[Git][reproducible-builds/reproducible-website][master] 2 commits: 2026-08: Initial draft
Chris Lamb (@lamby)
gitlab at salsa.debian.org
Wed Sep 9 11:05:49 UTC 2026
Chris Lamb pushed to branch master at Reproducible Builds / reproducible-website
Commits:
5f5fa906 by Chris Lamb at 2026-09-09T12:04:37+01:00
2026-08: Initial draft
- - - - -
7f69a4f6 by Chris Lamb at 2026-09-09T12:05:06+01:00
2026-07: Fix a mismerge (?) of Bernhard's report link from the previous month's report.
- - - - -
19 changed files:
- _reports/2026-07.md
- _reports/2026-08.md
- + images/reports/2026-07/opensuse.png
- + images/reports/2026-08/debian.png
- + images/reports/2026-08/diffoscope.png
- + images/reports/2026-08/opensuse.png
- + images/reports/2026-08/openwrt-rebuilderd.png
- + images/reports/2026-08/openwrt.png
- + images/reports/2026-08/paper-2607.21888.png
- + images/reports/2026-08/paper-2607.24888.png
- + images/reports/2026-08/paper-2607.26719.png
- + images/reports/2026-08/paper-2608.18180.png
- + images/reports/2026-08/paper-2608.20678.png
- + images/reports/2026-08/paper-2608.27125.png
- + images/reports/2026-08/paper-fdroid.png
- + images/reports/2026-08/paper-snakeoil.png
- + images/reports/2026-08/paper-vcaligner.png
- + images/reports/2026-08/reproducible-builds.png
- + images/reports/2026-08/website.png
Changes:
=====================================
_reports/2026-07.md
=====================================
@@ -74,6 +74,11 @@ In addition, there is [a new page showing verification rebuilds](https://rebuild
<br>
+[![]({{ "/images/reports/2026-07/opensuse.png#right" | relative_url }})](https://www.opensuse.org/)
+
+Lastly, Bernhard M. Wiedemann posted another [**openSUSE**](https://www.opensuse.org/) [monthly update](https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/JLAOJP7W6K3P2SL6XT6UYX444XZ5WQPN/) for their reproducibility work there.
+
+<br>
### Three new scholarly papers
@@ -105,8 +110,6 @@ Denise Nanni, Julien Malka, Stefano Zacchiroli and Théo Zimmermann from [Télé
The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where applicable or possible. This month, we wrote a large number of such patches, including:
-* [openSUSE monthly](https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/JLAOJP7W6K3P2SL6XT6UYX444XZ5WQPN/)
-
* Arnout Engelen:
* [`ivy`](https://github.com/apache/ant-ivy/pull/127)
=====================================
_reports/2026-08.md
=====================================
@@ -6,81 +6,240 @@ title: "Reproducible Builds in August 2026"
draft: true
---
-### Patches
+**Welcome to the August 2026 report from the [Reproducible Builds](https://reproducible-builds.org) project!**
+{: .lead}
-* Robin Candau:
+[![]({{ "/images/reports/2026-08/reproducible-builds.png#right" | relative_url }})](https://reproducible-builds.org/)
- * [`bashburn`](https://codeberg.org/aelinden/BashBurn/pulls/1)
- * [`LMMS`](https://github.com/LMMS/lmms/pull/8494)
-* [FIXME](https://arxiv.org/pdf/2607.26719)
+In our reports, we try to outline the most important things that we have been up to over the past month. As a quick recap about what problem our project intends to solve, whilst anyone may inspect the source code of free software for malicious flaws, almost all software is distributed to end users as pre-compiled binaries. The motivation behind the reproducible builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised or not.
+
+<!--
+
+In this month's report, we cover:
+
+0. Automatically generated prior to publication
+
+-->
+
+---
+
+### New updated SBOM specification from CISA.gov
+
+[CISA](https://en.wikipedia.org/wiki/Cybersecurity_and_Infrastructure_Security_Agency), the Cybersecurity and Infrastructure Security Agency of the U.S. government published some the joint guidance entitled *[Minimum Elements for a Software Bill of Materials*](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf) (SBOM), which updates and supersedes the baseline 2021 version covered in previous editions of these reports.
+
+Whilst [the PDF](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf) is worth skimming, the interesting changes include that the specification now mandates standard cryptographic hashes: unlike earlier standards that allowed hash omission or manifest-only parsing, hashes must be computed from the output. This is is important for reproducible builds, as it ensures the recording of the metadata required to demonstrate the shipped software matches the build output precisely where applicable. In addition, where the top-level only dependency limitation that was present in the 2021 version has been removed in favour of complete coverage with no minimum depth. That is, SBOMs are expected to reflect all linked libraries, vendored dependencies and other build-time inclusions.
+
+<br>
+
+### LWN on Bootstrappable builds at FOSSY 2026
+
+In the "Toolchains and Other Development Tools" track at [Software Freedom Conservancy](https://sfconservancy.org/)'s [FOSSY 2026](https://2026.fossy.ca/) in British Columbia, Canada, Timothy Sample gave a presentation on [bootstrappable builds](https://bootstrappable.org/). This [presentation was then covered](https://lwn.net/Articles/1088279/) in a [Linux Weekly News](https://lwn.net/) article by Jake Edge entitled [*Bootstrappable builds: how and why*]https://lwn.net/Articles/1088279/*](https://lwn.net/Articles/1088279/), which serves as an excellent introduction to the concept:
+
+
+> The basic idea behind bootstrappable builds is to create a system that can be built without relying on pre-built artifacts. "Can we go from zero to the modern day without having to just assume the existence of these already-built-for-us artifacts?" The classic recipe for yogurt requires some yogurt to start the process, which is like how we normally build a C compiler today—we start with an existing C compiler binary. You might think about making sourdough bread with your grandmother's starter brought over from the old country; "we're basically making C compilers with Dennis Ritchie's starter carried over from Bell Labs".
+
+The article, which goes on to cover GNU Mes and other projects that overlap with Reproducible Builds, also has [a number of thought-provoking comments](https://lwn.net/Articles/1088279/#Comments).
+
+<br>
+
+### "[*What's missing to have reproducible builds on PyPI?*](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/)"
+
+Core Python developer, [Brett Cannon](https://snarky.ca/) wrote an interesting blog post this month addressing [*What's missing to have reproducible builds on PyPI*](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/), the [official public repository for third-party Python software packages](https://pypi.org/):
+
+> The reason I like the idea of making reproducible builds work is that I think it can be done in such a way as to not require any work on the part of the producer of a distribution (which is a technical term for sdists or wheels, i.e., the people who upload stuff to PyPI), and thus make reproducible builds very low-friction for people to opt into supporting. [[…](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/)]
+
+Brett goes on to outline "What's missing from the specs" and how reproducibility might be visible on PyPI to consumers:
+
+Assuming all of this comes to pass and we record the where the source code is that went into a distribution and the software used to make the distribution, how do we make it useful to people? Does every person who cares about having a secure supply chain have to rebuild everything they use themselves? Is there some way for even people who don't care about this stuff to benefit? [[…](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/)]
+
+<br>
+
+### Distribution work
+
+[![]({{ "/images/reports/2026-08/debian.png#right" | relative_url }})](https://debian.org/)
+
+In **Debian** this month, 23 reviews of Debian packages were added, 28 were updated and 27 were removed this month adding to [our knowledge about identified issues](https://tests.reproducible-builds.org/debian/index_issues.html). A number of issue types have been updated as well, such as the addition of a new toolchain issue related to `python-traitlets` [[…](https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/666e1847)], and the note for an existing issue related to `texi2html` was updated as well [[…](https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/8c55be8f)].
+
+[![]({{ "/images/reports/2026-08/opensuse.png#right" | relative_url }})](https://www.opensuse.org/)
+
+Lastly, Bernhard M. Wiedemann posted another [**openSUSE**](https://www.opensuse.org/) [monthly update](https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/C7BCS4OC2XPR5ZNOEXCJGP6NXL2W5BNT/) for their reproducibility work there.
+
+<br>
+
+### Unreproducible builds under EROFS filesystem fixed
+
+[Martin Pitt](https://fosstodon.org/@martinpitt) reported on [Fosstodon](https://fosstodon.org/) that they had [identified an issue](https://fosstodon.org/@martinpitt/117034829700534836) where the `mkfs` ("make filesystem") command for the [EROFS](https://en.wikipedia.org/wiki/EROFS) (Enhanced Read-Only File System) subsystem of the Linux kernel did not have sorted [extended file attributes](https://en.wikipedia.org/wiki/Extended_file_attributes), leading to reproducible builds.
+
+Thankfully, Martin also reported that [they had fixed this in a commit to the kernel](https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/commit/?id=37fc4113694e1c9690bd871aefe91f55bf8bd029) which "order[s] each inode's xattrs by name so that images stay reproducible". [[…](https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/commit/?id=37fc4113694e1c9690bd871aefe91f55bf8bd029)]
+
+<br>
+
+### Tool and documentation development
+
+[![]({{ "/images/reports/2026-87/diffoscope.png#right" | relative_url }})](https://diffoscope.org/)
+
+[**diffoscope**](https://diffoscope.org) is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb made a number of chnages, including preparing and uploading versions `327`, `328` and `329` to Debian. In particular, he ensured that *diffoscope* did not require *python3-guestfs* in the autopkgtests on 32-bit architectures in order to fix Debian bug ([#1144372](https://bugs.debian.org/1144372)) [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/5440dd50)]. Colin Watson made an additional change, handling a potentially missing `openssh-client` package when running the autopkgtests [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/a4fd009a)], and Jochen Sprickerhof made a similar change to cope with missing `cpio` and `qemu-img` functionality [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/ae4f6f86)] whilst also updating the XML comparator to be considered when comparing SVG images [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/c7f23bb0)].
+
+<br>
+
-* [FIXME](https://books.google.com/books?hl=en&lr=&id=R7D6EQAAQBAJ&oi=fnd&pg=PA384&ots=MJAMLO7kQN&sig=74sOyxudlFmOhNSyF8TpyePlYsQ#v=onepage&q&f=false)
+[![]({{ "/images/reports/2026-08/website.png#right" | relative_url }})]({{ "/" | relative_url }})
-* [FIXME](https://arxiv.org/pdf/2607.24888)
+Yet again, there were a number of improvements made to [**our website**]({{ "/" | relative_url }}) this month as well. For example:
-* [FIXME](https://arxiv.org/pdf/2607.21888)
+* Chris Lamb added added draft for a [Gothenburg summit](https://reproducible-builds.org/news/2026/08/12/reproducible-builds-summit-in-gothenburg/)-related news article. [[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/126f1774)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/194c4f24)]
-* [FIXME](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf)
+* Holger Levsen then published [the same article](https://reproducible-builds.org/news/2026/08/12/reproducible-builds-summit-in-gothenburg/). [[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/12265a52)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/3be2ff73)]
-* [Unsorted xattrs made erofs builds unreproducible across host file systems](https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/commit/?id=b260119b8edba42af444e8f782c81acc0624dcdb)
+* Lastly, a large number of commits were pushed comprising an interview with Reproducible Builds developer Jochen Sprickerhof to be published within the next week. [[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/22f405e8)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/f11b768a)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/953236c7)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/60aa39b1)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/0eb0aa3c)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/53682fea)][[…](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/11cd8461)]
-* [FIXME](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/)
+<br>
-* [FIXME](https://dl.acm.org/doi/pdf/10.1145/3820755.3821482)
+### Six new scholarly papers
-* [FIXME](https://arxiv.org/pdf/2608.18180)
+[![]({{ "/images/reports/2026-08/paper-2607.21888.png#right" | relative_url }})](https://arxiv.org/abs/2607.21888)
-* [LWN FOSSY bootstrappable](https://lwn.net/Articles/1088279/)
+Jens Dietrich, Spencer Sun, Tim W. White and Behnaz Hassanshahi (the result of a collaboration between [Victoria University of Wellington](https://www.wgtn.ac.nz/) and [Oracle Australia](https://www.oracle.com/anz/) published a paper this month entitled [*No Snake Oil: Verifying Python Package Builds*](https://arxiv.org/abs/2607.21888). Drawing on the metaphor of "snake oil", that is, a fake or ineffective medicine or solution sold with exaggerated claims of curing or fixing everything, the authors write that
-* [openSUSE monthly](https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/C7BCS4OC2XPR5ZNOEXCJGP6NXL2W5BNT/)
+> Two tools that are designed to automate [PyPI] rebuilds and run them at scale are `macaron` and `oss-rebuild`. We study 12,180 popular releases from PyPI and find that the byte-for-byte equivalence rate is generally low. We analyse the reasons why they produce different wheels, and find that equivalence between the original and rebuilt wheels can often still be established, preserving most of the guarantees users expect from rebuildable releases. **We present and evaluate daleq4py, a tool to establish the equivalence of Python wheels through the kernel of a normalisation function that is based on provenance-preserving datalog rules. Experimental results show that daleq4py substantially expands the set of rebuilds that can be accepted as equivalent.**
+
+The [full PDF of their paper](https://arxiv.org/pdf/2607.21888) can be viewed online, and Jens Dietrich to [our mailing list](https://lists.reproducible-builds.org/listinfo/rb-general/) to [announce the availability](https://lists.reproducible-builds.org/pipermail/rb-general/2026-August/004146.html) of both the paper and the [`daleq4py` tool](https://github.com/binaryeq/daleq4py/) itself.
+
+<br>
+
+[![]({{ "/images/reports/2026-08/paper-2607.26719.png#right" | relative_url }})](https://arxiv.org/abs/2607.26719)
+
+Dimitri Kokkonis, Michaël Marcozzi and Stefano Zacchiroli published an article this month titled [*Not In My Git Yard: Catching Backdoors at Commit and Release Time*](https://arxiv.org/abs/2607.26719) on the topic of "code-level backdoors" — that is, "stealthy code changes that grant hidden privileges via secret triggers". These issues:
+
+> … pose a persistent threat to opensource software. Known attempts to inject such backdoors into widely used projects through malicious commits, tampered release packages, or compromised third-party dependencies, were stopped only by luck and manual review. Existing Continuous Integration (CI) pipelines cannot detect these attacks, and downstream binary analysis tools require substantial manual effort. **In this work, we present Lily, an automated approach that strengthens open-source development and release processes against backdoor injection. Lily integrates a backdoor detection mechanism into (1) CI pipelines to block malicious commits, and (2) release vetting workflows to prevent tampered releases or compromised dependencies from entering large ecosystems, such as Linux distributions.**
+
+The [full PDF](https://arxiv.org/pdf/2607.26719) can be read online.
+
+<br>
+
+[![]({{ "/images/reports/2026-08/paper-2608.20678.png#right" | relative_url }})](https://arxiv.org/abs/2608.20678)
+
+Ranindya Paramitha and Laurie Williams of North Carolina State University along with Christian Kästner of Carnegie Mellon University published a paper this month with the title of [*The Software Supply Chain as a Market for Lemons: A Multivocal Review of Trust Signal Collapse*](https://arxiv.org/abs/2608.20678). (A ["lemon"](https://en.wikipedia.org/wiki/Lemon_(automobile)) in American English, is a vehicle that "turns out to have several manufacturing defects".) Their abstract is as follows:
+
+> Practitioners evaluating open-source dependencies rely on cheap trust signals, e.g., stars, download counts, and contributor activity, as substitutes for direct code inspection, assuming those signals reflect genuine trustworthiness. Prior work has documented individual signal gaming, but the landscape of collapses across all dependency-adoption signals, as well as the ecosystem’s response, remains unexplored. **The goal of this study is to aid software practitioners in understanding the reliability of dependency adoption trust signals, such as download counts and contributor activity, by conducting a multivocal review of 252 Google Search sources and 870 Reddit threads.**
+
+Worryingly, after their review, the authors conclude that "cheap trust signals collapse under three simultaneous forces: adversarial manipulation, gaming techniques indistinguishable from legitimate behavior, and non-adversarial AI-driven inflation."
+
+The [full PDF of the paper](https://arxiv.org/pdf/2608.20678) is available online.
+
+<br>
+
+[![]({{ "/images/reports/2026-08/paper-2607.24888.png#right" | relative_url }})](https://arxiv.org/abs/2607.24888)
+
+Julien Malka, Aman Sharma, Martin Monperrus, Stefano Zacchiroli and Théo Zimmermann published a paper this month on [*Trusting-Trust Attack against an Entire Linux Distribution through Binary Manipulation*](https://arxiv.org/abs/2607.24888):
+
+> [Ken Thompson's trusting-trust attack](https://en.wikipedia.org/wiki/Backdoor_(computing)#Compiler_backdoors), in which a compromised compiler backdoors the programs it builds and reproduces the backdoor in subsequent rebuilds of itself, is widely regarded as a threat specific to compilers. We show that it is not. **We construct a complete trusting-trust attack around GNU *strip*, an ordinary build utility that neither inspects nor generates source code, using only manipulations of finished ELF files.**
+
+Scarily, in the authors' example, "a single tampered *strip* in the binary seed implants a payload that propagates from one generation of strip to the next and survives into the final standard environment after the seed leaves the dependency closure […] without failures and backdoors".
+
+A [full PDF of the paper](https://arxiv.org/pdf/2607.24888) is available for download online.
+
+<br>
+
+[![]({{ "/images/reports/2026-08/paper-2608.27125.png#right" | relative_url }})](https://arxiv.org/abs/2608.27125)
+
+Mehdi Keshanimm, Amirhossein Rahmati, Mohammad Hossein Aref and Abbas Heydarnoori published a paper that is currently under review at *Emperical Software Engineering* titled [*AROMA+: A Study of Factors Affecting Reproducible Builds in the Maven Ecosystem*](https://arxiv.org/abs/2608.27125). ([Maven](https://maven.apache.org/) is a/the build automation tool used for Java projects.) In their paper, the authors note that
+
+> […] reusing external software in a project presents a security risk when the source of the component is unknown or the consistency of a component cannot be verified. The [SolarWinds attack](https://en.wikipedia.org/wiki/SolarWinds#2019%E2%80%932020_supply_chain_attacks) serves as a popular example in which the injection of malicious code into a library affected thousands of customers and caused a loss of billions of dollars. […] Our research aims to support [reproducibility] efforts in the Maven ecosystem through automation. We investigate the feasibility of automatically finding the source code of a library from its Maven release and recovering information about the original release environment. Our tool, AROMA+, can obtain this critical information from the artifact and the source repository through several heuristics and we use the results for reproduction attempts of packages on Maven Central.
+
+The [full PDF of their article](https://arxiv.org/pdf/2608.27125) can be downloaded online.
+
+<br>
+
+[![]({{ "/images/reports/2026-08/paper-2608.18180.png#right" | relative_url }})](https://arxiv.org/abs/2608.18180)
+
+Lastly, Oreofe Solarin, Kelechi Kalu, James C. Davis and Paschal Amusuo published a paper this month titled [*Reproducibility is Not Enough: Artifact Verifiability in Decentralized-Build Package Ecosystems*](https://arxiv.org/abs/2608.18180):
+
+> [A]rtifact verification requires more than deterministic builds: a verifier must also recover the source state, build environment, dependencies, and build instructions that produced the artifact. Decentralized-build ecosystems make this difficult because artifacts are produced through heterogeneous tools, maintainer-controlled workflows, and fragmented metadata. As a result, it remains unclear how often artifacts in these ecosystems can be independently verified. **This paper studies artifact verifiability across four popular decentralized-build package ecosystems. We define an independent verifier model that relies only on registry-derivable metadata and an artifact comparison model with tiered equivalence levels. We implement these models in an Artifact Verification Pipeline and use it to measure artifact verifiability across the target ecosystems.**
+
+The authors conclude that "beyond build determinism, verifiability is limited by missing source and build metadata, implicit release transformations, and unconventional build practices".
+
+A [PDF](https://arxiv.org/pdf/2608.18180) of their paper can be reviewed online.
+
+<br>
+
+### Patches
+
+The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where applicable or possible. This month, we wrote a large number of such patches, including:
* Bernhard M. Wiedemann:
- * [`python-pook`](https://build.opensuse.org/request/show/1369446) (nocheck)
- * [`python-pyzmq`](https://build.opensuse.org/request/show/1369499) (random tmp path)
- * [`java-21-openj9`](https://build.opensuse.org/request/show/1369973) (date)
- * [`java-25-openj9`](https://build.opensuse.org/request/show/1369976) (date)
- * [`ceph`](https://build.opensuse.org/request/show/1370073) (zip mtime)
- * [`gri`](https://build.opensuse.org/request/show/1370260) (ps timestamp)
- * [`ksh`](https://build.opensuse.org/request/show/1370294) (date+memory)
- * [`gputils/sdcc`](https://build.opensuse.org/request/show/1370297) (toolchain date)
- * [`python-langgraph`](https://build.opensuse.org/request/show/1371636) (nocheck)
- * [`sbcl`](https://build.opensuse.org/request/show/1371634) (date ; CPU ; partial fix)
- * [`python-xgrammar`](https://build.opensuse.org/request/show/1371724) (.a LTO wheel RECORD)
- * [`mingw64-filesystem`](https://build.opensuse.org/request/show/1371702) (toolchain, race)
- * [`Rivet`](https://build.opensuse.org/request/show/1371954) (parallelism, random)
- * [`python-PyMuPDF`](https://build.opensuse.org/request/show/1373241) (random + ar mtime)
- * [`git-annex`](https://build.opensuse.org/request/show/1373692) (bug)
- * [`maxima`](https://build.opensuse.org/request/show/1373751) (bug)
- * [`python-gguf`](https://build.opensuse.org/request/show/1373864) (nocheck)
- * [`python-xlsx2csv`](https://build.opensuse.org/request/show/1373248) (date)
- * [`scons`](https://build.opensuse.org/request/show/1374393) (toolchain, date for nst)
- * [`llvm22`](https://build.opensuse.org/request/show/1374284) (#https://github.com/llvm/llvm-project/pull/219380 toolchain for cosmic-bg, random hash)
- * [`qt6-tools`](https://build.opensuse.org/request/show/1370201) (toolchain for qt6-base )
- * [`Botan`](https://bugzilla.opensuse.org/show_bug.cgi?id=1274324) (FTBFS-2029)
- * [`gcc/esbuild`](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108534#c3) (toolchain)
- * [`go1.27/esbuild`](https://build.opensuse.org/request/show/1373163) (toolchain, random, [upstreaming](https://github.com/golang/go/pull/81041))
- * [`obs`](https://github.com/openSUSE/obs-build/pull/1164) (toolchain for altimagebuild)
- * [`lutgen`](https://github.com/ozwaldorf/lutgen-rs/pull/46) (nocheck)
- * [`virtualbox`](https://github.com/VirtualBox/virtualbox/pull/827) (random UUID, fix 1/3)
- * [`zabbix`](https://github.com/zabbix/zabbix/pull/184) (date)
- * [`grass`](https://github.com/OSGeo/grass/pull/7849) (date/mtime)
- * [`fritzing`](https://github.com/fritzing/fritzing-app/pull/4336) (random)
- * [`xpenguins`](https://gitlab.com/wvermin/xpenguins/-/merge_requests/1) (date)
- * [`llvm`](https://github.com/llvm/llvm-project/pull/219384) (toolchain, random hash)
- * [`llvm`](https://github.com/llvm/llvm-project/pull/219388) (toolchain, random hash)
- * [`efl`](https://git.enlightenment.org/enlightenment/efl/pulls/148) (toolchain, bug / hash collision / mem-reuse)
- * [`dmd`](https://github.com/dlang/dmd/pull/23746) (sort ASLR)
- * [`neochat`](https://invent.kde.org/network/neochat/-/merge_requests/2987) (race qmlcachegen)
- * [`cosmic/xdgen`](https://github.com/pop-os/xdgen/pull/2) (toolchain, hash for cosmic-*)
- * [`dvgt`](https://build.opensuse.org/request/show/1374399) (date from toolchain tex)
- * [`cpio`](https://build.opensuse.org/request/show/1374640) (mtime + unrelated bug)
- * [`boost`](https://build.opensuse.org/request/show/1374641) (race + y2038)
- * [`firefox-esr`](https://build.opensuse.org/request/show/1375163) (PGO)
+ * [`Botan`](https://bugzilla.opensuse.org/show_bug.cgi?id=1274324)
+ * [`Rivet`](https://build.opensuse.org/request/show/1371954)
+ * [`boost`](https://build.opensuse.org/request/show/1374641)
+ * [`ceph`](https://build.opensuse.org/request/show/1370073)
+ * [`cosmic/xdgen`](https://github.com/pop-os/xdgen/pull/2)
+ * [`cpio`](https://build.opensuse.org/request/show/1374640)
+ * [`dmd`](https://github.com/dlang/dmd/pull/23746)
+ * [`dvgt`](https://build.opensuse.org/request/show/1374399)
+ * [`efl`](https://git.enlightenment.org/enlightenment/efl/pulls/148)
+ * [`firefox-esr`](https://build.opensuse.org/request/show/1375163)
+ * [`fritzing`](https://github.com/fritzing/fritzing-app/pull/4336)
+ * [`gcc/esbuild`](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108534#c3)
+ * [`git-annex`](https://build.opensuse.org/request/show/1373692)
+ * [`go1.27/esbuild`](https://build.opensuse.org/request/show/1373163)
+ * [`gputils/sdcc`](https://build.opensuse.org/request/show/1370297)
+ * [`grass`](https://github.com/OSGeo/grass/pull/7849)
+ * [`gri`](https://build.opensuse.org/request/show/1370260)
+ * [`java-21-openj9`](https://build.opensuse.org/request/show/1369973)
+ * [`java-25-openj9`](https://build.opensuse.org/request/show/1369976)
+ * [`ksh`](https://build.opensuse.org/request/show/1370294)
+ * [`llvm22`](https://build.opensuse.org/request/show/1374284)
+ * [`llvm`](https://github.com/llvm/llvm-project/pull/219384)
+ * [`llvm`](https://github.com/llvm/llvm-project/pull/219388)
+ * [`lutgen`](https://github.com/ozwaldorf/lutgen-rs/pull/46)
+ * [`maxima`](https://build.opensuse.org/request/show/1373751)
+ * [`mingw64-filesystem`](https://build.opensuse.org/request/show/1371702)
+ * [`neochat`](https://invent.kde.org/network/neochat/-/merge_requests/2987)
+ * [`obs`](https://github.com/openSUSE/obs-build/pull/1164)
+ * [`python-PyMuPDF`](https://build.opensuse.org/request/show/1373241)
+ * [`python-gguf`](https://build.opensuse.org/request/show/1373864)
+ * [`python-langgraph`](https://build.opensuse.org/request/show/1371636)
+ * [`python-pook`](https://build.opensuse.org/request/show/1369446)
+ * [`python-pyzmq`](https://build.opensuse.org/request/show/1369499)
+ * [`python-xgrammar`](https://build.opensuse.org/request/show/1371724)
+ * [`python-xlsx2csv`](https://build.opensuse.org/request/show/1373248)
+ * [`qt6-tools`](https://build.opensuse.org/request/show/1370201)
+ * [`sbcl`](https://build.opensuse.org/request/show/1371634)
+ * [`scons`](https://build.opensuse.org/request/show/1374393)
+ * [`virtualbox`](https://github.com/VirtualBox/virtualbox/pull/827)
+ * [`xpenguins`](https://gitlab.com/wvermin/xpenguins/-/merge_requests/1)
+ * [`zabbix`](https://github.com/zabbix/zabbix/pull/184)
+
+* Chris Lamb:
+
+ * [#1143615](https://bugs.debian.org/1143615) filed against [`keychain`](https://tracker.debian.org/pkg/keychain).
+ * [#1143616](https://bugs.debian.org/1143616) filed against [`python-nameparser`](https://tracker.debian.org/pkg/python-nameparser).
+ * [#1143617](https://bugs.debian.org/1143617) filed against [`lcov`](https://tracker.debian.org/pkg/lcov).
+ * [#1144065](https://bugs.debian.org/1144065) filed against [`displaycal-py3`](https://tracker.debian.org/pkg/displaycal-py3).
+ * [#1144066](https://bugs.debian.org/1144066) filed against [`redmine`](https://tracker.debian.org/pkg/redmine).
+ * [#1144407](https://bugs.debian.org/1144407) filed against [`django-htmx`](https://tracker.debian.org/pkg/django-htmx).
+ * [#1144409](https://bugs.debian.org/1144409) filed against [`pybdsf`](https://tracker.debian.org/pkg/pybdsf).
+ * [#1145914](https://bugs.debian.org/1145914) filed against [`golang-github-adamkorcz-go-fuzz-headers-1`](https://tracker.debian.org/pkg/golang-github-adamkorcz-go-fuzz-headers-1).
+ * [#1145915](https://bugs.debian.org/1145915) filed against [`googletest`](https://tracker.debian.org/pkg/googletest).
+
+* Jochen Sprickerhof:
+
+ * [#1145443](https://bugs.debian.org/1145443) filed against [`cross-toolchain-base`](https://tracker.debian.org/pkg/cross-toolchain-base).
+ * [#1146088](https://bugs.debian.org/1146088) filed against [`ferret-vis`](https://tracker.debian.org/pkg/ferret-vis).
+
+* Robin Candau:
+
+ * [`bashburn`](https://codeberg.org/aelinden/BashBurn/pulls/1)
+ * [`LMMS`](https://github.com/LMMS/lmms/pull/8494)
+
* Werner Fink:
+
* [`bash`](https://build.opensuse.org/request/show/1364197)
-* [FIXME](https://arxiv.org/pdf/2608.20678)
+<br>
+<br>
-* [FIXME](https://arxiv.org/pdf/2608.27125)
+If you are interested in contributing to the project, please visit our [*Contribute*]({{ "/contribute/" | relative_url }}) page on our website.
+{: .small}
=====================================
images/reports/2026-07/opensuse.png
=====================================
Binary files /dev/null and b/images/reports/2026-07/opensuse.png differ
=====================================
images/reports/2026-08/debian.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/debian.png differ
=====================================
images/reports/2026-08/diffoscope.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/diffoscope.png differ
=====================================
images/reports/2026-08/opensuse.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/opensuse.png differ
=====================================
images/reports/2026-08/openwrt-rebuilderd.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/openwrt-rebuilderd.png differ
=====================================
images/reports/2026-08/openwrt.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/openwrt.png differ
=====================================
images/reports/2026-08/paper-2607.21888.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-2607.21888.png differ
=====================================
images/reports/2026-08/paper-2607.24888.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-2607.24888.png differ
=====================================
images/reports/2026-08/paper-2607.26719.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-2607.26719.png differ
=====================================
images/reports/2026-08/paper-2608.18180.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-2608.18180.png differ
=====================================
images/reports/2026-08/paper-2608.20678.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-2608.20678.png differ
=====================================
images/reports/2026-08/paper-2608.27125.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-2608.27125.png differ
=====================================
images/reports/2026-08/paper-fdroid.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-fdroid.png differ
=====================================
images/reports/2026-08/paper-snakeoil.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-snakeoil.png differ
=====================================
images/reports/2026-08/paper-vcaligner.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/paper-vcaligner.png differ
=====================================
images/reports/2026-08/reproducible-builds.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/reproducible-builds.png differ
=====================================
images/reports/2026-08/website.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/website.png differ
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/compare/7e141852c0b9519934f6ddda34e79a37cbf9de3a...7f69a4f6a60dafd5833f3facc4fe40257900adb6
--
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/compare/7e141852c0b9519934f6ddda34e79a37cbf9de3a...7f69a4f6a60dafd5833f3facc4fe40257900adb6
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-commits/attachments/20260909/0bc5db3c/attachment.htm>
More information about the rb-commits
mailing list