From gitlab at salsa.debian.org Thu Sep 3 01:17:10 2026
From: gitlab at salsa.debian.org (Chris Lamb (@lamby))
Date: Thu, 03 Sep 2026 01:17:10 +0000
Subject: [Git][reproducible-builds/reproducible-website][master] Make a bunch
of cosmetic updates to
_posts/2026-08-25-supporter-spotlight-jochen-sprickerhof.md.
Message-ID: <6a98ca96db19a_55a476369016837c9@godard.mail>
Chris Lamb pushed to branch master at Reproducible Builds / reproducible-website
Commits:
534e5276 by Chris Lamb at 2026-09-02T18:16:47-07:00
Make a bunch of cosmetic updates to _posts/2026-08-25-supporter-spotlight-jochen-sprickerhof.md.
- - - - -
1 changed file:
- _posts/2026-08-25-supporter-spotlight-jochen-sprickerhof.md
Changes:
=====================================
_posts/2026-08-25-supporter-spotlight-jochen-sprickerhof.md
=====================================
@@ -18,117 +18,59 @@ one of the newer members of the Reproducible Builds project core team.
-**Vagrant Cascadian: Could you tell me a bit about yourself? What sort
- of things do you work on?**
+**Vagrant Cascadian: Could you tell me a bit about yourself? What sort of things do you work on?**
**Jochen Sprickerhof:**
-I am a freelance programmer working on Open Source. Mainly doing [Debian](https://debian.org),
-[F-Droid](https://f-droid.org) and some smaller software projects. In general I made it a
-habit to look into every software I use and try to fix bugs or add
-features I need. In Debian I maintain about 180 packages with topics
-from home banking over build systems to robotics. Most of my time I
-currently work on [reproduce.debian.net](https://reproduce.debian.net) where we try to bit by
-bit reproduce the packages distributed by Debian.
+I am a freelance programmer working on Open Source. Mainly doing [Debian](https://debian.org), [F-Droid](https://f-droid.org) and some smaller software projects. In general I made it a habit to look into every software I use and try to fix bugs or add features I need. In Debian, I maintain about 180 packages with topics covering home banking, build systems and robotics. Most of my time, I currently work on [*reproduce.debian.net*](https://reproduce.debian.net), where we try to bit-for-bit reproduce the packages distributed by Debian.
-**Vagrant: Could you describe the path that lead you to working on
- reproducible-builds?**
+**Vagrant: Could you describe the path that lead you to working on reproducible builds?**
**Jochen:**
-I started my Debian journey as a teenager, converting my school to Debian
-and serving as its system administrator for 13 years. After studying
-applied system science I joined the university's robotics labs where I
-worked on the robot operating system ROS and the point cloud library
-PCL. In the end I enjoyed programming more than writing papers so I
-eventually left academia for a robotics startup. Some years ago I
-realized that the open source work I was doing in my spare time was
-actually the work I cared most about. Nowadays I am really grateful
-that I can spend my days working on things I find important and have
-lots of fun with.
+I started my Debian journey as a teenager, converting my school to Debian and serving as its system administrator for 13 years. After studying Applied System Science, I joined the university's robotics labs, where I worked on the [Robot Operating System](https://www.ros.org/) (ROS) and the [Point Cloud Library](https://pointclouds.org/) (PCL). In the end, I enjoyed programming more than writing papers, so I eventually left academia for a robotics startup. Some years ago, I realized that the open source work I was doing in my spare time was actually the work I cared most about. Nowadays I am really grateful that I can spend my days working on things I find important and have lots of fun with.
**Vagrant: What projects did you recently make big progress on?**
**Jochen:**
-A recent example is [metasnap.debian.net](https://metasnap.debian.net). It is a meta archive of
-[snapshot.debian.org](https://snapshot.debian.org) that is an archive of all packages in Debian. Let
-me explain it the other way round. With reproduce.debian.net we try to
-reproduce the packages as they are distributed by the Debian
-archive. For that we need the same build environment (compilers,
-build tools..) as was used by Debian back when the original package
-was compiled. Luckily snapshot.debian.org has all those but they are not
-easily accessible via apt, Debians package manager. So metasnap provides a mapping from a
-package name and version to the apt repo on snapshot.debian.org to download
-it from. It was created by josch some time ago and is an awesome
-work. But when we tried to reproduce more and more packages on
-reproduce.debian.net we found that some were missing packages from the build
-environment even though they where visible on snapshot.debian.org. We found
-that metasnap excluded some archive areas because they where not
-expected to be needed. Reimporting all the data took more than two
-months and surfaced a couple more flaws.
-
-With this fixed we were able to build more packages only to find out
-that metasnap also needs better support for version numbers. Luckily we
-were able to rewrite the data in a day instead of starting
-the import again.
+
+A recent example is [*metasnap.debian.net*](https://metasnap.debian.net). It is a 'meta archive' of
+[*snapshot.debian.org*](https://snapshot.debian.org) which is itself archive of all packages in Debian. But let
+me explain it the other way round: with *reproduce.debian.net*, we try to reproduce the packages as they are distributed by the Debian archive. For that, we need the same build environment (compilers, libraries, build tools, etc) that was used by Debian back when the original package was compiled. Luckily, *snapshot.debian.org* has all those packages, but they are not easily accessible via *apt*, Debian's package manager. So, *metasnap* provides a mapping from a package name and version pair to the APT repo on *snapshot.debian.org* needed to download it from. It was created by `josch` some time ago, and is an awesome work. But when we tried to reproduce more and more packages on *reproduce.debian.net*, we found that some were missing packages from the build environment ? even though they where visible on *snapshot.debian.org*. We found that *metasnap* excluded some archive areas because they where not expected to be needed. Reimporting all the data took more than two months and surfaced a couple more flaws.
+
+With this fixed, we were able to build more packages, only to find out that *metasnap* also needs better support for version numbers. Luckily we were able to rewrite the data in a day instead of starting the import again.
-**Vagrant: You have been working on infrastructure to support reproducible
- builds for a while, has recent adoption of reproduce.debian.net into the
- Debian release tooling changed the focus of your work?**
+**Vagrant: You have been working on infrastructure to support reproducible builds for a while. Has recent adoption of *reproduce.debian.net* into the Debian release tooling changed the focus of your work?**
**Jochen:**
-Quite a bit. When we started reproduce.debian.net in 2024 only around
-33% of the packages could be reproduced successfully. Today we are
-above 98%. Most were not bugs in the packages themselves, but in the
-infrastructure. Like the metasnap thing I talked about earlier or
-packages just needed a rebuild because something else, like the
-toolchain, was fixed in the meantime. In May people from the Debian
-release team and reproducible builds sat together and decided that the
-overall state is good enough and now packages that regress on
-reproducibility are blocked from entering the next Debian release. But
-that does not mean all the work is on the shoulders of the Debian
-package maintainers. Since then I have been constantly looking at the
-migration tooling to spot regressions and provide fixes. Also a couple
-of maintainers reached out to us for help and I hope more will do so
-in future.
+Quite a bit. When we started *reproduce.debian.net* in 2024, only around 33% of the packages could be reproduced successfully. Today we are above 98%. Most were not bugs in the packages themselves but in the *infrastructure*. Similar to the *metasnap* issue I reference above, packages just needed a rebuild because something else, like the toolchain, was fixed in the meantime. In May, people from the Debian release team and the Reproducible Builds project sat together and decided that the overall state is good enough, and now packages that regress on reproducibility are blocked from entering the next Debian release. But that does not mean all the work is on the shoulders of Debian package maintainers. Since then I have been constantly looking at the migration tooling to spot regressions and provide fixes. Furthermore, a couple of maintainers reached out to us for help and I hope more will do so in future.
-**Vagrant: What is one small thing you (or others) have not yet gotten to
- that you would really like to see?**
+**Vagrant: What is one small thing you (or others) have not yet gotten to that you would really like to see?**
**Jochen:**
-The central tool to reproduce Debian packages is `debrebuild`, also written
-by josch. Currently it has two ways to retrieve the build dependencies of
-a package. Either it uses metasnap.debian.net as explained above or it can
-access the Debian unstable apt repository directly. This allows to test packages
-locally before everything is indexed on metasnap by compiling
-against unstable. But actually there are many other apt repositories
-to query, like Debian stable or even derivatives. Adding support for an
-optional list of apt repositories in `debrebuild` would be great. That would
-also be a big step to support reproducing other Debian based distributions.
+The central tool to reproduce Debian packages is *debrebuild*, also written by `josch`. Currently it has two ways to retrieve the build dependencies of a package. Either it uses *metasnap.debian.net* (as explained above), or it can access the Debian *unstable* APT repository directly. This allows to test packages locally before everything is indexed on *metasnap* by compiling against Debian *unstable*. But actually there are many other APT repositories to query, like Debian stable or even derivatives. Adding support for an optional list of APT repositories in `debrebuild` would be great. That would also be a big step to support reproducing other Debian based distributions.
-**Vagrant: ... one big thing?**
+**Vagrant: ... and one *big* thing?**
**Jochen:**
-It would be great to integrate metasnap.debian.net into
-snapshot.debian.org. There is some discussion on it already in
-[bugs.debian.org/650783](https://bugs.debian.org/650783).
+It would be great to integrate *metasnap.debian.net* into *snapshot.debian.org*. There is some discussion on it already in Debian bug [#650783](https://bugs.debian.org/650783).
**Vagrant: What are the tools you use the most?**
**Jochen:**
-According to my fish shell history:
+According to my *fish* shell history:
-
+```
$ history | cut -d' ' -f1 | sort | uniq -c | sort -nr | head -10
36199 git
20941 vi
@@ -140,70 +82,41 @@ $ history | cut -d' ' -f1 | sort | uniq -c | sort -nr | head -10
4249 mv
3655 dpkg
2873 cp
-
+```
-**Vagrant: So, is the fish shell reproducible? I remember it did not
- used to...**
+**Vagrant: So, is the *fish* shell reproducible? I remember it did not used to be...**
**Jochen:**
-You can check for yourself - it was last time I did:
-[reproduce.debian.net/excuses.html?source_name=fish](https://reproduce.debian.net/excuses.html?source_name=fish) But looking
-through the other commands, neovim sadly is not:
-[reproduce.debian.net/excuses.html?source_name=neovim](https://reproduce.debian.net/excuses.html?source_name=neovim) I hope we
-can fix that in future.
+You can check for yourself ? [it was last time I checked](https://reproduce.debian.net/excuses.html?source_name=fish). But looking through the other commands, [*neovim* sadly is not](https://reproduce.debian.net/excuses.html?source_name=neovim). I hope we can fix that in future.
-**Vagrant: Oh, that's a nice URL to check for reproducible package...
- you can just pass the source package name to check the current results?**
+**Vagrant: Oh, that's a nice URL to check for reproducible package... you can just pass the source package name to check the current results?**
**Jochen:**
-Yes. An other one is [udd.debian.org/reproducibility/](https://udd.debian.org/reproducibility/) where you
-can list all packages of a Debian maintainer. It also lists source
-reproducibility and has nice filters.
+
+Yes. Another one is [`udd.debian.org/reproducibility/hello`](https://udd.debian.org/reproducibility/hello), where you
+can list all packages of a Debian maintainer. It also lists source reproducibility and has nice filters as well.
**Vagrant: What tools do you use specifically working on reproducible builds?**
**Jochen:**
-I don't have statistics for that but I would say `sbuild`, to build the
-package, `debrebuild`, to reproduce it, and `diffoscope` to analyze the
-differences. Obviously I also need `apt source ` or `git-buildpackage`
-to get the sources and all the tools I mentioned above.
+I don't have statistics for that, but I would say *sbuild* to build the package, *debrebuild* to reproduce it, and `diffoscope` to analyze the differences. Obviously I also need run `apt source ` or use *git-buildpackage* to get the sources and all the tools I mentioned above.
-**Vagrant: So how many packages are left to build reproducibly, and once
- those are finished, what is next?**
+**Vagrant: So how many packages are left to build reproducibly, and once those are finished, what is next?**
**Jochen:**
-Right now reproduce.debian.net shows over 98% reproducibility though
-there are still over 650 package left and some will probably need a
-lot of work. But actually I think making packages reproducible is just
-the first step. For me this is a project to build confidence in the
-system. To reproduce a package we have two parts: The source of the
-package and the build environment. Fixing the packages means gaining
-confidence in the first part but we still rely on the individual build
-environments for each package, as we need to use the same compiler
-that was used when the package was build initially. So we have to keep
-around every historical version of all toolchain packages. I really
-would like to remove this extra archive which means we would have to rebuild
-all of Debian around release time. I am dreaming of a Debian release
-where you could bit by bit reproduce every package just from the
-released versions. Due to how Debian works this is not a trivial
-rebuild but will need some work on the infrastructure. By the way,
-initially there was a third component to pay attention to: any
-connection to the outside world during the build. Luckily we fixed the
-Debian build daemons to not allow network connections during the build some
-time ago.
+Right now, *reproduce.debian.net* shows over 98% reproducibility, though there are still over 650 package left and some will probably need a lot of work. But actually I think making packages reproducible is just the first step. For me, this is a project to build confidence in the system. To reproduce a package we have two parts: the source of the package and the build environment. Fixing the packages means gaining confidence in the first part but we still rely on the individual build environments for each package as we need to use the same compiler that was used when the package was build initially. Because of this, we have to keep around every historical version of all toolchain packages. I really would like to remove this extra archive, which means we would have to rebuild all of Debian around release time. I am dreaming of a Debian release where you could bit-for-bit reproduce every package just from the released versions. Due to how Debian works, however, this is not a trivial rebuild and it would need some work on the infrastructure. By the way, initially there was a third component to pay attention to: any connection to the outside world during the build. Luckily we fixed the Debian build daemons to not allow network connections during the build some time ago.
-**Vagrant: Thanks for all that work, and taking the time to tell us a bit
- about yourself!**
+**Vagrant: Thanks for all that work, and taking the time to tell us a bit about yourself!**
**Jochen:**
Thanks a lot for the interview!
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/534e527653319a2ce6f7a482e6e9d40b0904b9aa
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/534e527653319a2ce6f7a482e6e9d40b0904b9aa
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Thu Sep 3 06:23:15 2026
From: gitlab at salsa.debian.org (Jochen Sprickerhof (@jspricke))
Date: Thu, 03 Sep 2026 06:23:15 +0000
Subject: [Git][reproducible-builds/reproducible-website][master] Interview
Jochen: Update publish date, fix formatting
Message-ID: <6a991253a89a9_55a10465417247b3@godard.mail>
Jochen Sprickerhof pushed to branch master at Reproducible Builds / reproducible-website
Commits:
5ca55013 by Jochen Sprickerhof at 2026-09-03T08:17:15+02:00
Interview Jochen: Update publish date, fix formatting
- - - - -
1 changed file:
- _posts/2026-08-25-supporter-spotlight-jochen-sprickerhof.md
Changes:
=====================================
_posts/2026-08-25-supporter-spotlight-jochen-sprickerhof.md
=====================================
@@ -2,7 +2,7 @@
layout: post
title: "Supporter spotlight: Jochen Sprickerhof on ... Reproducible Builds!"
draft: true
-date: 2026-08-25 00:00:00
+date: 2026-09-15 00:00:00
categories: org
---
@@ -35,7 +35,6 @@ I started my Debian journey as a teenager, converting my school to Debian and se
**Vagrant: What projects did you recently make big progress on?**
**Jochen:**
-
A recent example is [*metasnap.debian.net*](https://metasnap.debian.net). It is a 'meta archive' of
[*snapshot.debian.org*](https://snapshot.debian.org) which is itself archive of all packages in Debian. But let
me explain it the other way round: with *reproduce.debian.net*, we try to reproduce the packages as they are distributed by the Debian archive. For that, we need the same build environment (compilers, libraries, build tools, etc) that was used by Debian back when the original package was compiled. Luckily, *snapshot.debian.org* has all those packages, but they are not easily accessible via *apt*, Debian's package manager. So, *metasnap* provides a mapping from a package name and version pair to the APT repo on *snapshot.debian.org* needed to download it from. It was created by `josch` some time ago, and is an awesome work. But when we tried to reproduce more and more packages on *reproduce.debian.net*, we found that some were missing packages from the build environment ? even though they where visible on *snapshot.debian.org*. We found that *metasnap* excluded some archive areas because they where not expected to be needed. Reimporting all the data took more than two months and surfaced a couple more flaws.
@@ -96,7 +95,6 @@ You can check for yourself ? [it was last time I checked](https://reproduce.de
**Vagrant: Oh, that's a nice URL to check for reproducible package... you can just pass the source package name to check the current results?**
**Jochen:**
-
Yes. Another one is [`udd.debian.org/reproducibility/hello`](https://udd.debian.org/reproducibility/hello), where you
can list all packages of a Debian maintainer. It also lists source reproducibility and has nice filters as well.
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/5ca55013d2764efc683bb159d5030f488289295f
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/5ca55013d2764efc683bb159d5030f488289295f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Thu Sep 3 07:38:02 2026
From: gitlab at salsa.debian.org (Jochen Sprickerhof (@jspricke))
Date: Thu, 03 Sep 2026 07:38:02 +0000
Subject: [Git][reproducible-builds/reproducible-website][master] Interview
Jochen: update filename to publish date
Message-ID: <6a9923da96937_55a36d0af817386a3@godard.mail>
Jochen Sprickerhof pushed to branch master at Reproducible Builds / reproducible-website
Commits:
eacb7f79 by Jochen Sprickerhof at 2026-09-03T09:19:39+02:00
Interview Jochen: update filename to publish date
- - - - -
1 changed file:
- _posts/2026-08-25-supporter-spotlight-jochen-sprickerhof.md ? _posts/2026-09-15-supporter-spotlight-jochen-sprickerhof.md
Changes:
=====================================
_posts/2026-08-25-supporter-spotlight-jochen-sprickerhof.md ? _posts/2026-09-15-supporter-spotlight-jochen-sprickerhof.md
=====================================
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/eacb7f79ebc30e54874bb315c01e167fa9f33efd
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/eacb7f79ebc30e54874bb315c01e167fa9f33efd
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Thu Sep 3 16:01:59 2026
From: gitlab at salsa.debian.org (Jochen Sprickerhof (@jspricke))
Date: Thu, 03 Sep 2026 16:01:59 +0000
Subject: [Git][reproducible-builds/reproducible-website][master] Interview
Jochen: fix URL
Message-ID: <6a9999f7af139_29a49ffa2831350@godard.mail>
Jochen Sprickerhof pushed to branch master at Reproducible Builds / reproducible-website
Commits:
3e3e7993 by Jochen Sprickerhof at 2026-09-03T17:58:27+02:00
Interview Jochen: fix URL
- - - - -
1 changed file:
- _posts/2026-09-15-supporter-spotlight-jochen-sprickerhof.md
Changes:
=====================================
_posts/2026-09-15-supporter-spotlight-jochen-sprickerhof.md
=====================================
@@ -95,7 +95,7 @@ You can check for yourself ? [it was last time I checked](https://reproduce.de
**Vagrant: Oh, that's a nice URL to check for reproducible package... you can just pass the source package name to check the current results?**
**Jochen:**
-Yes. Another one is [`udd.debian.org/reproducibility/hello`](https://udd.debian.org/reproducibility/hello), where you
+Yes. Another one is [`udd.debian.org/reproducibility/`](https://udd.debian.org/reproducibility/), where you
can list all packages of a Debian maintainer. It also lists source reproducibility and has nice filters as well.
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/3e3e7993b48fbfcfb8b68a22c668f7bd254ead00
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/3e3e7993b48fbfcfb8b68a22c668f7bd254ead00
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Thu Sep 3 17:07:10 2026
From: gitlab at salsa.debian.org (Bernhard M. Wiedemann (@bmwiedemann-guest))
Date: Thu, 03 Sep 2026 17:07:10 +0000
Subject: [Git][reproducible-builds/reproducible-website][master] 2026-08:
+openSUSE monthly
Message-ID: <6a99a93eb8c7b_29a49ffd0c415e2@godard.mail>
Bernhard M. Wiedemann pushed to branch master at Reproducible Builds / reproducible-website
Commits:
ef68198f by Bernhard M. Wiedemann at 2026-09-03T19:06:57+02:00
2026-08: +openSUSE monthly
- - - - -
1 changed file:
- _reports/2026-08.md
Changes:
=====================================
_reports/2026-08.md
=====================================
@@ -33,6 +33,8 @@ draft: true
* [LWN FOSSY bootstrappable](https://lwn.net/Articles/1088279/)
+* [openSUSE monthly](https://lists.opensuse.org/archives/list/factory at lists.opensuse.org/thread/C7BCS4OC2XPR5ZNOEXCJGP6NXL2W5BNT/)
+
* Bernhard M. Wiedemann:
* [`python-pook`](https://build.opensuse.org/request/show/1369446) (nocheck)
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/ef68198f0d8f97cae884895fcf90282eff413b13
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/ef68198f0d8f97cae884895fcf90282eff413b13
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Thu Sep 3 18:57:51 2026
From: gitlab at salsa.debian.org (Jochen Sprickerhof (@jspricke))
Date: Thu, 03 Sep 2026 18:57:51 +0000
Subject: [Git][reproducible-builds/reproducible-website][master] Interview
Jochen: fix wording, thanks Mattia and kp!
Message-ID: <6a99c32fbbeb4_29a49ffe9c6825d@godard.mail>
Jochen Sprickerhof pushed to branch master at Reproducible Builds / reproducible-website
Commits:
7e141852 by Jochen Sprickerhof at 2026-09-03T20:57:41+02:00
Interview Jochen: fix wording, thanks Mattia and kp!
- - - - -
1 changed file:
- _posts/2026-09-15-supporter-spotlight-jochen-sprickerhof.md
Changes:
=====================================
_posts/2026-09-15-supporter-spotlight-jochen-sprickerhof.md
=====================================
@@ -37,7 +37,7 @@ I started my Debian journey as a teenager, converting my school to Debian and se
**Jochen:**
A recent example is [*metasnap.debian.net*](https://metasnap.debian.net). It is a 'meta archive' of
[*snapshot.debian.org*](https://snapshot.debian.org) which is itself archive of all packages in Debian. But let
-me explain it the other way round: with *reproduce.debian.net*, we try to reproduce the packages as they are distributed by the Debian archive. For that, we need the same build environment (compilers, libraries, build tools, etc) that was used by Debian back when the original package was compiled. Luckily, *snapshot.debian.org* has all those packages, but they are not easily accessible via *apt*, Debian's package manager. So, *metasnap* provides a mapping from a package name and version pair to the APT repo on *snapshot.debian.org* needed to download it from. It was created by `josch` some time ago, and is an awesome work. But when we tried to reproduce more and more packages on *reproduce.debian.net*, we found that some were missing packages from the build environment ? even though they where visible on *snapshot.debian.org*. We found that *metasnap* excluded some archive areas because they where not expected to be needed. Reimporting all the data took more than two months and surfaced a couple more flaws.
+me explain it the other way round: with *reproduce.debian.net*, we try to reproduce the packages as they are distributed by the Debian archive. For that, we need the same build environment (compilers, libraries, build tools, etc) that was used by Debian back when the original package was compiled. Luckily, *snapshot.debian.org* has all those packages, but they are not easily accessible via *apt*, Debian's package manager. So, *metasnap* provides a mapping from a package name and version pair to the APT repo on *snapshot.debian.org* needed to download it from. It was created by `josch` some time ago, and it's awesome work. But when we tried to reproduce more and more packages on *reproduce.debian.net*, we found that some were missing packages from the build environment ? even though they where visible on *snapshot.debian.org*. We found that *metasnap* excluded some archive areas because they where not expected to be needed. Reimporting all the data took more than two months and surfaced a couple more flaws.
With this fixed, we were able to build more packages, only to find out that *metasnap* also needs better support for version numbers. Luckily we were able to rewrite the data in a day instead of starting the import again.
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/7e141852c0b9519934f6ddda34e79a37cbf9de3a
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/7e141852c0b9519934f6ddda34e79a37cbf9de3a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Fri Sep 4 00:01:16 2026
From: gitlab at salsa.debian.org (Mattia Rizzolo (@mattia))
Date: Fri, 04 Sep 2026 00:01:16 +0000
Subject: [Git][reproducible-builds/reproducible-notes][master] Remove archived
bugs
Message-ID: <6a9a0a4cbcae3_29a491682f8131139@godard.mail>
Mattia Rizzolo pushed to branch master at Reproducible Builds / reproducible-notes
Commits:
a16a6c1a by automatic commit from Mattia Rizzolo at 2026-09-04T00:00:50+00:00
Remove archived bugs
- - - - -
1 changed file:
- packages.yml
Changes:
=====================================
packages.yml
=====================================
@@ -1602,10 +1602,6 @@ binfmtc:
version: 0.17-2
issues:
- build_id_differences_only
-bingo:
- version: 0.10.0-1
- bugs:
- - 1138640
binpac:
version: 0.44-1
issues:
@@ -13982,8 +13978,6 @@ libjogl2-java:
version: 2.3.2+dfsg-5
issues:
- random_order_in_documentation_generated_by_javadoc
- bugs:
- - 1142134
libjpeg:
version: 0.0~git20180720.99764820d250-3
issues:
@@ -23041,10 +23035,6 @@ python-gammu:
version: 2.4-1
issues:
- ftbfs_uninvestigated_test_failures
-python-genson:
- version: 1.3.0-2
- bugs:
- - 1120881
python-geohash:
version: 0.8.3-1.1
issues:
@@ -34247,10 +34237,6 @@ vim-command-t:
version: 5.0.2-5-g7147ba9-1
issues:
- captures_build_path_via_assert
-vim-youcompleteme:
- version: 0+20240827+gitb6e8c64+ds-7
- bugs:
- - 1133174
vip-manager:
version: 1.0.1-5
issues:
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/a16a6c1a73705ae7dfd599d49fa0fb0bf4ad4af3
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/a16a6c1a73705ae7dfd599d49fa0fb0bf4ad4af3
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Fri Sep 4 11:07:25 2026
From: gitlab at salsa.debian.org (Chris Lamb (@lamby))
Date: Fri, 04 Sep 2026 11:07:25 +0000
Subject: [Git][reproducible-builds/reproducible-notes][master] Add patch for
lektor
Message-ID: <6a9aa66daf188_29a49ffbe0307629@godard.mail>
Chris Lamb pushed to branch master at Reproducible Builds / reproducible-notes
Commits:
4ecb20e0 by Chris Lamb at 2026-09-04T12:06:18+01:00
Add patch for lektor
- - - - -
1 changed file:
- packages.yml
Changes:
=====================================
packages.yml
=====================================
@@ -12955,6 +12955,10 @@ leiningen-clojure:
- timestamps_in_jar
bugs:
- 906720
+lektor:
+ version: 3.3.14-0.1
+ bugs:
+ - 1146687
lemonldap-ng:
version: 2.22.0+ds-2
comments: |
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/4ecb20e0186e0736bf64c03f39949af09feda999
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/4ecb20e0186e0736bf64c03f39949af09feda999
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Sun Sep 6 00:01:20 2026
From: gitlab at salsa.debian.org (Mattia Rizzolo (@mattia))
Date: Sun, 06 Sep 2026 00:01:20 +0000
Subject: [Git][reproducible-builds/reproducible-notes][master] Remove archived
bugs
Message-ID: <6a9cad50c7a2f_29a492bc6b9468351e@godard.mail>
Mattia Rizzolo pushed to branch master at Reproducible Builds / reproducible-notes
Commits:
dceceb43 by automatic commit from Mattia Rizzolo at 2026-09-06T00:00:53+00:00
Remove archived bugs
- - - - -
1 changed file:
- packages.yml
Changes:
=====================================
packages.yml
=====================================
@@ -4696,10 +4696,6 @@ ebook-tools:
issues:
- build_id_variation_requiring_further_investigation
- cmake_rpath_contains_build_path
-ecbuild:
- version: 3.15.0-2
- bugs:
- - 1143169
eccodes:
version: 2.6.0-1
issues:
@@ -4709,8 +4705,6 @@ eccodes:
- captures_build_arch_via_ecbuild
- captures_kernel_version_via_ecbuild
- records_build_flags_from_ecbuild
- bugs:
- - 1143169
ecdsautils:
version: 0.3.2+git20151018-2
issues:
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/dceceb4361dfb700e1f5e20f38c690f15c745a3c
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/dceceb4361dfb700e1f5e20f38c690f15c745a3c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Tue Sep 8 00:01:23 2026
From: gitlab at salsa.debian.org (Mattia Rizzolo (@mattia))
Date: Tue, 08 Sep 2026 00:01:23 +0000
Subject: [Git][reproducible-builds/reproducible-notes][master] Remove archived
bugs
Message-ID: <6a9f5053d9531_29a49ff99c1276144@godard.mail>
Mattia Rizzolo pushed to branch master at Reproducible Builds / reproducible-notes
Commits:
b506e82f by automatic commit from Mattia Rizzolo at 2026-09-08T00:00:56+00:00
Remove archived bugs
- - - - -
1 changed file:
- packages.yml
Changes:
=====================================
packages.yml
=====================================
@@ -14641,10 +14641,6 @@ libproxy:
version: 0.4.11-5
issues:
- gcc_captures_build_path
-libpsl:
- version: 0.23.0-1
- bugs:
- - 1142126
libpsm2:
version: 10.3.58-1
issues:
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/b506e82fad8268e62dea9bcf2ed15cfabb6205a9
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/b506e82fad8268e62dea9bcf2ed15cfabb6205a9
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Wed Sep 9 00:01:24 2026
From: gitlab at salsa.debian.org (Mattia Rizzolo (@mattia))
Date: Wed, 09 Sep 2026 00:01:24 +0000
Subject: [Git][reproducible-builds/reproducible-notes][master] Remove archived
bugs
Message-ID: <6aa0a1d4c7e84_29a49ffe7416708f0@godard.mail>
Mattia Rizzolo pushed to branch master at Reproducible Builds / reproducible-notes
Commits:
203bae62 by automatic commit from Mattia Rizzolo at 2026-09-09T00:00:58+00:00
Remove archived bugs
- - - - -
1 changed file:
- packages.yml
Changes:
=====================================
packages.yml
=====================================
@@ -32134,10 +32134,6 @@ sqlalchemy:
version: 1.4.50+ds1-1
issues:
- timestamp_in_documentation_using_sphinx_zzzeeksphinx_theme
-sqlalchemy-i18n:
- version: 1.1.0-3
- bugs:
- - 1124697
sqlite-utils:
version: 3.24-2
issues:
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/203bae62817ba3445391ee0f145e025ecbb5069f
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/203bae62817ba3445391ee0f145e025ecbb5069f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Wed Sep 9 11:05:49 2026
From: gitlab at salsa.debian.org (Chris Lamb (@lamby))
Date: Wed, 09 Sep 2026 11:05:49 +0000
Subject: [Git][reproducible-builds/reproducible-website][master] 2 commits:
2026-08: Initial draft
Message-ID: <6aa13d8df14ad_29a49ff9b017394ac@godard.mail>
Chris Lamb pushed to branch master at Reproducible Builds / reproducible-website
Commits:
5f5fa906 by Chris Lamb at 2026-09-09T12:04:37+01:00
2026-08: Initial draft
- - - - -
7f69a4f6 by Chris Lamb at 2026-09-09T12:05:06+01:00
2026-07: Fix a mismerge (?) of Bernhard's report link from the previous month's report.
- - - - -
19 changed files:
- _reports/2026-07.md
- _reports/2026-08.md
- + images/reports/2026-07/opensuse.png
- + images/reports/2026-08/debian.png
- + images/reports/2026-08/diffoscope.png
- + images/reports/2026-08/opensuse.png
- + images/reports/2026-08/openwrt-rebuilderd.png
- + images/reports/2026-08/openwrt.png
- + images/reports/2026-08/paper-2607.21888.png
- + images/reports/2026-08/paper-2607.24888.png
- + images/reports/2026-08/paper-2607.26719.png
- + images/reports/2026-08/paper-2608.18180.png
- + images/reports/2026-08/paper-2608.20678.png
- + images/reports/2026-08/paper-2608.27125.png
- + images/reports/2026-08/paper-fdroid.png
- + images/reports/2026-08/paper-snakeoil.png
- + images/reports/2026-08/paper-vcaligner.png
- + images/reports/2026-08/reproducible-builds.png
- + images/reports/2026-08/website.png
Changes:
=====================================
_reports/2026-07.md
=====================================
@@ -74,6 +74,11 @@ In addition, there is [a new page showing verification rebuilds](https://rebuild
+[![]({{ "/images/reports/2026-07/opensuse.png#right" | relative_url }})](https://www.opensuse.org/)
+
+Lastly, Bernhard M. Wiedemann posted another [**openSUSE**](https://www.opensuse.org/) [monthly update](https://lists.opensuse.org/archives/list/factory at lists.opensuse.org/thread/JLAOJP7W6K3P2SL6XT6UYX444XZ5WQPN/) for their reproducibility work there.
+
+
### Three new scholarly papers
@@ -105,8 +110,6 @@ Denise Nanni, Julien Malka, Stefano Zacchiroli and Th?o Zimmermann from [T?l?
The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where applicable or possible. This month, we wrote a large number of such patches, including:
-* [openSUSE monthly](https://lists.opensuse.org/archives/list/factory at lists.opensuse.org/thread/JLAOJP7W6K3P2SL6XT6UYX444XZ5WQPN/)
-
* Arnout Engelen:
* [`ivy`](https://github.com/apache/ant-ivy/pull/127)
=====================================
_reports/2026-08.md
=====================================
@@ -6,81 +6,240 @@ title: "Reproducible Builds in August 2026"
draft: true
---
-### Patches
+**Welcome to the August 2026 report from the [Reproducible Builds](https://reproducible-builds.org) project!**
+{: .lead}
-* Robin Candau:
+[![]({{ "/images/reports/2026-08/reproducible-builds.png#right" | relative_url }})](https://reproducible-builds.org/)
- * [`bashburn`](https://codeberg.org/aelinden/BashBurn/pulls/1)
- * [`LMMS`](https://github.com/LMMS/lmms/pull/8494)
-* [FIXME](https://arxiv.org/pdf/2607.26719)
+In our reports, we try to outline the most important things that we have been up to over the past month. As a quick recap about what problem our project intends to solve, whilst anyone may inspect the source code of free software for malicious flaws, almost all software is distributed to end users as pre-compiled binaries. The motivation behind the reproducible builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised or not.
+
+
+
+---
+
+### New updated SBOM specification from CISA.gov
+
+[CISA](https://en.wikipedia.org/wiki/Cybersecurity_and_Infrastructure_Security_Agency), the Cybersecurity and Infrastructure Security Agency of the U.S. government published some the joint guidance entitled *[Minimum Elements for a Software Bill of Materials*](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf) (SBOM), which updates and supersedes the baseline 2021 version covered in previous editions of these reports.
+
+Whilst [the PDF](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf) is worth skimming, the interesting changes include that the specification now mandates standard cryptographic hashes: unlike earlier standards that allowed hash omission or manifest-only parsing, hashes must be computed from the output. This is is important for reproducible builds, as it ensures the recording of the metadata required to demonstrate the shipped software matches the build output precisely where applicable. In addition, where the top-level only dependency limitation that was present in the 2021 version has been removed in favour of complete coverage with no minimum depth. That is, SBOMs are expected to reflect all linked libraries, vendored dependencies and other build-time inclusions.
+
+
+
+### LWN on Bootstrappable builds at FOSSY 2026
+
+In the "Toolchains and Other Development Tools" track at [Software Freedom Conservancy](https://sfconservancy.org/)'s [FOSSY 2026](https://2026.fossy.ca/) in British Columbia, Canada, Timothy Sample gave a presentation on [bootstrappable builds](https://bootstrappable.org/). This [presentation was then covered](https://lwn.net/Articles/1088279/) in a [Linux Weekly News](https://lwn.net/) article by Jake Edge entitled [*Bootstrappable builds: how and why*]https://lwn.net/Articles/1088279/*](https://lwn.net/Articles/1088279/), which serves as an excellent introduction to the concept:
+
+
+> The basic idea behind bootstrappable builds is to create a system that can be built without relying on pre-built artifacts. "Can we go from zero to the modern day without having to just assume the existence of these already-built-for-us artifacts?" The classic recipe for yogurt requires some yogurt to start the process, which is like how we normally build a C compiler today?we start with an existing C compiler binary. You might think about making sourdough bread with your grandmother's starter brought over from the old country; "we're basically making C compilers with Dennis Ritchie's starter carried over from Bell Labs".
+
+The article, which goes on to cover GNU Mes and other projects that overlap with Reproducible Builds, also has [a number of thought-provoking comments](https://lwn.net/Articles/1088279/#Comments).
+
+
+
+### "[*What's missing to have reproducible builds on PyPI?*](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/)"
+
+Core Python developer, [Brett Cannon](https://snarky.ca/) wrote an interesting blog post this month addressing [*What's missing to have reproducible builds on PyPI*](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/), the [official public repository for third-party Python software packages](https://pypi.org/):
+
+> The reason I like the idea of making reproducible builds work is that I think it can be done in such a way as to not require any work on the part of the producer of a distribution (which is a technical term for sdists or wheels, i.e., the people who upload stuff to PyPI), and thus make reproducible builds very low-friction for people to opt into supporting. [[?](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/)]
+
+Brett goes on to outline "What's missing from the specs" and how reproducibility might be visible on PyPI to consumers:
+
+Assuming all of this comes to pass and we record the where the source code is that went into a distribution and the software used to make the distribution, how do we make it useful to people? Does every person who cares about having a secure supply chain have to rebuild everything they use themselves? Is there some way for even people who don't care about this stuff to benefit? [[?](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/)]
+
+
+
+### Distribution work
+
+[![]({{ "/images/reports/2026-08/debian.png#right" | relative_url }})](https://debian.org/)
+
+In **Debian** this month, 23 reviews of Debian packages were added, 28 were updated and 27 were removed this month adding to [our knowledge about identified issues](https://tests.reproducible-builds.org/debian/index_issues.html). A number of issue types have been updated as well, such as the addition of a new toolchain issue related to `python-traitlets` [[?](https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/666e1847)], and the note for an existing issue related to `texi2html` was updated as well [[?](https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/8c55be8f)].
+
+[![]({{ "/images/reports/2026-08/opensuse.png#right" | relative_url }})](https://www.opensuse.org/)
+
+Lastly, Bernhard M. Wiedemann posted another [**openSUSE**](https://www.opensuse.org/) [monthly update](https://lists.opensuse.org/archives/list/factory at lists.opensuse.org/thread/C7BCS4OC2XPR5ZNOEXCJGP6NXL2W5BNT/) for their reproducibility work there.
+
+
+
+### Unreproducible builds under EROFS filesystem fixed
+
+[Martin Pitt](https://fosstodon.org/@martinpitt) reported on [Fosstodon](https://fosstodon.org/) that they had [identified an issue](https://fosstodon.org/@martinpitt/117034829700534836) where the `mkfs` ("make filesystem") command for the [EROFS](https://en.wikipedia.org/wiki/EROFS) (Enhanced Read-Only File System) subsystem of the Linux kernel did not have sorted [extended file attributes](https://en.wikipedia.org/wiki/Extended_file_attributes), leading to reproducible builds.
+
+Thankfully, Martin also reported that [they had fixed this in a commit to the kernel](https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/commit/?id=37fc4113694e1c9690bd871aefe91f55bf8bd029) which "order[s] each inode's xattrs by name so that images stay reproducible". [[?](https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/commit/?id=37fc4113694e1c9690bd871aefe91f55bf8bd029)]
+
+
+
+### Tool and documentation development
+
+[![]({{ "/images/reports/2026-87/diffoscope.png#right" | relative_url }})](https://diffoscope.org/)
+
+[**diffoscope**](https://diffoscope.org) is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb made a number of chnages, including preparing and uploading versions `327`, `328` and `329` to Debian. In particular, he ensured that *diffoscope* did not require *python3-guestfs* in the autopkgtests on 32-bit architectures in order to fix Debian bug ([#1144372](https://bugs.debian.org/1144372)) [[?](https://salsa.debian.org/reproducible-builds/diffoscope/commit/5440dd50)]. Colin Watson made an additional change, handling a potentially missing `openssh-client` package when running the autopkgtests [[?](https://salsa.debian.org/reproducible-builds/diffoscope/commit/a4fd009a)], and Jochen Sprickerhof made a similar change to cope with missing `cpio` and `qemu-img` functionality [[?](https://salsa.debian.org/reproducible-builds/diffoscope/commit/ae4f6f86)] whilst also updating the XML comparator to be considered when comparing SVG images [[?](https://salsa.debian.org/reproducible-builds/diffoscope/commit/c7f23bb0)].
+
+
+
-* [FIXME](https://books.google.com/books?hl=en&lr=&id=R7D6EQAAQBAJ&oi=fnd&pg=PA384&ots=MJAMLO7kQN&sig=74sOyxudlFmOhNSyF8TpyePlYsQ#v=onepage&q&f=false)
+[![]({{ "/images/reports/2026-08/website.png#right" | relative_url }})]({{ "/" | relative_url }})
-* [FIXME](https://arxiv.org/pdf/2607.24888)
+Yet again, there were a number of improvements made to [**our website**]({{ "/" | relative_url }}) this month as well. For example:
-* [FIXME](https://arxiv.org/pdf/2607.21888)
+* Chris Lamb added added draft for a [Gothenburg summit](https://reproducible-builds.org/news/2026/08/12/reproducible-builds-summit-in-gothenburg/)-related news article. [[?](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/126f1774)][[?](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/194c4f24)]
-* [FIXME](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf)
+* Holger Levsen then published [the same article](https://reproducible-builds.org/news/2026/08/12/reproducible-builds-summit-in-gothenburg/). [[?](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/12265a52)][[?](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/3be2ff73)]
-* [Unsorted xattrs made erofs builds unreproducible across host file systems](https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/commit/?id=b260119b8edba42af444e8f782c81acc0624dcdb)
+* Lastly, a large number of commits were pushed comprising an interview with Reproducible Builds developer Jochen Sprickerhof to be published within the next week. [[?](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/22f405e8)][[?](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/f11b768a)][[?](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/953236c7)][[?](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/60aa39b1)][[?](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/0eb0aa3c)][[?](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/53682fea)][[?](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/11cd8461)]
-* [FIXME](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/)
+
-* [FIXME](https://dl.acm.org/doi/pdf/10.1145/3820755.3821482)
+### Six new scholarly papers
-* [FIXME](https://arxiv.org/pdf/2608.18180)
+[![]({{ "/images/reports/2026-08/paper-2607.21888.png#right" | relative_url }})](https://arxiv.org/abs/2607.21888)
-* [LWN FOSSY bootstrappable](https://lwn.net/Articles/1088279/)
+Jens Dietrich, Spencer Sun, Tim W. White and Behnaz Hassanshahi (the result of a collaboration between [Victoria University of Wellington](https://www.wgtn.ac.nz/) and [Oracle Australia](https://www.oracle.com/anz/) published a paper this month entitled [*No Snake Oil: Verifying Python Package Builds*](https://arxiv.org/abs/2607.21888). Drawing on the metaphor of "snake oil", that is, a fake or ineffective medicine or solution sold with exaggerated claims of curing or fixing everything, the authors write that
-* [openSUSE monthly](https://lists.opensuse.org/archives/list/factory at lists.opensuse.org/thread/C7BCS4OC2XPR5ZNOEXCJGP6NXL2W5BNT/)
+> Two tools that are designed to automate [PyPI] rebuilds and run them at scale are `macaron` and `oss-rebuild`. We study 12,180 popular releases from PyPI and find that the byte-for-byte equivalence rate is generally low. We analyse the reasons why they produce different wheels, and find that equivalence between the original and rebuilt wheels can often still be established, preserving most of the guarantees users expect from rebuildable releases. **We present and evaluate daleq4py, a tool to establish the equivalence of Python wheels through the kernel of a normalisation function that is based on provenance-preserving datalog rules. Experimental results show that daleq4py substantially expands the set of rebuilds that can be accepted as equivalent.**
+
+The [full PDF of their paper](https://arxiv.org/pdf/2607.21888) can be viewed online, and Jens Dietrich to [our mailing list](https://lists.reproducible-builds.org/listinfo/rb-general/) to [announce the availability](https://lists.reproducible-builds.org/pipermail/rb-general/2026-August/004146.html) of both the paper and the [`daleq4py` tool](https://github.com/binaryeq/daleq4py/) itself.
+
+
+
+[![]({{ "/images/reports/2026-08/paper-2607.26719.png#right" | relative_url }})](https://arxiv.org/abs/2607.26719)
+
+Dimitri Kokkonis, Micha?l Marcozzi and Stefano Zacchiroli published an article this month titled [*Not In My Git Yard: Catching Backdoors at Commit and Release Time*](https://arxiv.org/abs/2607.26719) on the topic of "code-level backdoors" ? that is, "stealthy code changes that grant hidden privileges via secret triggers". These issues:
+
+> ? pose a persistent threat to opensource software. Known attempts to inject such backdoors into widely used projects through malicious commits, tampered release packages, or compromised third-party dependencies, were stopped only by luck and manual review. Existing Continuous Integration (CI) pipelines cannot detect these attacks, and downstream binary analysis tools require substantial manual effort. **In this work, we present Lily, an automated approach that strengthens open-source development and release processes against backdoor injection. Lily integrates a backdoor detection mechanism into (1) CI pipelines to block malicious commits, and (2) release vetting workflows to prevent tampered releases or compromised dependencies from entering large ecosystems, such as Linux distributions.**
+
+The [full PDF](https://arxiv.org/pdf/2607.26719) can be read online.
+
+
+
+[![]({{ "/images/reports/2026-08/paper-2608.20678.png#right" | relative_url }})](https://arxiv.org/abs/2608.20678)
+
+Ranindya Paramitha and Laurie Williams of North Carolina State University along with Christian K?stner of Carnegie Mellon University published a paper this month with the title of [*The Software Supply Chain as a Market for Lemons: A Multivocal Review of Trust Signal Collapse*](https://arxiv.org/abs/2608.20678). (A ["lemon"](https://en.wikipedia.org/wiki/Lemon_(automobile)) in American English, is a vehicle that "turns out to have several manufacturing defects".) Their abstract is as follows:
+
+> Practitioners evaluating open-source dependencies rely on cheap trust signals, e.g., stars, download counts, and contributor activity, as substitutes for direct code inspection, assuming those signals reflect genuine trustworthiness. Prior work has documented individual signal gaming, but the landscape of collapses across all dependency-adoption signals, as well as the ecosystem?s response, remains unexplored. **The goal of this study is to aid software practitioners in understanding the reliability of dependency adoption trust signals, such as download counts and contributor activity, by conducting a multivocal review of 252 Google Search sources and 870 Reddit threads.**
+
+Worryingly, after their review, the authors conclude that "cheap trust signals collapse under three simultaneous forces: adversarial manipulation, gaming techniques indistinguishable from legitimate behavior, and non-adversarial AI-driven inflation."
+
+The [full PDF of the paper](https://arxiv.org/pdf/2608.20678) is available online.
+
+
+
+[![]({{ "/images/reports/2026-08/paper-2607.24888.png#right" | relative_url }})](https://arxiv.org/abs/2607.24888)
+
+Julien Malka, Aman Sharma, Martin Monperrus, Stefano Zacchiroli and Th?o Zimmermann published a paper this month on [*Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation*](https://arxiv.org/abs/2607.24888):
+
+> [Ken Thompson's trusting-trust attack](https://en.wikipedia.org/wiki/Backdoor_(computing)#Compiler_backdoors), in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regarded as a threat specific to compilers. We show that it is not. **We construct a complete trusting-trust attack around GNU *strip*, an ordinary build utility that neither inspects nor generates source code, using only manipulations of finished ELF files.**
+
+Scarily, in the authors' example, "a single tampered *strip* in the binary seed implants a payload that propagates from one generation of strip to the next and survives into the final standard environment after the seed leaves the dependency closure [?] without failures and backdoors".
+
+A [full PDF of the paper](https://arxiv.org/pdf/2607.24888) is available for download online.
+
+
+
+[![]({{ "/images/reports/2026-08/paper-2608.27125.png#right" | relative_url }})](https://arxiv.org/abs/2608.27125)
+
+Mehdi Keshanimm, Amirhossein Rahmati, Mohammad Hossein Aref and Abbas Heydarnoori published a paper that is currently under review at *Emperical Software Engineering* titled [*AROMA+: A Study of Factors Affecting Reproducible Builds in the Maven Ecosystem*](https://arxiv.org/abs/2608.27125). ([Maven](https://maven.apache.org/) is a/the build automation tool used for Java projects.) In their paper, the authors note that
+
+> [?] reusing external software in a project presents a security risk when the source of the component is unknown or the consistency of a component cannot be verified. The [SolarWinds attack](https://en.wikipedia.org/wiki/SolarWinds#2019%E2%80%932020_supply_chain_attacks) serves as a popular example in which the injection of malicious code into a library affected thousands of customers and caused a loss of billions of dollars. [?] Our research aims to support [reproducibility] efforts in the Maven ecosystem through automation. We investigate the feasibility of automatically finding the source code of a library from its Maven release and recovering information about the original release environment. Our tool, AROMA+, can obtain this critical information from the artifact and the source repository through several heuristics and we use the results for reproduction attempts of packages on Maven Central.
+
+The [full PDF of their article](https://arxiv.org/pdf/2608.27125) can be downloaded online.
+
+
+
+[![]({{ "/images/reports/2026-08/paper-2608.18180.png#right" | relative_url }})](https://arxiv.org/abs/2608.18180)
+
+Lastly, Oreofe Solarin, Kelechi Kalu, James C. Davis and Paschal Amusuo published a paper this month titled [*Reproducibility is Not Enough: Artifact Verifiability in Decentralized-Build Package Ecosystems*](https://arxiv.org/abs/2608.18180):
+
+> [A]rtifact verification requires more than deterministic builds: a verifier must also recover the source state, build environment, dependencies, and build instructions that produced the artifact. Decentralized-build ecosystems make this difficult because artifacts are produced through heterogeneous tools, maintainer-controlled workflows, and fragmented metadata. As a result, it remains unclear how often artifacts in these ecosystems can be independently verified. **This paper studies artifact verifiability across four popular decentralized-build package ecosystems. We define an independent verifier model that relies only on registry-derivable metadata and an artifact comparison model with tiered equivalence levels. We implement these models in an Artifact Verification Pipeline and use it to measure artifact verifiability across the target ecosystems.**
+
+The authors conclude that "beyond build determinism, verifiability is limited by missing source and build metadata, implicit release transformations, and unconventional build practices".
+
+A [PDF](https://arxiv.org/pdf/2608.18180) of their paper can be reviewed online.
+
+
+
+### Patches
+
+The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where applicable or possible. This month, we wrote a large number of such patches, including:
* Bernhard M. Wiedemann:
- * [`python-pook`](https://build.opensuse.org/request/show/1369446) (nocheck)
- * [`python-pyzmq`](https://build.opensuse.org/request/show/1369499) (random tmp path)
- * [`java-21-openj9`](https://build.opensuse.org/request/show/1369973) (date)
- * [`java-25-openj9`](https://build.opensuse.org/request/show/1369976) (date)
- * [`ceph`](https://build.opensuse.org/request/show/1370073) (zip mtime)
- * [`gri`](https://build.opensuse.org/request/show/1370260) (ps timestamp)
- * [`ksh`](https://build.opensuse.org/request/show/1370294) (date+memory)
- * [`gputils/sdcc`](https://build.opensuse.org/request/show/1370297) (toolchain date)
- * [`python-langgraph`](https://build.opensuse.org/request/show/1371636) (nocheck)
- * [`sbcl`](https://build.opensuse.org/request/show/1371634) (date ; CPU ; partial fix)
- * [`python-xgrammar`](https://build.opensuse.org/request/show/1371724) (.a LTO wheel RECORD)
- * [`mingw64-filesystem`](https://build.opensuse.org/request/show/1371702) (toolchain, race)
- * [`Rivet`](https://build.opensuse.org/request/show/1371954) (parallelism, random)
- * [`python-PyMuPDF`](https://build.opensuse.org/request/show/1373241) (random + ar mtime)
- * [`git-annex`](https://build.opensuse.org/request/show/1373692) (bug)
- * [`maxima`](https://build.opensuse.org/request/show/1373751) (bug)
- * [`python-gguf`](https://build.opensuse.org/request/show/1373864) (nocheck)
- * [`python-xlsx2csv`](https://build.opensuse.org/request/show/1373248) (date)
- * [`scons`](https://build.opensuse.org/request/show/1374393) (toolchain, date for nst)
- * [`llvm22`](https://build.opensuse.org/request/show/1374284) (#https://github.com/llvm/llvm-project/pull/219380 toolchain for cosmic-bg, random hash)
- * [`qt6-tools`](https://build.opensuse.org/request/show/1370201) (toolchain for qt6-base )
- * [`Botan`](https://bugzilla.opensuse.org/show_bug.cgi?id=1274324) (FTBFS-2029)
- * [`gcc/esbuild`](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108534#c3) (toolchain)
- * [`go1.27/esbuild`](https://build.opensuse.org/request/show/1373163) (toolchain, random, [upstreaming](https://github.com/golang/go/pull/81041))
- * [`obs`](https://github.com/openSUSE/obs-build/pull/1164) (toolchain for altimagebuild)
- * [`lutgen`](https://github.com/ozwaldorf/lutgen-rs/pull/46) (nocheck)
- * [`virtualbox`](https://github.com/VirtualBox/virtualbox/pull/827) (random UUID, fix 1/3)
- * [`zabbix`](https://github.com/zabbix/zabbix/pull/184) (date)
- * [`grass`](https://github.com/OSGeo/grass/pull/7849) (date/mtime)
- * [`fritzing`](https://github.com/fritzing/fritzing-app/pull/4336) (random)
- * [`xpenguins`](https://gitlab.com/wvermin/xpenguins/-/merge_requests/1) (date)
- * [`llvm`](https://github.com/llvm/llvm-project/pull/219384) (toolchain, random hash)
- * [`llvm`](https://github.com/llvm/llvm-project/pull/219388) (toolchain, random hash)
- * [`efl`](https://git.enlightenment.org/enlightenment/efl/pulls/148) (toolchain, bug / hash collision / mem-reuse)
- * [`dmd`](https://github.com/dlang/dmd/pull/23746) (sort ASLR)
- * [`neochat`](https://invent.kde.org/network/neochat/-/merge_requests/2987) (race qmlcachegen)
- * [`cosmic/xdgen`](https://github.com/pop-os/xdgen/pull/2) (toolchain, hash for cosmic-*)
- * [`dvgt`](https://build.opensuse.org/request/show/1374399) (date from toolchain tex)
- * [`cpio`](https://build.opensuse.org/request/show/1374640) (mtime + unrelated bug)
- * [`boost`](https://build.opensuse.org/request/show/1374641) (race + y2038)
- * [`firefox-esr`](https://build.opensuse.org/request/show/1375163) (PGO)
+ * [`Botan`](https://bugzilla.opensuse.org/show_bug.cgi?id=1274324)
+ * [`Rivet`](https://build.opensuse.org/request/show/1371954)
+ * [`boost`](https://build.opensuse.org/request/show/1374641)
+ * [`ceph`](https://build.opensuse.org/request/show/1370073)
+ * [`cosmic/xdgen`](https://github.com/pop-os/xdgen/pull/2)
+ * [`cpio`](https://build.opensuse.org/request/show/1374640)
+ * [`dmd`](https://github.com/dlang/dmd/pull/23746)
+ * [`dvgt`](https://build.opensuse.org/request/show/1374399)
+ * [`efl`](https://git.enlightenment.org/enlightenment/efl/pulls/148)
+ * [`firefox-esr`](https://build.opensuse.org/request/show/1375163)
+ * [`fritzing`](https://github.com/fritzing/fritzing-app/pull/4336)
+ * [`gcc/esbuild`](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108534#c3)
+ * [`git-annex`](https://build.opensuse.org/request/show/1373692)
+ * [`go1.27/esbuild`](https://build.opensuse.org/request/show/1373163)
+ * [`gputils/sdcc`](https://build.opensuse.org/request/show/1370297)
+ * [`grass`](https://github.com/OSGeo/grass/pull/7849)
+ * [`gri`](https://build.opensuse.org/request/show/1370260)
+ * [`java-21-openj9`](https://build.opensuse.org/request/show/1369973)
+ * [`java-25-openj9`](https://build.opensuse.org/request/show/1369976)
+ * [`ksh`](https://build.opensuse.org/request/show/1370294)
+ * [`llvm22`](https://build.opensuse.org/request/show/1374284)
+ * [`llvm`](https://github.com/llvm/llvm-project/pull/219384)
+ * [`llvm`](https://github.com/llvm/llvm-project/pull/219388)
+ * [`lutgen`](https://github.com/ozwaldorf/lutgen-rs/pull/46)
+ * [`maxima`](https://build.opensuse.org/request/show/1373751)
+ * [`mingw64-filesystem`](https://build.opensuse.org/request/show/1371702)
+ * [`neochat`](https://invent.kde.org/network/neochat/-/merge_requests/2987)
+ * [`obs`](https://github.com/openSUSE/obs-build/pull/1164)
+ * [`python-PyMuPDF`](https://build.opensuse.org/request/show/1373241)
+ * [`python-gguf`](https://build.opensuse.org/request/show/1373864)
+ * [`python-langgraph`](https://build.opensuse.org/request/show/1371636)
+ * [`python-pook`](https://build.opensuse.org/request/show/1369446)
+ * [`python-pyzmq`](https://build.opensuse.org/request/show/1369499)
+ * [`python-xgrammar`](https://build.opensuse.org/request/show/1371724)
+ * [`python-xlsx2csv`](https://build.opensuse.org/request/show/1373248)
+ * [`qt6-tools`](https://build.opensuse.org/request/show/1370201)
+ * [`sbcl`](https://build.opensuse.org/request/show/1371634)
+ * [`scons`](https://build.opensuse.org/request/show/1374393)
+ * [`virtualbox`](https://github.com/VirtualBox/virtualbox/pull/827)
+ * [`xpenguins`](https://gitlab.com/wvermin/xpenguins/-/merge_requests/1)
+ * [`zabbix`](https://github.com/zabbix/zabbix/pull/184)
+
+* Chris Lamb:
+
+ * [#1143615](https://bugs.debian.org/1143615) filed against [`keychain`](https://tracker.debian.org/pkg/keychain).
+ * [#1143616](https://bugs.debian.org/1143616) filed against [`python-nameparser`](https://tracker.debian.org/pkg/python-nameparser).
+ * [#1143617](https://bugs.debian.org/1143617) filed against [`lcov`](https://tracker.debian.org/pkg/lcov).
+ * [#1144065](https://bugs.debian.org/1144065) filed against [`displaycal-py3`](https://tracker.debian.org/pkg/displaycal-py3).
+ * [#1144066](https://bugs.debian.org/1144066) filed against [`redmine`](https://tracker.debian.org/pkg/redmine).
+ * [#1144407](https://bugs.debian.org/1144407) filed against [`django-htmx`](https://tracker.debian.org/pkg/django-htmx).
+ * [#1144409](https://bugs.debian.org/1144409) filed against [`pybdsf`](https://tracker.debian.org/pkg/pybdsf).
+ * [#1145914](https://bugs.debian.org/1145914) filed against [`golang-github-adamkorcz-go-fuzz-headers-1`](https://tracker.debian.org/pkg/golang-github-adamkorcz-go-fuzz-headers-1).
+ * [#1145915](https://bugs.debian.org/1145915) filed against [`googletest`](https://tracker.debian.org/pkg/googletest).
+
+* Jochen Sprickerhof:
+
+ * [#1145443](https://bugs.debian.org/1145443) filed against [`cross-toolchain-base`](https://tracker.debian.org/pkg/cross-toolchain-base).
+ * [#1146088](https://bugs.debian.org/1146088) filed against [`ferret-vis`](https://tracker.debian.org/pkg/ferret-vis).
+
+* Robin Candau:
+
+ * [`bashburn`](https://codeberg.org/aelinden/BashBurn/pulls/1)
+ * [`LMMS`](https://github.com/LMMS/lmms/pull/8494)
+
* Werner Fink:
+
* [`bash`](https://build.opensuse.org/request/show/1364197)
-* [FIXME](https://arxiv.org/pdf/2608.20678)
+
+
-* [FIXME](https://arxiv.org/pdf/2608.27125)
+If you are interested in contributing to the project, please visit our [*Contribute*]({{ "/contribute/" | relative_url }}) page on our website.
+{: .small}
=====================================
images/reports/2026-07/opensuse.png
=====================================
Binary files /dev/null and b/images/reports/2026-07/opensuse.png differ
=====================================
images/reports/2026-08/debian.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/debian.png differ
=====================================
images/reports/2026-08/diffoscope.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/diffoscope.png differ
=====================================
images/reports/2026-08/opensuse.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/opensuse.png differ
=====================================
images/reports/2026-08/openwrt-rebuilderd.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/openwrt-rebuilderd.png differ
=====================================
images/reports/2026-08/openwrt.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/openwrt.png differ
=====================================
images/reports/2026-08/paper-2607.21888.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-2607.21888.png differ
=====================================
images/reports/2026-08/paper-2607.24888.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-2607.24888.png differ
=====================================
images/reports/2026-08/paper-2607.26719.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-2607.26719.png differ
=====================================
images/reports/2026-08/paper-2608.18180.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-2608.18180.png differ
=====================================
images/reports/2026-08/paper-2608.20678.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-2608.20678.png differ
=====================================
images/reports/2026-08/paper-2608.27125.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-2608.27125.png differ
=====================================
images/reports/2026-08/paper-fdroid.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-fdroid.png differ
=====================================
images/reports/2026-08/paper-snakeoil.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-snakeoil.png differ
=====================================
images/reports/2026-08/paper-vcaligner.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-vcaligner.png differ
=====================================
images/reports/2026-08/reproducible-builds.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/reproducible-builds.png differ
=====================================
images/reports/2026-08/website.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/website.png differ
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/compare/7e141852c0b9519934f6ddda34e79a37cbf9de3a...7f69a4f6a60dafd5833f3facc4fe40257900adb6
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/compare/7e141852c0b9519934f6ddda34e79a37cbf9de3a...7f69a4f6a60dafd5833f3facc4fe40257900adb6
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Wed Sep 9 12:30:19 2026
From: gitlab at salsa.debian.org (kpcyrd (@kpcyrd))
Date: Wed, 09 Sep 2026 12:30:19 +0000
Subject: [Git][reproducible-builds/reproducible-website][master] 2026-08: Fix
markdown link
Message-ID: <6aa1515b8f040_29a49ffc58175628f@godard.mail>
kpcyrd pushed to branch master at Reproducible Builds / reproducible-website
Commits:
b9125675 by kpcyrd at 2026-09-09T14:29:38+02:00
2026-08: Fix markdown link
- - - - -
1 changed file:
- _reports/2026-08.md
Changes:
=====================================
_reports/2026-08.md
=====================================
@@ -34,7 +34,7 @@ Whilst [the PDF](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom
### LWN on Bootstrappable builds at FOSSY 2026
-In the "Toolchains and Other Development Tools" track at [Software Freedom Conservancy](https://sfconservancy.org/)'s [FOSSY 2026](https://2026.fossy.ca/) in British Columbia, Canada, Timothy Sample gave a presentation on [bootstrappable builds](https://bootstrappable.org/). This [presentation was then covered](https://lwn.net/Articles/1088279/) in a [Linux Weekly News](https://lwn.net/) article by Jake Edge entitled [*Bootstrappable builds: how and why*]https://lwn.net/Articles/1088279/*](https://lwn.net/Articles/1088279/), which serves as an excellent introduction to the concept:
+In the "Toolchains and Other Development Tools" track at [Software Freedom Conservancy](https://sfconservancy.org/)'s [FOSSY 2026](https://2026.fossy.ca/) in British Columbia, Canada, Timothy Sample gave a presentation on [bootstrappable builds](https://bootstrappable.org/). This [presentation was then covered](https://lwn.net/Articles/1088279/) in a [Linux Weekly News](https://lwn.net/) article by Jake Edge entitled [*Bootstrappable builds: how and why*](https://lwn.net/Articles/1088279/*](https://lwn.net/Articles/1088279/), which serves as an excellent introduction to the concept:
> The basic idea behind bootstrappable builds is to create a system that can be built without relying on pre-built artifacts. "Can we go from zero to the modern day without having to just assume the existence of these already-built-for-us artifacts?" The classic recipe for yogurt requires some yogurt to start the process, which is like how we normally build a C compiler today?we start with an existing C compiler binary. You might think about making sourdough bread with your grandmother's starter brought over from the old country; "we're basically making C compilers with Dennis Ritchie's starter carried over from Bell Labs".
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/b912567550d3856bc743e4b8cd611c8c30e6fb71
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/b912567550d3856bc743e4b8cd611c8c30e6fb71
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Wed Sep 9 12:46:17 2026
From: gitlab at salsa.debian.org (Holger Levsen (@holger))
Date: Wed, 09 Sep 2026 12:46:17 +0000
Subject: [Git][reproducible-builds/reproducible-notes][master] drop
blacklisted_on_jenkins_armhf_only issue as we dont test on armhf on trbo
anymore
Message-ID: <6aa15519bd3dc_29a4997c078c1760454@godard.mail>
Holger Levsen pushed to branch master at Reproducible Builds / reproducible-notes
Commits:
4505d203 by Holger Levsen at 2026-09-09T14:46:08+02:00
drop blacklisted_on_jenkins_armhf_only issue as we dont test on armhf on trbo anymore
Signed-off-by: Holger Levsen
- - - - -
2 changed files:
- issues.yml
- packages.yml
Changes:
=====================================
issues.yml
=====================================
@@ -184,14 +184,6 @@ blacklisted_on_jenkins:
their build hangs, takes too long, spawns processes that are not killed, or
simply because they use too many resources for our current capacity. (This
is purely practical step - we would like to test these packages.)
-blacklisted_on_jenkins_armhf_only:
- description: |
- Some packages have been blacklisted only on armhf in our test infrastructure
- because their builds take too long on the tiny armhf boards we're using.
- The mitigation against this is to add more architectures or to wait until
- we test against the debian archive, when it will become sensible to raise
- the 18h timeout for a single build.
- Until his happens, please rely on the amd64, i386 and arm64 tests.
diffoscope_runs_forever:
url: https://reproducible.debian.net/index_breakages.html
description: |
=====================================
packages.yml
=====================================
@@ -131,7 +131,6 @@ acl2:
Update 2017-04-28: tried 7.2dfsg-3 on testing/amd64 and the first build was autokilled after 18h? (so blacklisted again)
issues:
- blacklisted_on_jenkins
- - blacklisted_on_jenkins_armhf_only
acmetool:
version: 0.0.51-1
issues:
@@ -240,8 +239,6 @@ agda:
version: 2.5.3-3
comments: |
.agdai files seem to be unreproducible... are they "just" renamed .i files?
- issues:
- - blacklisted_on_jenkins_armhf_only
age:
version: 1.0.0~rc1-1
issues:
@@ -2542,8 +2539,6 @@ ceph:
version: 10.2.5-7.2
comments: |
Non-deterministic order of dh_installinit snippet in postinst etc.
- issues:
- - blacklisted_on_jenkins_armhf_only
ceres-solver:
version: 1.11.0~dfsg0-5
issues:
@@ -2687,11 +2682,8 @@ chromium:
version: 81.0.4044.92-1
issues:
- ftbfs_due_to_f-file-prefix-map
- - blacklisted_on_jenkins_armhf_only
chromium-browser:
version: 48.0.2564.82-2
- issues:
- - blacklisted_on_jenkins_armhf_only
chron:
version: 2.3-47-2
issues:
@@ -3171,7 +3163,6 @@ commons-math3:
First build on armhf ran into a timeout after 18h - thus blacklisted.
issues:
- random_order_in_documentation_generated_by_javadoc
- - blacklisted_on_jenkins_armhf_only
commons-vfs:
version: 2.0-7
comments: |
@@ -3527,8 +3518,6 @@ ctfutils:
- gcc_captures_build_path
cthreadpool:
version: 0.0+git20170424-2
- issues:
- - blacklisted_on_jenkins_armhf_only
ctpp2:
version: 2.8.3-19
issues:
@@ -3864,8 +3853,6 @@ dbus:
- nondeterminstic_todo_identifiers_in_documentation_generated_by_doxygen
dbus-cpp:
version: 5.0.1-5
- issues:
- - blacklisted_on_jenkins_armhf_only
dbus-java:
version: 2.8-6
issues:
@@ -4308,7 +4295,6 @@ doc-linux-fr:
First build on armhf succeeded, but 2nd one was killed after 37h in total? thus blacklisted.
issues:
- timestamps_in_manpages_generated_by_docbook_xsl
- - blacklisted_on_jenkins_armhf_only
- timestamps_in_pdf_generated_by_apache_fop
- timestamps_in_ps_generated_by_dvips
- different_encoding
@@ -4316,8 +4302,6 @@ docbook-defguide:
version: 2.0.17+svn9912-1
comments: |
First build on armhf was killed after 18h?
- issues:
- - blacklisted_on_jenkins_armhf_only
docbook-xsl-saxon:
version: 1.00.dfsg.1-7
issues:
@@ -4754,7 +4738,6 @@ eclipse:
First build on armhf ran into a timeout after 18h - thus blacklisted.
issues:
- timestamps_in_jar
- - blacklisted_on_jenkins_armhf_only
eclipse-aether:
version: 1.0.2-1
issues:
@@ -4789,8 +4772,6 @@ eclipse-wtp:
version: 3.6.0-1
comments: |
Blacklisted on armhf because a (single) build takes more than 18h?
- issues:
- - blacklisted_on_jenkins_armhf_only
eclipselink:
version: 2.5.1-4
issues:
@@ -4857,8 +4838,6 @@ eggdrop:
- records_build_flags
eigen3:
version: 3.3~beta1-2
- issues:
- - blacklisted_on_jenkins_armhf_only
eiskaltdcpp:
version: 2.4.2-1
issues:
@@ -5670,12 +5649,8 @@ fiona:
- random_hashes_in_cython_output
firefox:
version: 47.0.1-1
- issues:
- - blacklisted_on_jenkins_armhf_only
firefox-esr:
version: 52.3.0esr-2
- issues:
- - blacklisted_on_jenkins_armhf_only
firehol:
version: 2.0.1+ds-1
comments: |
@@ -5721,8 +5696,6 @@ flameshot:
- build_id_differences_only
flang:
version: 20181226-2
- issues:
- - blacklisted_on_jenkins_armhf_only
flann:
version: 1.8.4-4.1
issues:
@@ -6120,8 +6093,6 @@ freediameter:
- cmake_rpath_contains_build_path
freedict:
version: 2014.10.22-2
- issues:
- - blacklisted_on_jenkins_armhf_only
freedroidrpg:
version: 0.15.1-1
issues:
@@ -6727,7 +6698,6 @@ gcc-mingw-w64:
version: 17
issues:
- captures_shell_variable_in_autofoo_script
- - blacklisted_on_jenkins_armhf_only
- paths_vary_due_to_usrmerge
gcc-msp430:
version: 4.6.3~mspgcc-20120406-7
@@ -6756,7 +6726,6 @@ gcc-snapshot:
updating the gcc-X packages, so no big deal.
issues:
- blacklisted_on_jenkins
- - blacklisted_on_jenkins_armhf_only
gcc-xtensa-lx106:
version: 9
issues:
@@ -7079,8 +7048,6 @@ ghc:
find debian/tmp/usr/share/doc/ghc-doc $(FILES) > debian/ghc-doc.install
find debian/tmp/usr/lib/ghc-doc $(FILES) >> debian/ghc-doc.install
endif
- issues:
- - blacklisted_on_jenkins_armhf_only
ghc-testsuite:
version: 7.8.4-1
comments: |
@@ -8702,8 +8669,6 @@ gromacs:
version: 5.1.2-1
comments: |
Randomness in Doxygen graph.
- issues:
- - blacklisted_on_jenkins_armhf_only
gromit:
version: 20041213-9
issues:
@@ -8726,7 +8691,6 @@ groovy:
version: 1.8.6-4
issues:
- timestamps_in_documentation_generated_by_groovydoc
- - blacklisted_on_jenkins_armhf_only
gross:
version: 1.0.2-4
issues:
@@ -9369,8 +9333,6 @@ haskell-gi-gobject:
- haskell_abi_hash_differences
haskell-gi-gtk:
version: 3.0.36-1
- issues:
- - blacklisted_on_jenkins_armhf_only
haskell-gi-pango:
version: 1.0.26-1
issues:
@@ -11364,8 +11326,6 @@ julia:
.
main binary package: Inconclusive: there are differences, but it is unknown whether they are
fallout of the above issue or independent.
- issues:
- - blacklisted_on_jenkins_armhf_only
juman:
version: 7.0-3.2
comments: |
@@ -14736,7 +14696,6 @@ libreoffice:
lack of support in dh_strip_nondeterminism
issues:
- - blacklisted_on_jenkins_armhf_only
- random_order_in_documentation_generated_by_javadoc
bugs:
- 1065448
@@ -15368,7 +15327,6 @@ linux:
Build path captured in CONFIG_SYSTEM_TRUSTED_KEYS in various fiels in linux-headers-X.Y.Z packages, via use of CURDIR
https://sources.debian.org/src/linux/6.1.20-2/debian/bin/gencontrol.py/#L595
issues:
- - blacklisted_on_jenkins_armhf_only
- randomness_in_documentation_generated_by_sphinx
- gcc_captures_build_path
- build_path_captured_in_assembly_objects
@@ -15469,8 +15427,6 @@ lltsv:
- randomness_in_binaries_generated_by_golang
llvm-toolchain-11:
version: 1:11.0.1~+rc1-1~exp1
- issues:
- - blacklisted_on_jenkins_armhf_only
llvm-toolchain-14:
version: 1:14.0.0~+rc4-1
issues:
@@ -15480,28 +15436,18 @@ llvm-toolchain-3.7:
version: 1:3.7.1-1
issues:
- timestamps_in_documentation_generated_by_groff
- - blacklisted_on_jenkins_armhf_only
llvm-toolchain-3.8:
version: 1:3.8-1
- issues:
- - blacklisted_on_jenkins_armhf_only
llvm-toolchain-3.9:
version: 1:3.9-1
- issues:
- - blacklisted_on_jenkins_armhf_only
llvm-toolchain-4.0:
version: 1:4.0-1
- issues:
- - blacklisted_on_jenkins_armhf_only
llvm-toolchain-9:
version: 1:9.0.1-8
issues:
- ftbfs_due_to_f-file-prefix-map
- - blacklisted_on_jenkins_armhf_only
llvm-toolchain-snapshot:
version: 1:3.8~svn254193-1
- issues:
- - blacklisted_on_jenkins_armhf_only
llvmlite:
version: 0.15.0+git20161228.95d8c7c-2
issues:
@@ -16114,8 +16060,6 @@ mame:
version: 0.182-1
comments: |
Need to sort here http://sources.debian.net/src/mame/0.176-3/src/lib/util/options.cpp/#L492
- issues:
- - blacklisted_on_jenkins_armhf_only
manderlbot:
version: 0.9.2-19
issues:
@@ -16774,8 +16718,6 @@ mlt:
- cmake_rpath_contains_build_path
mlton:
version: 20180207-1
- issues:
- - blacklisted_on_jenkins_armhf_only
mm:
version: 1.4.2-5
issues:
@@ -17539,7 +17481,6 @@ nbdkit:
version: 1.26.5-1
issues:
- records_build_flags
- - blacklisted_on_jenkins_armhf_only
nbibtex:
version: 0.9.18-11
issues:
@@ -19832,8 +19773,6 @@ openexr-viewers:
- gcc_captures_build_path
openfoam:
version: 1906.191111+dfsg1-2
- issues:
- - blacklisted_on_jenkins_armhf_only
opengm:
version: 2.3.6+20160131-2
issues:
@@ -19873,8 +19812,6 @@ openjade:
- gcc_captures_build_path
openjdk-11:
version: 11.0.4+11-1
- issues:
- - blacklisted_on_jenkins_armhf_only
openjdk-27:
version: 27~30ea-1
issues:
@@ -20040,8 +19977,6 @@ openstack-trove:
- randomness_in_documentation_generated_by_sphinx
openstructure:
version: 2.2.0-3
- issues:
- - blacklisted_on_jenkins_armhf_only
opensubdiv:
version: 3.4.0-6
issues:
@@ -20076,7 +20011,6 @@ openturns:
https://sources.debian.net/src/openturns/1.5-7/lib/include/CMakeLists.txt/#L29
issues:
- randomness_in_r_rdb_rds_databases
- - blacklisted_on_jenkins_armhf_only
openvas-cli:
version: 1.4.4-1
issues:
@@ -20104,8 +20038,6 @@ openvswitch:
comments: |
/usr/src/openvswitch/openvswitch.tar.gz embeds timestamp,
username, user id, groupname, group id and umask.
- issues:
- - blacklisted_on_jenkins_armhf_only
openxr-sdk-source:
version: 1.0.13~dfsg1-1
comments: |
@@ -20488,7 +20420,6 @@ paperwork:
version: 2.0.2-2
issues:
- png_generated_by_plantuml_captures_kernel_version_and_builddate
- - blacklisted_on_jenkins_armhf_only
paps:
version: 0.6.8-7
issues:
@@ -21541,8 +21472,6 @@ polymake:
version: 3.1-4
comments: |
Paths introduced via perllib/Polymake/Configure.pm and support/configure.pl
- issues:
- - blacklisted_on_jenkins_armhf_only
polyml:
version: 5.6-8
issues:
@@ -22606,8 +22535,6 @@ pyprotocols:
- gcc_captures_build_path
pypy:
version: 2.6.1+dfsg-2
- issues:
- - blacklisted_on_jenkins_armhf_only
pypy3:
version: 7.3.17+dfsg-2
comments: |
@@ -23782,7 +23709,6 @@ python3.9:
01069720: 456e 6420 5461 6720 5461 626c 650a 0a1f End Tag Table...
issues:
- captures_build_path
- - blacklisted_on_jenkins_armhf_only
pythonqt:
version: 3.2-10
issues:
@@ -24034,7 +23960,6 @@ qt4-perl:
qt4-x11:
version: 4:4.8.7+dfsg-5
issues:
- - blacklisted_on_jenkins_armhf_only
- different_encoding
- timestamps_in_qmake_makefiles
qt6-3d:
@@ -24286,8 +24211,6 @@ qtwayland-opensource-src:
- build_path_in_index_files_generated_by_qdoc
qtwebengine-opensource-src:
version: 5.9.1+dfsg-4
- issues:
- - blacklisted_on_jenkins_armhf_only
qtwebkit-opensource-src:
version: 5.212.0~alpha4-14
comments: |
@@ -24328,7 +24251,6 @@ quantlib:
Test duration in
/usr/share/doc/libquantlib0/examples/test-suite/quantlib-test-suite.log.gz
issues:
- - blacklisted_on_jenkins_armhf_only
- captures_shell_variable_in_autofoo_script
- captures_execution_time
- captures_build_path
@@ -30805,8 +30727,6 @@ rustc:
comments: |
Non-deterministic JSON serialisation https://sources.debian.net/src/rustc/1.0.0%2Bdfsg1-1/src/librustdoc/html/render.rs/#L1299
Reported to upstream at https://github.com/rust-lang/rust/issues/34902 - more details there
- issues:
- - blacklisted_on_jenkins_armhf_only
s-nail:
version: 14.9.11-3
comments: |
@@ -30852,7 +30772,6 @@ sagemath:
issues:
- cython_captures_build_path
- timestamps_in_documentation_generated_by_sphinx
- - blacklisted_on_jenkins_armhf_only
sagetex:
version: 3.0+ds-2
comments: |
@@ -30955,7 +30874,6 @@ scala:
version: 2.9.2+dfsg-2
issues:
- timestamps_in_maven_version_files
- - blacklisted_on_jenkins_armhf_only
- different_encoding
scala-parser-combinators:
version: 1.0.3-3
@@ -31236,7 +31154,6 @@ seqan2:
version: 2.4.0+dfsg-11
issues:
- ftbfs_due_to_f-file-prefix-map
- - blacklisted_on_jenkins_armhf_only
seqan3:
version: 3.0.0+ds2-1
issues:
@@ -33407,8 +33324,6 @@ tomcat7:
- random_order_in_documentation_generated_by_javadoc
tomcat8:
version: 8.0.32-1
- issues:
- - blacklisted_on_jenkins_armhf_only
tomcat9:
version: 9.0.16-3
issues:
@@ -33802,8 +33717,6 @@ ufoai:
- fonts_in_pdf_files
ufoai-maps:
version: 2.5-1
- issues:
- - blacklisted_on_jenkins_armhf_only
ufoai-music:
version: 2.5-1
comments: |
@@ -33901,8 +33814,6 @@ unicorn:
- gcc_captures_build_path
unidic-mecab:
version: 2.3.0+dfsg-6
- issues:
- - blacklisted_on_jenkins_armhf_only
unikmer:
version: 0.18.8-1
issues:
@@ -34757,7 +34668,6 @@ woo:
comments: |
Blacklisted on armhf because it builds very long on much faster archs already.
issues:
- - blacklisted_on_jenkins_armhf_only
- captures_build_path
wordwarvi:
version: 1.00+dfsg1-3
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/4505d203b34296abc83a5931c92c34dba5973a97
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/4505d203b34296abc83a5931c92c34dba5973a97
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Wed Sep 9 13:00:19 2026
From: gitlab at salsa.debian.org (Jochen Sprickerhof (@jspricke))
Date: Wed, 09 Sep 2026 13:00:19 +0000
Subject: [Git][reproducible-builds/reproducible-notes][master] Fixup for
4505d203
Message-ID: <6aa158631ed5d_29a4997c078c1763954@godard.mail>
Jochen Sprickerhof pushed to branch master at Reproducible Builds / reproducible-notes
Commits:
6f95f4af by Jochen Sprickerhof at 2026-09-09T14:59:54+02:00
Fixup for 4505d203
- - - - -
1 changed file:
- packages.yml
Changes:
=====================================
packages.yml
=====================================
@@ -2682,8 +2682,6 @@ chromium:
version: 81.0.4044.92-1
issues:
- ftbfs_due_to_f-file-prefix-map
-chromium-browser:
- version: 48.0.2564.82-2
chron:
version: 2.3-47-2
issues:
@@ -3159,8 +3157,6 @@ commons-math:
- random_order_in_documentation_generated_by_javadoc
commons-math3:
version: 3.6.1-1
- comments: |
- First build on armhf ran into a timeout after 18h - thus blacklisted.
issues:
- random_order_in_documentation_generated_by_javadoc
commons-vfs:
@@ -3516,8 +3512,6 @@ ctfutils:
version: 10.3~svn297264-2
issues:
- gcc_captures_build_path
-cthreadpool:
- version: 0.0+git20170424-2
ctpp2:
version: 2.8.3-19
issues:
@@ -3851,8 +3845,6 @@ dbus:
version: 1.12.20-1
issues:
- nondeterminstic_todo_identifiers_in_documentation_generated_by_doxygen
-dbus-cpp:
- version: 5.0.1-5
dbus-java:
version: 2.8-6
issues:
@@ -4298,10 +4290,6 @@ doc-linux-fr:
- timestamps_in_pdf_generated_by_apache_fop
- timestamps_in_ps_generated_by_dvips
- different_encoding
-docbook-defguide:
- version: 2.0.17+svn9912-1
- comments: |
- First build on armhf was killed after 18h?
docbook-xsl-saxon:
version: 1.00.dfsg.1-7
issues:
@@ -4735,7 +4723,6 @@ eclipse:
version: 3.8.1-10
comments: |
Also embeds kernel version and has timestamps in properties files.
- First build on armhf ran into a timeout after 18h - thus blacklisted.
issues:
- timestamps_in_jar
eclipse-aether:
@@ -4768,10 +4755,6 @@ eclipse-titan:
issues:
- user_hostname_manually_added_requiring_further_investigation
- captures_users_gecos
-eclipse-wtp:
- version: 3.6.0-1
- comments: |
- Blacklisted on armhf because a (single) build takes more than 18h?
eclipselink:
version: 2.5.1-4
issues:
@@ -4836,8 +4819,6 @@ eggdrop:
issues:
- gcc_captures_build_path
- records_build_flags
-eigen3:
- version: 3.3~beta1-2
eiskaltdcpp:
version: 2.4.2-1
issues:
@@ -5647,10 +5628,6 @@ fiona:
version: 1.8.14-3
issues:
- random_hashes_in_cython_output
-firefox:
- version: 47.0.1-1
-firefox-esr:
- version: 52.3.0esr-2
firehol:
version: 2.0.1+ds-1
comments: |
@@ -5694,8 +5671,6 @@ flameshot:
version: 0.6.0-5
issues:
- build_id_differences_only
-flang:
- version: 20181226-2
flann:
version: 1.8.4-4.1
issues:
@@ -6091,8 +6066,6 @@ freediameter:
version: 1.2.1-8
issues:
- cmake_rpath_contains_build_path
-freedict:
- version: 2014.10.22-2
freedroidrpg:
version: 0.15.1-1
issues:
@@ -9331,8 +9304,6 @@ haskell-gi-gobject:
version: 2.0.27-1
issues:
- haskell_abi_hash_differences
-haskell-gi-gtk:
- version: 3.0.36-1
haskell-gi-pango:
version: 1.0.26-1
issues:
@@ -15425,8 +15396,6 @@ lltsv:
issues:
- records_build_flags
- randomness_in_binaries_generated_by_golang
-llvm-toolchain-11:
- version: 1:11.0.1~+rc1-1~exp1
llvm-toolchain-14:
version: 1:14.0.0~+rc4-1
issues:
@@ -15436,18 +15405,10 @@ llvm-toolchain-3.7:
version: 1:3.7.1-1
issues:
- timestamps_in_documentation_generated_by_groff
-llvm-toolchain-3.8:
- version: 1:3.8-1
-llvm-toolchain-3.9:
- version: 1:3.9-1
-llvm-toolchain-4.0:
- version: 1:4.0-1
llvm-toolchain-9:
version: 1:9.0.1-8
issues:
- ftbfs_due_to_f-file-prefix-map
-llvm-toolchain-snapshot:
- version: 1:3.8~svn254193-1
llvmlite:
version: 0.15.0+git20161228.95d8c7c-2
issues:
@@ -16716,8 +16677,6 @@ mlt:
rpath issue fixed by -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON
issues:
- cmake_rpath_contains_build_path
-mlton:
- version: 20180207-1
mm:
version: 1.4.2-5
issues:
@@ -19771,8 +19730,6 @@ openexr-viewers:
version: 1.0.1-6
issues:
- gcc_captures_build_path
-openfoam:
- version: 1906.191111+dfsg1-2
opengm:
version: 2.3.6+20160131-2
issues:
@@ -19810,8 +19767,6 @@ openjade:
version: 1.4devel1-21.1
issues:
- gcc_captures_build_path
-openjdk-11:
- version: 11.0.4+11-1
openjdk-27:
version: 27~30ea-1
issues:
@@ -19975,8 +19930,6 @@ openstack-trove:
version: 1:18.0.0~rc1-2
issues:
- randomness_in_documentation_generated_by_sphinx
-openstructure:
- version: 2.2.0-3
opensubdiv:
version: 3.4.0-6
issues:
@@ -22533,8 +22486,6 @@ pyprotocols:
version: 1.0a.svn20070625-7
issues:
- gcc_captures_build_path
-pypy:
- version: 2.6.1+dfsg-2
pypy3:
version: 7.3.17+dfsg-2
comments: |
@@ -24209,8 +24160,6 @@ qtwayland-opensource-src:
version: 5.10.1-3
issues:
- build_path_in_index_files_generated_by_qdoc
-qtwebengine-opensource-src:
- version: 5.9.1+dfsg-4
qtwebkit-opensource-src:
version: 5.212.0~alpha4-14
comments: |
@@ -33322,8 +33271,6 @@ tomcat7:
version: 7.0.75-1
issues:
- random_order_in_documentation_generated_by_javadoc
-tomcat8:
- version: 8.0.32-1
tomcat9:
version: 9.0.16-3
issues:
@@ -33715,8 +33662,6 @@ ufoai:
issues:
- random_id_in_pdf_generated_by_dblatex
- fonts_in_pdf_files
-ufoai-maps:
- version: 2.5-1
ufoai-music:
version: 2.5-1
comments: |
@@ -33812,8 +33757,6 @@ unicorn:
version: 5.0.1-2
issues:
- gcc_captures_build_path
-unidic-mecab:
- version: 2.3.0+dfsg-6
unikmer:
version: 0.18.8-1
issues:
@@ -34665,8 +34608,6 @@ wolfssl:
- records_build_flags
woo:
version: 1.0+dfsg1-1
- comments: |
- Blacklisted on armhf because it builds very long on much faster archs already.
issues:
- captures_build_path
wordwarvi:
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/6f95f4af84dfb4267e7582ab7ee1fae67446d5ab
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/6f95f4af84dfb4267e7582ab7ee1fae67446d5ab
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Fri Sep 11 00:01:26 2026
From: gitlab at salsa.debian.org (Mattia Rizzolo (@mattia))
Date: Fri, 11 Sep 2026 00:01:26 +0000
Subject: [Git][reproducible-builds/reproducible-notes][master] Remove archived
bugs
Message-ID: <6aa344d68abf6_29a49bcbbe8822270c1@godard.mail>
Mattia Rizzolo pushed to branch master at Reproducible Builds / reproducible-notes
Commits:
9bd2330e by automatic commit from Mattia Rizzolo at 2026-09-11T00:00:58+00:00
Remove archived bugs
- - - - -
1 changed file:
- packages.yml
Changes:
=====================================
packages.yml
=====================================
@@ -7949,10 +7949,6 @@ golang-github-jung-kurt-gofpdf:
version: 2.17.3+ds-1
bugs:
- 1123007
-golang-github-klauspost-reedsolomon:
- version: 1.13.3-2
- bugs:
- - 1138625
golang-github-kshedden-dstream:
version: 0.0~git20190512.c4c4106-2
bugs:
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/9bd2330eb1493a8e2784322da6e9480211b15646
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/9bd2330eb1493a8e2784322da6e9480211b15646
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Fri Sep 11 10:13:05 2026
From: gitlab at salsa.debian.org (Chris Lamb (@lamby))
Date: Fri, 11 Sep 2026 10:13:05 +0000
Subject: [Git][reproducible-builds/reproducible-website][master] 2 commits:
Misc changes prior to publication.
Message-ID: <6aa3d43166c10_29a49fff3c231579b@godard.mail>
Chris Lamb pushed to branch master at Reproducible Builds / reproducible-website
Commits:
d0052cd9 by Chris Lamb at 2026-09-11T11:12:41+01:00
Misc changes prior to publication.
- - - - -
7c6a6b88 by Chris Lamb at 2026-09-11T11:12:50+01:00
published as https://reproducible-builds.org/reports/2026-08/
- - - - -
5 changed files:
- _reports/2026-08.md
- ? images/reports/2026-07/diffoscope.png
- + images/reports/2026-08/2026_cisa_sbom_minimum_elements_508c.png
- + images/reports/2026-08/fossy-sample-sm.png
- + images/reports/2026-08/pypi.png
Changes:
=====================================
_reports/2026-08.md
=====================================
@@ -3,7 +3,8 @@ layout: report
year: "2026"
month: "08"
title: "Reproducible Builds in August 2026"
-draft: true
+draft: false
+date: 2026-09-11 10:12:50
---
**Welcome to the August 2026 report from the [Reproducible Builds](https://reproducible-builds.org) project!**
@@ -14,19 +15,24 @@ draft: true
In our reports, we try to outline the most important things that we have been up to over the past month. As a quick recap about what problem our project intends to solve, whilst anyone may inspect the source code of free software for malicious flaws, almost all software is distributed to end users as pre-compiled binaries. The motivation behind the reproducible builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised or not.
-
+0. [New updated SBOM specification from CISA.gov](#new-updated-sbom-specification-from-cisagov)
+0. [LWN on Bootstrappable builds at FOSSY 2026](#lwn-on-bootstrappable-builds-at-fossy-2026)
+0. [?What?s missing to have reproducible builds on PyPI??](#whats-missing-to-have-reproducible-builds-on-pypi)
+0. [Distribution work](#distribution-work)
+0. [Unreproducible builds under EROFS filesystem fixed](#unreproducible-builds-under-erofs-filesystem-fixed)
+0. [Tool and documentation development](#tool-and-documentation-development)
+0. [Six new scholarly papers](#six-new-scholarly-papers)
+0. [Patches](#patches)
---
### New updated SBOM specification from CISA.gov
-[CISA](https://en.wikipedia.org/wiki/Cybersecurity_and_Infrastructure_Security_Agency), the Cybersecurity and Infrastructure Security Agency of the U.S. government published some the joint guidance entitled *[Minimum Elements for a Software Bill of Materials*](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf) (SBOM), which updates and supersedes the baseline 2021 version covered in previous editions of these reports.
+[![]({{ "/images/reports/2026-08/2026_cisa_sbom_minimum_elements_508c.png#right" | relative_url }})](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf)
+
+[CISA](https://en.wikipedia.org/wiki/Cybersecurity_and_Infrastructure_Security_Agency), the Cybersecurity and Infrastructure Security Agency of the U.S. government published some the joint guidance entitled [*Minimum Elements for a Software Bill of Materials*](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf) (SBOM), which updates and supersedes the baseline 2021 version covered in previous editions of these reports.
Whilst [the PDF](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf) is worth skimming, the interesting changes include that the specification now mandates standard cryptographic hashes: unlike earlier standards that allowed hash omission or manifest-only parsing, hashes must be computed from the output. This is is important for reproducible builds, as it ensures the recording of the metadata required to demonstrate the shipped software matches the build output precisely where applicable. In addition, where the top-level only dependency limitation that was present in the 2021 version has been removed in favour of complete coverage with no minimum depth. That is, SBOMs are expected to reflect all linked libraries, vendored dependencies and other build-time inclusions.
@@ -34,7 +40,9 @@ Whilst [the PDF](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom
### LWN on Bootstrappable builds at FOSSY 2026
-In the "Toolchains and Other Development Tools" track at [Software Freedom Conservancy](https://sfconservancy.org/)'s [FOSSY 2026](https://2026.fossy.ca/) in British Columbia, Canada, Timothy Sample gave a presentation on [bootstrappable builds](https://bootstrappable.org/). This [presentation was then covered](https://lwn.net/Articles/1088279/) in a [Linux Weekly News](https://lwn.net/) article by Jake Edge entitled [*Bootstrappable builds: how and why*](https://lwn.net/Articles/1088279/*](https://lwn.net/Articles/1088279/), which serves as an excellent introduction to the concept:
+[![]({{ "/images/reports/2026-08/fossy-sample-sm.png#right" | relative_url }})](https://lwn.net/Articles/1088279/)
+
+In the "Toolchains and Other Development Tools" track at [Software Freedom Conservancy](https://sfconservancy.org/)'s [FOSSY 2026](https://2026.fossy.ca/) in British Columbia, Canada, Timothy Sample gave a presentation on [bootstrappable builds](https://bootstrappable.org/). This [presentation was then covered](https://lwn.net/Articles/1088279/) in a [Linux Weekly News](https://lwn.net/) article by Jake Edge entitled [*Bootstrappable builds: how and why*](https://lwn.net/Articles/1088279/), which serves as an excellent introduction to the concept:
> The basic idea behind bootstrappable builds is to create a system that can be built without relying on pre-built artifacts. "Can we go from zero to the modern day without having to just assume the existence of these already-built-for-us artifacts?" The classic recipe for yogurt requires some yogurt to start the process, which is like how we normally build a C compiler today?we start with an existing C compiler binary. You might think about making sourdough bread with your grandmother's starter brought over from the old country; "we're basically making C compilers with Dennis Ritchie's starter carried over from Bell Labs".
@@ -45,6 +53,8 @@ The article, which goes on to cover GNU Mes and other projects that overlap with
### "[*What's missing to have reproducible builds on PyPI?*](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/)"
+[![]({{ "/images/reports/2026-08/pypi.png#right" | relative_url }})](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/)
+
Core Python developer, [Brett Cannon](https://snarky.ca/) wrote an interesting blog post this month addressing [*What's missing to have reproducible builds on PyPI*](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/), the [official public repository for third-party Python software packages](https://pypi.org/):
> The reason I like the idea of making reproducible builds work is that I think it can be done in such a way as to not require any work on the part of the producer of a distribution (which is a technical term for sdists or wheels, i.e., the people who upload stuff to PyPI), and thus make reproducible builds very low-friction for people to opt into supporting. [[?](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/)]
@@ -77,7 +87,7 @@ Thankfully, Martin also reported that [they had fixed this in a commit to the ke
### Tool and documentation development
-[![]({{ "/images/reports/2026-87/diffoscope.png#right" | relative_url }})](https://diffoscope.org/)
+[![]({{ "/images/reports/2026-08/diffoscope.png#right" | relative_url }})](https://diffoscope.org/)
[**diffoscope**](https://diffoscope.org) is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb made a number of chnages, including preparing and uploading versions `327`, `328` and `329` to Debian. In particular, he ensured that *diffoscope* did not require *python3-guestfs* in the autopkgtests on 32-bit architectures in order to fix Debian bug ([#1144372](https://bugs.debian.org/1144372)) [[?](https://salsa.debian.org/reproducible-builds/diffoscope/commit/5440dd50)]. Colin Watson made an additional change, handling a potentially missing `openssh-client` package when running the autopkgtests [[?](https://salsa.debian.org/reproducible-builds/diffoscope/commit/a4fd009a)], and Jochen Sprickerhof made a similar change to cope with missing `cpio` and `qemu-img` functionality [[?](https://salsa.debian.org/reproducible-builds/diffoscope/commit/ae4f6f86)] whilst also updating the XML comparator to be considered when comparing SVG images [[?](https://salsa.debian.org/reproducible-builds/diffoscope/commit/c7f23bb0)].
=====================================
images/reports/2026-07/diffoscope.png deleted
=====================================
Binary files a/images/reports/2026-07/diffoscope.png and /dev/null differ
=====================================
images/reports/2026-08/2026_cisa_sbom_minimum_elements_508c.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/2026_cisa_sbom_minimum_elements_508c.png differ
=====================================
images/reports/2026-08/fossy-sample-sm.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/fossy-sample-sm.png differ
=====================================
images/reports/2026-08/pypi.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/pypi.png differ
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/compare/b912567550d3856bc743e4b8cd611c8c30e6fb71...7c6a6b88b9b92d849d1f0d69792e2dc0804f2635
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/compare/b912567550d3856bc743e4b8cd611c8c30e6fb71...7c6a6b88b9b92d849d1f0d69792e2dc0804f2635
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Fri Sep 11 10:13:12 2026
From: gitlab at salsa.debian.org (Chris Lamb (@lamby))
Date: Fri, 11 Sep 2026 10:13:12 +0000
Subject: [Git][reproducible-builds/reproducible-website] Pushed new tag 2026-08
Message-ID: <6aa3d438c4cca_29a49b2e5760231599c@godard.mail>
Chris Lamb pushed new tag 2026-08 at Reproducible Builds / reproducible-website
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/tree/2026-08
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Sat Sep 12 00:01:13 2026
From: gitlab at salsa.debian.org (Mattia Rizzolo (@mattia))
Date: Sat, 12 Sep 2026 00:01:13 +0000
Subject: [Git][reproducible-builds/reproducible-notes][master]
--fix-deterministic
Message-ID: <6aa4964996e47_3d8138ff8202233fc@godard.mail>
Mattia Rizzolo pushed to branch master at Reproducible Builds / reproducible-notes
Commits:
c53efe24 by automatic commit from Mattia Rizzolo at 2026-09-12T00:01:10+00:00
--fix-deterministic
- - - - -
1 changed file:
- packages.yml
Changes:
=====================================
packages.yml
=====================================
@@ -5923,7 +5923,6 @@ fonts-smc-dyuthi:
fonts-smc-karumbi:
version: 1.0-1
issues:
- - fontforge_resets_modification_time
- timestamp_in_fonts_generated_by_opentype
fonts-smc-keraleeyam:
version: 3.0.1-1
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/c53efe241ca4f39a9924a14beb925249a68d8316
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/c53efe241ca4f39a9924a14beb925249a68d8316
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Sun Sep 13 00:01:21 2026
From: gitlab at salsa.debian.org (Mattia Rizzolo (@mattia))
Date: Sun, 13 Sep 2026 00:01:21 +0000
Subject: [Git][reproducible-builds/reproducible-notes][master] Remove archived
bugs
Message-ID: <6aa5e7d1dd227_5ef10267415942e@godard.mail>
Mattia Rizzolo pushed to branch master at Reproducible Builds / reproducible-notes
Commits:
79174dff by automatic commit from Mattia Rizzolo at 2026-09-13T00:00:53+00:00
Remove archived bugs
- - - - -
1 changed file:
- packages.yml
Changes:
=====================================
packages.yml
=====================================
@@ -20347,10 +20347,6 @@ pandas:
- randomness_in_documentation_generated_by_sphinx
bugs:
- 877419
-pangzero:
- version: 1.4.1+git20121103-6
- bugs:
- - 1142131
panicparse:
version: 2.2.2-1
issues:
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/79174dffc9a1a512c77dabc331eec2a9e2219318
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/79174dffc9a1a512c77dabc331eec2a9e2219318
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Sun Sep 13 08:48:35 2026
From: gitlab at salsa.debian.org (mirabilos (@tg))
Date: Sun, 13 Sep 2026 08:48:35 +0000
Subject: [Git][reproducible-builds/reproducible-notes][master] update note for
mksh
Message-ID: <6aa6636360e01_5efffec42738a1@godard.mail>
mirabilos pushed to branch master at Reproducible Builds / reproducible-notes
Commits:
2e5d8a42 by mirabilos at 2026-09-13T10:48:22+02:00
update note for mksh
- - - - -
1 changed file:
- packages.yml
Changes:
=====================================
packages.yml
=====================================
@@ -16647,9 +16647,11 @@ mknfonts.tool:
issues:
- gcc_captures_build_path
mksh:
- version: 59c-41
+ version: 59c-43
comments: |
- Ships build logs in README.Debian with nondeterminstic contents
+ Affected by bug #1147469 (tl;dr: reproducible-builds is meant
+ to vary the nocheck build *profile* but does it to the build
+ *option* instead, which *is* allowed to vary the package contents)
mldonkey:
version: 3.1.5-3
issues:
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/2e5d8a427d33853f0db3f97d5c3414b5c2ac7661
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/commit/2e5d8a427d33853f0db3f97d5c3414b5c2ac7661
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Sun Sep 13 15:14:28 2026
From: gitlab at salsa.debian.org (Mattia Rizzolo (@mattia))
Date: Sun, 13 Sep 2026 15:14:28 +0000
Subject: [Git][reproducible-builds/reproducible-website][master] update POs
Message-ID: <6aa6bdd4a68ac_5ef102610358322@godard.mail>
Mattia Rizzolo pushed to branch master at Reproducible Builds / reproducible-website
Commits:
e65814d4 by Mattia Rizzolo at 2026-09-13T17:13:57+02:00
update POs
Signed-off-by: Mattia Rizzolo
- - - - -
4 changed files:
- po/_docs.de.po
- po/_docs.pot
- po/_pages.de.po
- po/_pages.pot
The diff was not included because it is too large.
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/e65814d48382f40727d59997c12097cbbcbb45b5
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/e65814d48382f40727d59997c12097cbbcbb45b5
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Sun Sep 13 17:48:13 2026
From: gitlab at salsa.debian.org (Chris Lamb (@lamby))
Date: Sun, 13 Sep 2026 17:48:13 +0000
Subject: [Git][reproducible-builds/reproducible-website][master] 2026-08: Fix
a 'changes' typo.
Message-ID: <6aa6e1dddbfb7_5ef102674381859@godard.mail>
Chris Lamb pushed to branch master at Reproducible Builds / reproducible-website
Commits:
5b0ede36 by Chris Lamb at 2026-09-13T18:47:51+01:00
2026-08: Fix a 'changes' typo.
- - - - -
1 changed file:
- _reports/2026-08.md
Changes:
=====================================
_reports/2026-08.md
=====================================
@@ -89,7 +89,7 @@ Thankfully, Martin also reported that [they had fixed this in a commit to the ke
[![]({{ "/images/reports/2026-08/diffoscope.png#right" | relative_url }})](https://diffoscope.org/)
-[**diffoscope**](https://diffoscope.org) is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb made a number of chnages, including preparing and uploading versions `327`, `328` and `329` to Debian. In particular, he ensured that *diffoscope* did not require *python3-guestfs* in the autopkgtests on 32-bit architectures in order to fix Debian bug ([#1144372](https://bugs.debian.org/1144372)) [[?](https://salsa.debian.org/reproducible-builds/diffoscope/commit/5440dd50)]. Colin Watson made an additional change, handling a potentially missing `openssh-client` package when running the autopkgtests [[?](https://salsa.debian.org/reproducible-builds/diffoscope/commit/a4fd009a)], and Jochen Sprickerhof made a similar change to cope with missing `cpio` and `qemu-img` functionality [[?](https://salsa.debian.org/reproducible-builds/diffoscope/commit/ae4f6f86)] whilst also updating the XML comparator to be considered when comparing SVG images [[?](https://salsa.debian.org/reproducible-builds/diffoscope/commit/c7f23bb0)].
+[**diffoscope**](https://diffoscope.org) is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb made a number of changes, including preparing and uploading versions `327`, `328` and `329` to Debian. In particular, he ensured that *diffoscope* did not require *python3-guestfs* in the autopkgtests on 32-bit architectures in order to fix Debian bug ([#1144372](https://bugs.debian.org/1144372)) [[?](https://salsa.debian.org/reproducible-builds/diffoscope/commit/5440dd50)]. Colin Watson made an additional change, handling a potentially missing `openssh-client` package when running the autopkgtests [[?](https://salsa.debian.org/reproducible-builds/diffoscope/commit/a4fd009a)], and Jochen Sprickerhof made a similar change to cope with missing `cpio` and `qemu-img` functionality [[?](https://salsa.debian.org/reproducible-builds/diffoscope/commit/ae4f6f86)] whilst also updating the XML comparator to be considered when comparing SVG images [[?](https://salsa.debian.org/reproducible-builds/diffoscope/commit/c7f23bb0)].
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/5b0ede36d0188141976d85d00d621bbe9094b9da
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/5b0ede36d0188141976d85d00d621bbe9094b9da
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Sun Sep 13 17:51:44 2026
From: gitlab at salsa.debian.org (Chris Lamb (@lamby))
Date: Sun, 13 Sep 2026 17:51:44 +0000
Subject: [Git][reproducible-builds/reproducible-website][master] 2026-08: Drop
a double word
Message-ID: <6aa6e2b077ff7_5ef102638382628@godard.mail>
Chris Lamb pushed to branch master at Reproducible Builds / reproducible-website
Commits:
4ff86d93 by Chris Lamb at 2026-09-13T18:48:12+01:00
2026-08: Drop a double word
- - - - -
1 changed file:
- _reports/2026-08.md
Changes:
=====================================
_reports/2026-08.md
=====================================
@@ -98,7 +98,7 @@ Thankfully, Martin also reported that [they had fixed this in a commit to the ke
Yet again, there were a number of improvements made to [**our website**]({{ "/" | relative_url }}) this month as well. For example:
-* Chris Lamb added added draft for a [Gothenburg summit](https://reproducible-builds.org/news/2026/08/12/reproducible-builds-summit-in-gothenburg/)-related news article. [[?](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/126f1774)][[?](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/194c4f24)]
+* Chris Lamb added draft for a [Gothenburg summit](https://reproducible-builds.org/news/2026/08/12/reproducible-builds-summit-in-gothenburg/)-related news article. [[?](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/126f1774)][[?](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/194c4f24)]
* Holger Levsen then published [the same article](https://reproducible-builds.org/news/2026/08/12/reproducible-builds-summit-in-gothenburg/). [[?](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/12265a52)][[?](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/3be2ff73)]
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/4ff86d93027bfea6fa16028217813452f425b424
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/4ff86d93027bfea6fa16028217813452f425b424
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From gitlab at salsa.debian.org Mon Sep 14 00:01:21 2026
From: gitlab at salsa.debian.org (Mattia Rizzolo (@mattia))
Date: Mon, 14 Sep 2026 00:01:21 +0000
Subject: [Git][reproducible-builds/reproducible-notes][master] 2 commits:
Remove archived bugs
Message-ID: <6aa73951163f7_5ef10225046548c@godard.mail>
Mattia Rizzolo pushed to branch master at Reproducible Builds / reproducible-notes
Commits:
a4805fc0 by automatic commit from Mattia Rizzolo at 2026-09-14T00:00:54+00:00
Remove archived bugs
- - - - -
48afcd47 by automatic commit from Mattia Rizzolo at 2026-09-14T00:01:09+00:00
Add missing usertagged bugs
- - - - -
1 changed file:
- packages.yml
Changes:
=====================================
packages.yml
=====================================
@@ -1981,6 +1981,10 @@ bpack:
version: 1.3.0-3
issues:
- sphinx_reading_durations
+bpftop:
+ version: 0.9.0.9.g5a67ec0-1
+ bugs:
+ - 1147533
bplay:
version: 0.991-10
issues:
@@ -4197,10 +4201,6 @@ dislocker:
version: 0.6.1-6
issues:
- build_id_differences_only
-displaycal-py3:
- version: 3.9.19-1
- bugs:
- - 1144065
dita-ot:
version: 1.5.3+dfsg-1
comments: |
@@ -21156,10 +21156,6 @@ plainbox:
issues:
- randomness_in_documentation_generated_by_sphinx
- randomness_in_documentation_indices_generated_by_sphinx
-plasma-bigscreen:
- version: 6.7.4-1
- bugs:
- - 1144482
plasma-desktop:
version: 4:5.8.6-1
issues:
@@ -21733,8 +21729,6 @@ print-manager:
issues:
- build_id_differences_only
- cmake_rpath_contains_build_path
- bugs:
- - 1144481
prison:
version: 1.1.1-1
issues:
@@ -22361,10 +22355,6 @@ pylint-celery:
version: 0.3-3
bugs:
- 888157
-pylint-common:
- version: 0.2.5-1
- bugs:
- - 884220
pylirc:
version: 0.0.5-3
issues:
@@ -30648,6 +30638,8 @@ rust-coreutils:
version: 0.8.0-6
comments: |
./src/bin/uudoc.rs line 187 generates manpages with build date instead of SOURCE_DATE_EPOCH.
+ bugs:
+ - 1147372
rust-gst-plugin-gif:
version: 0.15.0-3
bugs:
@@ -33586,6 +33578,10 @@ u1db:
version: 13.10-6.2
issues:
- gcc_captures_build_path
+u1db-qt:
+ version: 0.1.8-3
+ bugs:
+ - 1147534
uanytun:
version: 0.3.5-1
issues:
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/compare/2e5d8a427d33853f0db3f97d5c3414b5c2ac7661...48afcd478b638a3e884c08c0487bee8a641d7b3f
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-notes/-/compare/2e5d8a427d33853f0db3f97d5c3414b5c2ac7661...48afcd478b638a3e884c08c0487bee8a641d7b3f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
From notice at records.2global.net Mon Sep 14 06:18:54 2026
From: notice at records.2global.net (Yoogo Business Records,
operated by 2Global Corporation)
Date: Mon, 14 Sep 2026 06:18:54 +0000
Subject: Notice Regarding Public Business Information Record
Message-ID: <010001a09e918e02-0030fb25-b16f-4551-bd14-0f068f369bb7-000000@email.amazonses.com>
Hello Reproducible Builds team,
Yoogo has created a public business information record for Reproducible Builds using publicly available business information. We are sending this notice so you can review the record and contact us if anything is inaccurate.
The record may include publicly available business information such as business name, address, category, and website. It may also include related Yoogo profile content, including social media features where available.
To view the current record, please go directly to:
https://www.yoogo.com/business-lookup
Then search for:
Reproducible Builds
If any information is inaccurate, or if you have questions about this notice or your data rights, you can contact us at privacy at mail.yoogo.com.
This notice is being sent for transparency and data accuracy purposes regarding a public business information record.
Regards,
Yoogo Privacy Team
Yoogo, Inc.
2514 Whitney Ave. #185892
Hamden, CT 06518, USA
To stop receiving future transparency notices:
https://yoogo.com/u?token=MXw4OXwyMzU5NzUwOXwtTlprT2pMbDlFZktwbTVHSjJVdFRRbHRrNUh6YzVLWEdRdFR0SG9meGJrfDE4MjA3Nzk2MTU.y8ZjPG-GeO23tbnlJjCD5GRvMLOOasOF_VwR3WV_DRI
? Yoogo 2026. All rights reserved.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: