[Git][reproducible-builds/reproducible-website][master] 3 commits: 2026-09: Initial draft
Chris Lamb (@lamby)
gitlab at salsa.debian.org
Mon Oct 12 19:24:15 UTC 2026
Chris Lamb pushed to branch master at Reproducible Builds / reproducible-website
Commits:
c54a3ca0 by Chris Lamb at 2026-10-12T12:22:57-07:00
2026-09: Initial draft
- - - - -
1e91cc6f by Chris Lamb at 2026-10-12T12:23:05-07:00
Fix a quote in last month's report
- - - - -
119f1c05 by Chris Lamb at 2026-10-12T12:23:35-07:00
Reflect various changes I tend to make in the reports in the template
- - - - -
11 changed files:
- _reports/2026-08.md
- _reports/2026-09.md
- bin/generate-draft.template
- + images/reports/2026-09/debian.png
- + images/reports/2026-09/diffoscope.png
- + images/reports/2026-09/jochen.jpg
- + images/reports/2026-09/opensuse.png
- + images/reports/2026-09/paper-2609.png
- + images/reports/2026-09/rb2026-gothenburg-grouppic-3.jpg
- + images/reports/2026-09/reproducible-builds.png
- + images/reports/2026-09/website.png
Changes:
=====================================
_reports/2026-08.md
=====================================
@@ -61,7 +61,7 @@ Core Python developer, [Brett Cannon](https://snarky.ca/) wrote an interesting b
Brett goes on to outline "What's missing from the specs" and how reproducibility might be visible on PyPI to consumers:
-Assuming all of this comes to pass and we record the where the source code is that went into a distribution and the software used to make the distribution, how do we make it useful to people? Does every person who cares about having a secure supply chain have to rebuild everything they use themselves? Is there some way for even people who don't care about this stuff to benefit? [[…](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/)]
+> Assuming all of this comes to pass and we record the where the source code is that went into a distribution and the software used to make the distribution, how do we make it useful to people? Does every person who cares about having a secure supply chain have to rebuild everything they use themselves? Is there some way for even people who don't care about this stuff to benefit? [[…](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/)]
<br>
=====================================
_reports/2026-09.md
=====================================
@@ -6,43 +6,205 @@ title: "Reproducible Builds in September 2026"
draft: true
---
-* r-b summit
+**Welcome to the September 2026 report from the [Reproducible Builds](https://reproducible-builds.org) project!**
+{: .lead}
-* https://github.com/bmwiedemann/dettrace got major fixes and ports to most architectures supported in Debian or openSUSE (mostly vibe-coded, so quality may need improvement - at least tests are green). This allows it to be used in production builds. E.g. for making profiling deterministic, so we don't have to sacrifice the performance of profile-guided-optimizations (PGO) for reproducible builds.
-It also can be applied to Lisp/Scheme memory dumps (clisp, sbcl, scheme48, racket, emacs) that are really hard to make deterministic.
+[![]({{ "/images/reports/2026-09/reproducible-builds.png#right" | relative_url }})](https://reproducible-builds.org/)
-* [`rebuilderd`](https://github.com/kpcyrd/rebuilderd/pull/263) (repomd split)
+In our reports, we try to outline the most important things that we have been up to over the past month. As a quick recap about what problem our project intends to solve, whilst anyone may inspect the source code of free software for malicious flaws, almost all software is distributed to end users as pre-compiled binaries. The motivation behind the reproducible builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised or not.
-### Patches
+As ever, if you are interested in contributing to the project, please visit our [*Contribute*]({{ "/contribute/" | relative_url }}) page on our website.
+
+<!--
+
+In this month's report, we cover:
+
+0. Added by lamby prior to publication…
+
+-->
+
+---
+
+### Reproducible Builds Summit 2026 held in Gothenburg, Sweden
+
+[![]({{ "/images/reports/2026-09/rb2026-gothenburg-grouppic-3.jpg#right" | relative_url }})]({{ "/events/gothenburg2026/" | relative_url }})
+
+The annual [Reproducible Builds summit took place from 22 to 24 September 2026 in Gothenburg, Sweden]({{ "/events/gothenburg2026/" | relative_url }}). The event brought together developers, distribution maintainers, security researchers and free software advocates from across the ecosystem to share updates on current initiatives, address outstanding toolchain bottlenecks and strengthen cross-project collaboration.
+
+Participants engaged in a series of working sessions and technical roundtables focused on expanding the practical scope of reproducibility. Discussions covered ongoing work within major Linux distributions, language-specific package ecosystems and the various parts of the binary verification infrastructure.
+
+Strategic planning formed a pillar of the gathering, with participants discussing long-term roadmap goals for supply-chain security, software integrity and related topics. Attendees explored new methods for automated verification, discussing how to lower the adoption barriers for maintainers and streamline the integration of deterministic build pipelines into established continuous integration (CI) systems. The event was then followed by two days of unmoderated hacking sessions. These hacking sessions provided space for technical progress, allowing attendees to draft specification updates, prototype new tool features and resolve standing reproducibility bugs in-person.
+
+<br>
+
+### Dettrace expanding architecture support for PGO & Lisp dumps
+
+Bernhard M. Wiedemann announced major updates to [dettrace](https://github.com/bmwiedemann/dettrace), porting the tool across most architectures supported by Debian and openSUSE. The release addresses key stability issues, passing test suites across these targets and making it ready for production build pipelines.
+
+These improvements enable deterministic builds when utilising [Profile-Guided Optimisations](https://en.wikipedia.org/wiki/Profile-guided_optimization) (PGO), removing the need to sacrifice runtime performance for reproducibility. Additionally, `dettrace` can now be applied to (notoriously difficult-to-reproduce) Lisp and Scheme memory dumps, including environments such as CLISP, SBCL, Scheme 48, Racket and GNU Emacs.
+
+<br>
+
+### *"They don't care about this"*
+
+[![]({{ "/images/reports/2026-09/paper-2609.png#right" | relative_url }})](https://arxiv.org/abs/2609.11411)
+
+Annika Wilde, Marco Gutfleisch, Felix Reichmann, Anirban Chakraborty, Yuval Yarom, M. Angela Sasse and Ghassan Karame published a paper this month entitled [*"They don't care about this": A Systematic Study of Trusted Execution Environments Build Reproducibility in the Wild*](https://arxiv.org/abs/2609.11411):
+
+> Trusted Execution Environments (TEEs) have become a cornerstone of modern cloud computing, providing strong confidentiality and integrity guarantees for both code and data. A critical component of this trust model is remote attestation, which enables external entities to verify the authenticity and integrity of code executing within a TEE through cryptographic measurements. However, the effectiveness of remote attestation fundamentally **depends on the verifier's ability to trace the reported measurement back to the original source code - a property that can only be guaranteed through reproducible builds**. [[…](https://arxiv.org/abs/2609.11411)]
+
+The [full PDF](https://arxiv.org/pdf/2609.11411) can be read online.
+
+<br>
+
+### `SOURCE_DATE_EPOCH` specification updates
+
+Bernhard M. Wiedemann [shared a number of proposals](https://lists.reproducible-builds.org/pipermail/rb-general/2026-September/004165.html) regarding updating the [`SOURCE_DATE_EPOCH` specification]({{ "/specs/source-date-epoch/" | relative_url }}) following discussions at a project summit. Seven distinct proposed changes have been [submitted as merge requests on Salsa](https://salsa.debian.org/reproducible-builds/specs/source-date-epoch-spec/-/merge_requests/).
+
+Bernhard's proposed modifications are independent of one another, allowing for any combination to be merged depending on community feedback. Bernhard noted that one proposal may see the most debate, and could still benefit from further refinement before reaching consensus. Community members are invited to review and provide feedback on the individual merge requests by 1 December 2026. Input can be submitted via reactions or comments on Salsa, directly by email to Bernhard or the mailing list.
+
+The specification was first published in 2015 and updated in 2017.
+
+<br>
+
+### New Code of Conduct (CoC) for the Reproducible Builds project
+
+Mattia Rizzolo [announced the official launch](https://lists.reproducible-builds.org/pipermail/rb-general/2026-September/004156.html) of a [Code of Conduct]({{ "/conduct/" | relative_url }}) for the Reproducible Builds project. This follows work and community discussions originally initiated in 2024, incorporating feedback gathered over email and during project summits, as well as with input from the [Software Freedom Conservancy](https://sfconservancy.org/).
+
+The new Code of Conduct establishes guidelines emphasising mutual respect among project contributors. It also defines a formalised process for submitting and handling complaints regarding community misconduct, ensuring transparent governance across project spaces. Along with the core policy document, an accompanying [Code of Conduct FAQ]({{ "/conduct/faq/" | relative_url }}) has been published to outline the rationale behind adopting the guidelines.
+
+<br>
+
+### Supporter Spotlight: Jochen Sprickerhof
+
+[![]({{ "/images/reports/2026-09/jochen.jpg#right" | relative_url }})]({{ "/news/2026/09/15/supporter-spotlight-jochen-sprickerhof/" | relative_url }})
+
+As a reminder, another [supporter spotlight interview]({{ "/news/2026/09/15/supporter-spotlight-jochen-sprickerhof/" | relative_url }}) was published featuring long-time Debian and Reproducible Builds contributor Jochen Sprickerhof, highlighting his work on package verification and project infrastructure.
+
+<br>
+
+### Mailing list news
+
+On [our mailing list](https://lists.reproducible-builds.org/listinfo/rb-general/) this month:
+
+* [Jonathan Starr](https://jstarr.science/) from the [Institute of Open Science Practices](https://iosp.science/) (IOSP) [posted with an announcement](https://lists.reproducible-builds.org/pipermail/rb-general/2026-September/004150.html) of its upcoming 2026 workshop series in Leiden in the Netherlands. This free-to-attend event aims to build a participant-owned data storage consortium, allowing community members to publish datasets, code and knowledge objects alongside algorithms designed to evaluate trust and value. The event features a dedicated [Community Track](https://www.iosp.science/submit-community-session) for talks and discussions, a tool showcase and an opening session on [resilient data storage](https://www.iosp.science/resilient-data-signup).
+* Following up on IRC discussions regarding profile-guided optimization (PGO) on build servers, *kpcyrd* created a [demonstration repository](https://github.com/kpcyrd/pgo-hashmap-unreproducible) showing how PGO profiling can introduce non-determinism into output binaries. The demo highlights how runtime randomness (specifically, the randomised keys used in HashMaps to prevent denial-of-service attacks) causes varying bucket collision rates during test runs. These structural variances alter execution weights on underlying code branches, prompting the compiler to generate differing final assembly output for builds that would otherwise be perfectly reproducible if PGO was disabled. Rather than abandoning PGO performance gains, [kpcyrd suggested treating generated profiling data as a documented build input](https://lists.reproducible-builds.org/pipermail/rb-general/2026-September/004153.html) or recorded environment artifact (similar to `.buildinfo` files), rather than regenerating profiles dynamically on the fly during build execution.
-* [FIXME](https://arxiv.org/pdf/2609.11411)
+* An autonomous AI agent (!), [posted](https://lists.reproducible-builds.org/pipermail/rb-general/2026-September/004159.html) a [controlled build result and reproducer](https://f005.backblazeb2.com/file/kai-agi-competitive-brief-2026/reproducibility/libmilter-9023/witness.md) demonstrating that pre-creating an `obj` directory in `libmilter` source trees prevents kernel-release path leaks (`obj.Linux.<release>.x86_64`) into debugging symbols. [*kpcyrd* followed up with a helpful reply](https://lists.reproducible-builds.org/pipermail/rb-general/2026-September/004160.html).
+
+* [Alexander Sosedkin inquired on the mailing list](https://lists.reproducible-builds.org/pipermail/rb-general/2026-September/004171.html) about the preferred approach for [sourcing pinned translation files](https://translationproject.org/) to create reproducible [GnuTLS](https://www.gnutls.org/) release tarballs, asking whether external hosting should provide versioned downloads, or if projects ought to use Git submodules, dedicated side-repositories or some other mechanism.
+
+<br>
+
+### Tool and documentation development
+
+[![]({{ "/images/reports/2026-09/diffoscope.png#right" | relative_url }})](https://diffoscope.org/)
+
+[**diffoscope**](https://diffoscope.org) is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb made a number of changes, including preparing and uploading versions `330`, `331` and `332` to Debian. In particular, Chris committed support for `radare2` versions greater than 5.9.0 [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/ba64aec7)] based on input from Guillaume Girol [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/b2c830f4)], and committed support for `.nar` files via Guix. [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/df30572e)][[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/8237da72)].
+
+Chris later modified *diffoscope* to not `Build-Depend` on the Debian package of GNU Guix, as its status in the Debian bug tracking system would transitively render *diffoscope* as being overly buggy for the next stable release [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/c126df62)]. Similarly, he adjusted the `Build-Depend`s on the `apksigcopier` package as it has been removed from Debian *testing* [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/436bc40f)] and, finally, he updated a number of copyright years [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/45ae6845)][[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/b4f193dc)].
+
+<br>
+
+[**reprotest**](https://salsa.debian.org/reproducible-builds/reprotest) is our tool for building the same source code twice in different environments and then checking the binaries produced by each build for any differences. This month, *reprotest* version `0.7.33` was uploaded to Debian by Holger Levsen with the following changes:
+
+* Sergei Tachenov fixed the `fileordering` test on all filesystems, including the likes of [ZFS](https://en.wikipedia.org/wiki/ZFS), which could return a different order across two builds due to build being done in a different directory [[…](https://salsa.debian.org/reproducible-builds/reprotest/commit/8e4beb6)].
+
+* Holger Levsen bumped the `Standards-Version` to `4.7.4`, reflected that `Priority: optional` is the default now [[…](https://salsa.debian.org/reproducible-builds/reprotest/commit/8053f66)], fixed the old [Free Software Foundation](https://www.fsf.org/) address [[…](https://salsa.debian.org/reproducible-builds/reprotest/commit/0f77715)] and bumped the *debhelper* 'compat' level to 14 after confirming there are only desired changes [[…](https://salsa.debian.org/reproducible-builds/reprotest/commit/d263fdb)].
+
+<br>
+
+[**rebuilderd**](https://github.com/kpcyrd/rebuilderd), our server designed monitor the official package repositories of Linux distributions and attempt to reproduce the observed results there; it powers, amongst other things, [*reproduce.debian.net*](https://reproduce.debian.net/). This month, Bernhard M. Wiedemann [submitted a pull request to rebuilderd](https://github.com/kpcyrd/rebuilderd/pull/263) that refactors RPM repository metadata handling. The change extracts `rpm-md` parsing out of the Fedora-specific scheduler module and into a shared one.
+
+<br>
+
+[![]({{ "/images/reports/2026-09/website.png#right" | relative_url }})]({{ "/" | relative_url }})
+
+Lastly, there were a number of improvements made to [**our website**]({{ "/" | relative_url }}) this month as well. For example:
+
+* Chris Lamb:
+
+ * Added a note re. `TZ=UTC` vs. `TZ=UTC0` to the [*Timezones*]({{ "/docs/timezones/" | relative_url }}) page. [[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/adf38b87)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/ae8f4da5)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/0ca7cc78)]
+ * Make a bunch of cosmetic updates to [Jochen's supporter spotlight]({{ "/news/2026/09/15/supporter-spotlight-jochen-sprickerhof/" | relative_url }}). [[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/534e5276)]
+
+* Holger Levsen made a very large number of changes to the [Gothenburg summit page]({{ "/events/gothenburg2026/" | relative_url }}). [[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/5fefa023)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/7aba87f6)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/3598d1c9)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/4600ab6d)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/1529fc99)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/bf569952)]
+
+* Jochen Sprickerhof wrote and published [another supporter spotlight]({{ "/news/2026/09/15/supporter-spotlight-jochen-sprickerhof/" | relative_url }}). [[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/af7a55b8)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/7e141852)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/3e3e7993)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/eacb7f79)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/5ca55013)]
+
+* Mattia Rizzolo:
+
+ * Made a number of changes to the [Gothenburg summit page]({{ "/events/gothenburg2026/" | relative_url }}). [[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/57c81cb9)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/ea564cf5)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/75146298)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/411d3e8e)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/ea3eca50)]
+
+ * Add and publish the new [Code of Conduct]({{ "/conduct/" | relative_url }}). [[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/df0cb783)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/ca36d617)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/86434786)]
+ * Update translation POs. [[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/e65814d4)]
+
+* *kpcyrd* also made a number of changes to the [Gothenburg summit page]({{ "/events/gothenburg2026/" | relative_url }}). [[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/b02b2de5)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/77169f50)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/b819f72c)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/5c47ecc4)]
+
+<br>
+
+### Patches
+
+The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where applicable or possible. This month, we wrote a large number of such patches, including:
* Bernhard M. Wiedemann:
- * [`rpm`](https://build.opensuse.org/request/show/1375466) (delsign + Y2038)
- * [`python-hdf5plugin`](https://build.opensuse.org/request/show/1375796) (CPU)
- * [`python-slycot`](https://build.opensuse.org/request/show/1375800) (random tmp path)
- * [`golang-github-prometheus-prometheus`](https://build.opensuse.org/request/show/1375983) (tar)
- * [`python-mypy`](https://build.opensuse.org/request/show/1376580) (sphinx doctrees pickle)
- * [`python-django-cacheops`](https://build.opensuse.org/request/show/1376924) (FTBFS)
- * [`vlang`](https://build.opensuse.org/request/show/1375866) (%jobs)
- * [`pythia`](https://build.opensuse.org/request/show/1375963) (CPU cores in .src.rpm)
- * [`gromacs`](https://build.opensuse.org/request/show/1375891) (CPU cores via .src.rpm)
- * [`rusty_v8`](https://build.opensuse.org/request/show/1378149) (bug)
- * [`rust1.98`](https://build.opensuse.org/request/show/1378324) (LLVM22 backport + SR 1378325 1378326 for rust1.97 + rust1.96)
- * [`ltfat`](https://github.com/ltfat/ltfat/pull/206) (jar mtime)
- * [`jason`](https://github.com/michalmuskala/jason/pull/206) (hash (erlang))
- * [`otp`](https://github.com/erlang/otp/pull/11609) (uninitialized memory)
- * [`scotch`](https://gitlab.inria.fr/scotch/scotch/-/commit/f861be2c24b123355a64c2fe3c55f4f2f1355490) (CPU cores)
- * [`obs-build`](https://github.com/openSUSE/obs-build/pull/1166) (chmod)
- * [`obs-build`](https://github.com/openSUSE/obs-build/pull/1173) (rpmdb date, [alternative](https://github.com/openSUSE/obs-build/pull/1176))
- * [`python-autobahn`](https://build.opensuse.org/request/show/1379338) (drop cache)
- * [`lkl`](https://build.opensuse.org/request/show/1379485) (date+hostname regression)
- * [`MozillaFirefox`](https://build.opensuse.org/request/show/1380021) (PGO)
- * [`apache-arrow`](https://build.opensuse.org/request/show/1380315) (core count)
- * [`dtaidistance`](https://github.com/wannesm/dtaidistance/pull/230) (ASLR in log)
- * [`qt6-base`](https://qt-project.atlassian.net/browse/QTBUG-150796) (toolchain CPU - affects calibre)
- * [`memory-constraints`](https://src.opensuse.org/chromium/memory-constraints/pulls/5) (toolchain %jobs)
- * [gcc 3.3](https://src.opensuse.org/gcc/gcc33/pulls/1)
- * [gcc 4.8](https://src.opensuse.org/gcc/gcc48/pulls/1)
- * [gcc 7](https://src.opensuse.org/gcc/gcc7/pulls/1)
+
+ * [`apache-arrow`](https://build.opensuse.org/request/show/1380315)
+ * [`dtaidistance`](https://github.com/wannesm/dtaidistance/pull/230)
+ * [`gcc 3.3`](https://src.opensuse.org/gcc/gcc33/pulls/1)
+ * [`gcc 4.8`](https://src.opensuse.org/gcc/gcc48/pulls/1)
+ * [`gcc 7`](https://src.opensuse.org/gcc/gcc7/pulls/1)
+ * [`golang-github-prometheus-prometheus`](https://build.opensuse.org/request/show/1375983)
+ * [`gromacs`](https://build.opensuse.org/request/show/1375891)
+ * [`jason`](https://github.com/michalmuskala/jason/pull/206)
+ * [`lkl`](https://build.opensuse.org/request/show/1379485)
+ * [`ltfat`](https://github.com/ltfat/ltfat/pull/206)
+ * [`memory-constraints`](https://src.opensuse.org/chromium/memory-constraints/pulls/5)
+ * [`MozillaFirefox`](https://build.opensuse.org/request/show/1380021)
+ * [`obs-build`](https://github.com/openSUSE/obs-build/pull/1166)
+ * [`obs-build`](https://github.com/openSUSE/obs-build/pull/1173)
+ * [`otp`](https://github.com/erlang/otp/pull/11609)
+ * [`pythia`](https://build.opensuse.org/request/show/1375963)
+ * [`python-autobahn`](https://build.opensuse.org/request/show/1379338)
+ * [`python-django-cacheops`](https://build.opensuse.org/request/show/1376924)
+ * [`python-hdf5plugin`](https://build.opensuse.org/request/show/1375796)
+ * [`python-mypy`](https://build.opensuse.org/request/show/1376580)
+ * [`python-slycot`](https://build.opensuse.org/request/show/1375800)
+ * [`qt6-base`](https://qt-project.atlassian.net/browse/QTBUG-150796)
+ * [`rpm`](https://build.opensuse.org/request/show/1375466)
+ * [`rust1.98`](https://build.opensuse.org/request/show/1378324)
+ * [`rusty_v8`](https://build.opensuse.org/request/show/1378149)
+ * [`scotch`](https://gitlab.inria.fr/scotch/scotch/-/commit/f861be2c24b123355a64c2fe3c55f4f2f1355490)
+ * [`vlang`](https://build.opensuse.org/request/show/1375866)
+
+* Chris Lamb:
+
+ * [#1146687](https://bugs.debian.org/1146687) filed against [`lektor`](https://tracker.debian.org/pkg/lektor).
+ * [#1147673](https://bugs.debian.org/1147673) filed against [`golang-forgejo-xorm-xorm`](https://tracker.debian.org/pkg/golang-forgejo-xorm-xorm).
+ * [#1147674](https://bugs.debian.org/1147674) filed against [`python-vermin`](https://tracker.debian.org/pkg/python-vermin).
+ * [#1148657](https://bugs.debian.org/1148657) filed against [`python-eventlet`](https://tracker.debian.org/pkg/python-eventlet).
+ * [#1148658](https://bugs.debian.org/1148658) filed against [`golang-github-miekg-pkcs11`](https://tracker.debian.org/pkg/golang-github-miekg-pkcs11).
+ * [#1148660](https://bugs.debian.org/1148660) filed against [`python-prov`](https://tracker.debian.org/pkg/python-prov).
+ * [#1148973](https://bugs.debian.org/1148973) filed against [`lemonade`](https://tracker.debian.org/pkg/lemonade).
+ * [#1148977](https://bugs.debian.org/1148977) filed against [`yuzu`](https://tracker.debian.org/pkg/yuzu).
+ * [#1148979](https://bugs.debian.org/1148979) filed against [`python-mne`](https://tracker.debian.org/pkg/python-mne).
+
+* Jochen Sprickerhof:
+
+ * [#1147645](https://bugs.debian.org/1147645) filed against [`bitshuffle`](https://tracker.debian.org/pkg/bitshuffle).
+
+* Tianyu Chen:
+
+ * [#1147760](https://bugs.debian.org/1147760) filed against [`nss`](https://tracker.debian.org/pkg/nss).
+
+<br>
+<br>
+
+If you are interested in contributing to the Reproducible Builds project, please visit our [*Contribute*](https://reproducible-builds.org/contribute/) page on our website. However, you can get in touch with us via:
+
+ * IRC: `#reproducible-builds` on `irc.oftc.net`.
+
+ * Mastodon: [@reproducible_builds at fosstodon.org](https://fosstodon.org/@reproducible_builds)
+
+ * Mailing list: [`rb-general at lists.reproducible-builds.org`](https://lists.reproducible-builds.org/listinfo/rb-general)
+>>>>>>> e44c9f2c (2026-09: Initial draft)
=====================================
bin/generate-draft.template
=====================================
@@ -59,11 +59,9 @@ In Debian:
<br>
-## Software development
+### Upstream patches
-#### Upstream patches
-
-The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where appropriate. This month, we wrote a large number of such patches, including:
+The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where applicable or possible. This month, we wrote a large number of such patches, including:
{% for x, ys in patches.items()|sort %}
* {{ x }}:
@@ -75,7 +73,9 @@ In addition, build failure bugs were reported by:
* {{ k }} ({{ v|length }}){% endfor %}{% endif %}
{% for project in projects %}
-#### {{ project }}
+<br>
+
+### {{ project }}
{% for x in uploads[project] %}
{{ project }} version `{{ x['version'] }}` was [uploaded to Debian {{ x['distribution'] }}](https://tracker.debian.org/pkg/{{ project }}?FIXME) by {{ x['signed_by_name'] }}. It [included contributions already covered in previous months](https://salsa.debian.org/reproducible-builds/{{ project }}/commits/{% if project != 'diffoscope' %}debian/{% endif %}{{ x['version'] }}) as well as new ones from:
=====================================
images/reports/2026-09/debian.png
=====================================
Binary files /dev/null and b/images/reports/2026-09/debian.png differ
=====================================
images/reports/2026-09/diffoscope.png
=====================================
Binary files /dev/null and b/images/reports/2026-09/diffoscope.png differ
=====================================
images/reports/2026-09/jochen.jpg
=====================================
Binary files /dev/null and b/images/reports/2026-09/jochen.jpg differ
=====================================
images/reports/2026-09/opensuse.png
=====================================
Binary files /dev/null and b/images/reports/2026-09/opensuse.png differ
=====================================
images/reports/2026-09/paper-2609.png
=====================================
Binary files /dev/null and b/images/reports/2026-09/paper-2609.png differ
=====================================
images/reports/2026-09/rb2026-gothenburg-grouppic-3.jpg
=====================================
Binary files /dev/null and b/images/reports/2026-09/rb2026-gothenburg-grouppic-3.jpg differ
=====================================
images/reports/2026-09/reproducible-builds.png
=====================================
Binary files /dev/null and b/images/reports/2026-09/reproducible-builds.png differ
=====================================
images/reports/2026-09/website.png
=====================================
Binary files /dev/null and b/images/reports/2026-09/website.png differ
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/compare/f3922a2d04911c00c7690edf376499647de41d88...119f1c05f749e91a8c97396f0718f695ea2041d8
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/compare/f3922a2d04911c00c7690edf376499647de41d88...119f1c05f749e91a8c97396f0718f695ea2041d8
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-commits/attachments/20261012/c5d00661/attachment.htm>
More information about the rb-commits
mailing list