/2025-12/" | relative_url }}), as well as updating the packaging to the latest Debian standards. A [second upload](https://tracker.debian.org/news/1703912/accepted-disorderfs-062-1-source-into-unstable/) (`0.6.2-1`) was subsequently made, with Holger adding instructions on how to add the upstream release to our release archive and incorporating changes by Roland Clobus to set `_FILE_OFFSET_BITS` on 32-bit platforms, fixing a build failure on 32-bit systems. Vagrant Cascadian updated *diffoscope* in GNU Guix to version [`311-2-ge4ec97f7`](https://codeberg.org/guix/guix/commit/1718f0349536a83a76d0b4c6760d16ab147e3694) and *disorderfs* to [`0.6.2`](https://codeberg.org/guix/guix/commit/60a507264d8b0d3b49ea802e5089449109028da4).
 
 
 <br>


=====================================
images/reports/2026-01/conda-forge.png
=====================================
Binary files /dev/null and b/images/reports/2026-01/conda-forge.png differ


=====================================
images/reports/2026-01/nixos.png
=====================================
Binary files /dev/null and b/images/reports/2026-01/nixos.png differ



View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/compare/d41f6db537a5fdccf91fe2b67543b842e4198241...4fce4960ec221a8707de296e3f40452b9abd008e

-- 
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/compare/d41f6db537a5fdccf91fe2b67543b842e4198241...4fce4960ec221a8707de296e3f40452b9abd008e
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-commits/attachments/20260206/e5f25029/attachment.htm>
