[Git][reproducible-builds/reproducible-website][master] 2 commits: Misc changes prior to publication.

Fri Sep 11 10:13:05 UTC 2026


Chris Lamb pushed to branch master at Reproducible Builds / reproducible-website


Commits:
d0052cd9 by Chris Lamb at 2026-09-11T11:12:41+01:00
Misc changes prior to publication.

- - - - -
7c6a6b88 by Chris Lamb at 2026-09-11T11:12:50+01:00
published as https://reproducible-builds.org/reports/2026-08/

- - - - -


5 changed files:

- _reports/2026-08.md
- − images/reports/2026-07/diffoscope.png
- + images/reports/2026-08/2026_cisa_sbom_minimum_elements_508c.png
- + images/reports/2026-08/fossy-sample-sm.png
- + images/reports/2026-08/pypi.png


Changes:

=====================================
_reports/2026-08.md
=====================================
@@ -3,7 +3,8 @@ layout: report
 year: "2026"
 month: "08"
 title: "Reproducible Builds in August 2026"
-draft: true
+draft: false
+date: 2026-09-11 10:12:50
 ---
 
 **Welcome to the August 2026 report from the [Reproducible Builds](https://reproducible-builds.org) project!**
@@ -14,19 +15,24 @@ draft: true
 
 In our reports, we try to outline the most important things that we have been up to over the past month. As a quick recap about what problem our project intends to solve, whilst anyone may inspect the source code of free software for malicious flaws, almost all software is distributed to end users as pre-compiled binaries. The motivation behind the reproducible builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised or not.
 
-<!--
-
 In this month's report, we cover:
 
-0. Automatically generated prior to publication
-
--->
+0. [New updated SBOM specification from CISA.gov](#new-updated-sbom-specification-from-cisagov)
+0. [LWN on Bootstrappable builds at FOSSY 2026](#lwn-on-bootstrappable-builds-at-fossy-2026)
+0. [”What’s missing to have reproducible builds on PyPI?”](#whats-missing-to-have-reproducible-builds-on-pypi)
+0. [Distribution work](#distribution-work)
+0. [Unreproducible builds under EROFS filesystem fixed](#unreproducible-builds-under-erofs-filesystem-fixed)
+0. [Tool and documentation development](#tool-and-documentation-development)
+0. [Six new scholarly papers](#six-new-scholarly-papers)
+0. [Patches](#patches)
 
 ---
 
 ### New updated SBOM specification from CISA.gov
 
-[CISA](https://en.wikipedia.org/wiki/Cybersecurity_and_Infrastructure_Security_Agency), the Cybersecurity and Infrastructure Security Agency of the U.S. government published some the joint guidance entitled *[Minimum Elements for a Software Bill of Materials*](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf) (SBOM), which updates and supersedes the baseline 2021 version covered in previous editions of these reports.
+[![]({{ "/images/reports/2026-08/2026_cisa_sbom_minimum_elements_508c.png#right" | relative_url }})](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf)
+
+[CISA](https://en.wikipedia.org/wiki/Cybersecurity_and_Infrastructure_Security_Agency), the Cybersecurity and Infrastructure Security Agency of the U.S. government published some the joint guidance entitled [*Minimum Elements for a Software Bill of Materials*](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf) (SBOM), which updates and supersedes the baseline 2021 version covered in previous editions of these reports.
 
 Whilst [the PDF](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf) is worth skimming, the interesting changes include that the specification now mandates standard cryptographic hashes: unlike earlier standards that allowed hash omission or manifest-only parsing, hashes must be computed from the output. This is is important for reproducible builds, as it ensures the recording of the metadata required to demonstrate the shipped software matches the build output precisely where applicable. In addition, where the top-level only dependency limitation that was present in the 2021 version has been removed in favour of complete coverage with no minimum depth. That is, SBOMs are expected to reflect all linked libraries, vendored dependencies and other build-time inclusions.
 
@@ -34,7 +40,9 @@ Whilst [the PDF](https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom
 
 ### LWN on Bootstrappable builds at FOSSY 2026
 
-In the "Toolchains and Other Development Tools" track at [Software Freedom Conservancy](https://sfconservancy.org/)'s [FOSSY 2026](https://2026.fossy.ca/) in British Columbia, Canada, Timothy Sample gave a presentation on [bootstrappable builds](https://bootstrappable.org/). This [presentation was then covered](https://lwn.net/Articles/1088279/) in a [Linux Weekly News](https://lwn.net/) article by Jake Edge entitled [*Bootstrappable builds: how and why*](https://lwn.net/Articles/1088279/*](https://lwn.net/Articles/1088279/), which serves as an excellent introduction to the concept:
+[![]({{ "/images/reports/2026-08/fossy-sample-sm.png#right" | relative_url }})](https://lwn.net/Articles/1088279/)
+
+In the "Toolchains and Other Development Tools" track at [Software Freedom Conservancy](https://sfconservancy.org/)'s [FOSSY 2026](https://2026.fossy.ca/) in British Columbia, Canada, Timothy Sample gave a presentation on [bootstrappable builds](https://bootstrappable.org/). This [presentation was then covered](https://lwn.net/Articles/1088279/) in a [Linux Weekly News](https://lwn.net/) article by Jake Edge entitled [*Bootstrappable builds: how and why*](https://lwn.net/Articles/1088279/), which serves as an excellent introduction to the concept:
 
 
 > The basic idea behind bootstrappable builds is to create a system that can be built without relying on pre-built artifacts. "Can we go from zero to the modern day without having to just assume the existence of these already-built-for-us artifacts?" The classic recipe for yogurt requires some yogurt to start the process, which is like how we normally build a C compiler today—we start with an existing C compiler binary. You might think about making sourdough bread with your grandmother's starter brought over from the old country; "we're basically making C compilers with Dennis Ritchie's starter carried over from Bell Labs".
@@ -45,6 +53,8 @@ The article, which goes on to cover GNU Mes and other projects that overlap with
 
 ### "[*What's missing to have reproducible builds on PyPI?*](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/)"
 
+[![]({{ "/images/reports/2026-08/pypi.png#right" | relative_url }})](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/)
+
 Core Python developer, [Brett Cannon](https://snarky.ca/) wrote an interesting blog post this month addressing [*What's missing to have reproducible builds on PyPI*](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/), the [official public repository for third-party Python software packages](https://pypi.org/):
 
 > The reason I like the idea of making reproducible builds work is that I think it can be done in such a way as to not require any work on the part of the producer of a distribution (which is a technical term for sdists or wheels, i.e., the people who upload stuff to PyPI), and thus make reproducible builds very low-friction for people to opt into supporting. [[…](https://snarky.ca/whats-missing-to-have-reproducible-builds-on-pypi/)]
@@ -77,7 +87,7 @@ Thankfully, Martin also reported that [they had fixed this in a commit to the ke
 
 ### Tool and documentation development
 
-[![]({{ "/images/reports/2026-87/diffoscope.png#right" | relative_url }})](https://diffoscope.org/)
+[![]({{ "/images/reports/2026-08/diffoscope.png#right" | relative_url }})](https://diffoscope.org/)
 
 [**diffoscope**](https://diffoscope.org) is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb made a number of chnages, including preparing and uploading versions `327`, `328` and `329` to Debian. In particular, he ensured that *diffoscope* did not require *python3-guestfs* in the autopkgtests on 32-bit architectures in order to fix Debian bug ([#1144372](https://bugs.debian.org/1144372)) [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/5440dd50)]. Colin Watson made an additional change, handling a potentially missing `openssh-client` package when running the autopkgtests [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/a4fd009a)], and Jochen Sprickerhof made a similar change to cope with missing `cpio` and `qemu-img` functionality [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/ae4f6f86)] whilst also updating the XML comparator to be considered when comparing SVG images [[…](https://salsa.debian.org/reproducible-builds/diffoscope/commit/c7f23bb0)].
 


=====================================
images/reports/2026-07/diffoscope.png deleted
=====================================
Binary files a/images/reports/2026-07/diffoscope.png and /dev/null differ


=====================================
images/reports/2026-08/2026_cisa_sbom_minimum_elements_508c.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/2026_cisa_sbom_minimum_elements_508c.png differ


=====================================
images/reports/2026-08/fossy-sample-sm.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/fossy-sample-sm.png differ


=====================================
images/reports/2026-08/pypi.png
=====================================
Binary files /dev/null and b/images/reports/2026-08/pypi.png differ



View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/compare/b912567550d3856bc743e4b8cd611c8c30e6fb71...7c6a6b88b9b92d849d1f0d69792e2dc0804f2635

-- 
View it on GitLab: https://salsa.debian.org/reproducible-builds/reproducible-website/-/compare/b912567550d3856bc743e4b8cd611c8c30e6fb71...7c6a6b88b9b92d849d1f0d69792e2dc0804f2635
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.reproducible-builds.org/pipermail/rb-commits/attachments/20260911/abc54854/attachment.htm>
