Reproducible builds in November 2023

Chris Lamb chris at reproducible-builds.org
Wed Dec 6 15:21:05 UTC 2023 

--------------------------------------------------------------------
        o
      ⬋   ⬊      October 2023 in Reproducible Builds
     o     o
      ⬊   ⬋      https://reproducible-builds.org/reports/2023-10/
        o
--------------------------------------------------------------------

Welcome to the November 2023 report from the Reproducible Builds
project! In these reports we outline the most important things that we
have been up to over the past month. As a rather rapid recap, whilst
anyone may inspect the source code of free software for malicious
flaws, almost all software is distributed to end users as pre-compiled
binaries.

You can find out more about our project here:

    https://reproducible-builds.org/#why-does-it-matter


                                §§§


## Reproducible Builds Summit 2023

Between October 31st and November 2nd, we held our seventh
Reproducible Builds Summit [2] in Hamburg, Germany! Amazingly, the
agenda and all notes from all sessions [3] are all online — many
thanks to everyone who wrote notes from the sessions.

As a followup on one idea, started at the summit, Alexander Couzens
and Holger Levsen started work on a cache (or tailored front-end) for
the *snapshot.debian.org* [4] service. The general idea is that, when
rebuilding Debian, you do not actually need the whole ~140TB of data
from *snapshot.debian.org*; rather, only a very small subset of the
packages are ever used for for building. It turns out, for amd64,
arm64, armhf, i386, ppc64el, riscv64 and s390 for Debian trixie,
unstable and experimental, this is only around 500GB — ie.  less than
1%. Although the new service not yet ready for usage, it has already
provided a promising outlook in this regard. More information is
available on https://rebuilder-snapshot.debian.net [5] and we hope
that this service becomes usable in the coming weeks.

The picture on our website shows a sticky note authored by
Jan-Benedict Glaw at the summit in Hamburg, confirming Holger Levsen's
theory that rebuilding all Debian packages needs a very small subset
of packages, the text states that 69,200 packages (in Debian sid)
list 24,850 packages in their .buildinfo files, in 8,0200 variations.
This little piece of paper was the beginning of rebuilder-snapshot
and is a direct outcome of the summit!

The Reproducible Builds team would like to thank our event sponsors
who include Mullvad VPN [6], openSUSE [7], Debian [8], Software
Freedom Conservancy [9], Allotropia [10] and Aspiration Tech [11].

 [2] https://reproducible-builds.org/events/hamburg2023/
 [3] https://reproducible-builds.org/events/hamburg2023/agenda/
 [4] https://snapshot.debian.org
 [5] https://rebuilder-snapshot.debian.net
 [6] https://mullvad.net/
 [7] https://www.opensuse.org/
 [8] https://www.debian.org/
 [9] https://sfconservancy.org/
 [10] https://www.debian.org/
 [11] https://aspirationtech.org/


                                §§§


## Beyond Trusting FOSS presentation at SeaGL

On November 4th, Vagrant Cascadian presented Beyond Trusting FOSS [12]
at SeaGL [13] in Seattle, WA in the United States. Founded in 2013,
SeaGL is a free, grassroots technical summit dedicated to spreading
awareness and knowledge about free source software, hardware and
culture. The summary of Vagrant's talk mentions that it will:

> […] introduce the concepts of Reproducible Builds, including best
> practices for developing and releasing software, the tools available
> to help diagnose issues, and touch on progress towards solving
> decades-old deeply pervasive fundamental security issues... Learn
> how to verify and demonstrate trust, rather than simply hoping
> everything is OK!

Germane to the contents of the talk, the slides for Vagrant's talk
[14] can be built reproducibly, resulting in a PDF with a SHA1 of
cfde2f8a0b7e6ec9b85377eeac0661d728b70f34 when built on Debian
bookworm and c21fab273232c550ce822c4b0d9988e6c49aa2c3 on Debian
sid… at the time of writing.

 [12] https://osem.seagl.org/conferences/seagl2023/program/proposals/939
 [13] https://seagl.org/
 [14] https://salsa.debian.org/reproducible-builds/reproducible-presentations/-/tree/master/2023-11-04-SeaGL-Beyond-Trusting-FOSS


                                §§§


## Human Factors in Software Supply Chain Security

Marcel Fourné, Dominik Wermke, Sascha Fahl and Yasemin Acar have
published an article in a Special Issue of the IEEE's Security &
Privacy [15] magazine. Entitled "A Viewpoint on Human Factors in
Software Supply Chain Security: A Research Agenda", the paper justifies
the need for reproducible builds to reach developers and end-users
specifically, and furthermore points out some under-researched topics
that we have seen mentioned in interviews. An author pre-print of the
article [16] is available in PDF form.

 [15] https://ieeexplore.ieee.org/xpl/RecentIssue.jsp?punumber=8013
 [16] https://marcelfourne.de/fourne-sc-agenda-2023.pdf


                                §§§


## Community updates

On our mailing list [17] this month:

* Julien Lepiller mentioned [18] that they were interested in
  translating our website [19], and provided offered GNU Guix's
  translation framework [20] (Weblate [21]) as a potential model
  to emulate.

* Bernhard M. Wiedemann posted a positive "LibreOffice success story
  [22]" documenting that, after some work:

    > […] today I hold in my hands the first two bit-identical
    > LibreOffice rpm packages. And this is the success I wanted to
    > share with you all today [and] it makes me feel as if we can
    > solve anything.

* kpcyrd reported on their excellent results with making esp32c3
  microcontroller firmware reproducible with Rust, repro-env and Arch
  Linux [23]:

    > I chose the esp32c3 [board] because it has good Rust support
    from the esp-rs project [24], and you can get a dev board for
    about 6-8€. To document my build environment I used repro-env
    [25] together with Arch Linux because its archive [26] is very
    reliable and contains all the different Rust development tools
    I needed.

* Separate to their work on LibreOffice however, Bernhard M. Wiedemann
  also requested assistance [27] with a number of packages that so far
  refuse to build reproducibly. He writes that "the common theme
  around them is that they use scheme or lisp to produce binaries with
  a dump command" and hopes that someone may be able to help.

" Finally, Fay Stegerman regrettably reports that she will no longer
  be able to work on Android reproducible builds [28] nor update the
  Reproducible Builds community with the status of reproducibility
  within F-Droid.

 [17] https://lists.reproducible-builds.org/listinfo/rb-general/
 [18] https://lists.reproducible-builds.org/pipermail/rb-general/2023-November/003115.html
 [19] https://reproducible-builds.org/
 [20] https://translate.fedoraproject.org/projects/guix/website/nl/
 [21] https://weblate.org/en-gb/
 [22] https://lists.reproducible-builds.org/pipermail/rb-general/2023-November/003121.html
 [23] https://lists.reproducible-builds.org/pipermail/rb-general/2023-November/003205.html
 [24] https://github.com/esp-rs
 [25] https://github.com/kpcyrd/repro-env
 [26] https://archive.archlinux.org/
 [27] https://lists.reproducible-builds.org/pipermail/rb-general/2023-November/003195.html
 [28] https://lists.reproducible-builds.org/pipermail/rb-general/2023-November/003201.html


                                §§§


## openSUSE updates

Bernhard M. Wiedemann has created a wiki page [29] outlining an
proposal to create a general-purpose Linux distribution which consists
of 100% bit-reproducible packages… albeit minus the embedded signature
within RPM files. It would be based on openSUSE Tumbleweed or, if
available, its Slowroll-variant.

In addition, Bernhard posted another monthly update [30] for his work
elsewhere in openSUSE.

 [29] https://en.opensuse.org/openSUSE:Reproducible_openSUSE
 [30] https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/VWWVEPYEUBBMZN6K7VGUU5KKC7CBSSM2/


                                §§§


## Reproducibility-related changes in Debian

As recently reported in the most recent Debian Developer News [31],
Paul Gevers has integrated a package's reproducibility status into the
way Debian 'migrates' packages into the next stable release. For the
amd64, arm64, i386 and armhf architectures, data is collected from the
Reproducible Builds testing framework [32] is collected by this
migration software even though, at the time of writing, it neither
causes nor migration bonuses nor blocks migration. Indeed, the
information only results are visible on Britney's "excuses" [33] as
well as on individual packages' pages on tracker.debian.org [34].

 [31] https://lists.debian.org/debian-devel-announce/2023/11/msg00003.html
 [32] https://tests.reproducible-builds.org/debian
 [33] https://release.debian.org/britney/update_excuses.html
 [34] https://tracker.debian.org


                                §§§


## Ubuntu Launchpad now supports .buildinfo files

Back in 2017, Steve Langasek filed a bug [35] against Ubuntu's
Launchpad code hosting platform [36] to report that .changes files
(artifacts of building Ubuntu and Debian packages) reference
.buildinfo files that aren't actually exposed by Launchpad itself.
This was causing issues when attempting to process .changes files with
tools such as Lintian [37]. However, it was noticed last month that,
in early August of this year, Simon Quigley had resolved this issue,
and .buildinfo files are now available from the Launchpad system.

 [35] https://bugs.launchpad.net/launchpad/+bug/1686242
 [36] https://launchpad.net
 [37] https://lintian.debian.org


                                §§§


## PHP reproducibility updates

There have been two updates from the PHP programming language
this month.

Firstly, the widely-deployed PHPUnit [38] framework for the PHP
programming language have recently released version 10.5.0, which
introduces the inclusion of a composer.lock file, ensuring total
reproducibility of the shipped binary file. Further details and the
discussion that went into their particular implementation can be found
on the associated GitHub pull request [39].

In addition, the presentation "Leveraging Nix in the PHP ecosystem"
[40] has been given in late October at the PHP International
Conference in Munichby Pol Dellaiera [41]. While the video replay is
not yet available, the (reproducible) presentation slides and speaker
notes [42] are available.

 [38] https://phpunit.de/
 [39] https://github.com/sebastianbergmann/phpunit/pull/5576
 [40] https://phpconference.com/web-development/leveraging-nix-php-ecosystem/
 [41] https://github.com/drupol
 [42] https://github.com/drupol/ipc2023/releases/tag/v23-79efbb4c24ab0d42c73906d16233a79d9659c5ca


                                §§§


## diffoscope changes

diffoscope [43] is our in-depth and content-aware diff utility that
can locate and diagnose reproducibility issues. This month, Chris Lamb
made a number of changes, including:

* Improving DOS/MBR extraction by adding support for 7z. [44]
* Adding a missing RequiredToolNotFound import. [45]
* As a UI/UX improvement, try and avoid printing an extended traceback
  if diffoscope runs out of memory. [46]
* Mark diffoscope as 'stable' on PyPI.org [47]. [48]
* Uploading version 252 to Debian unstable. [49]

 [43] https://diffoscope.org
 [44] https://salsa.debian.org/reproducible-builds/diffoscope/commit/59b86c1f
 [45] https://salsa.debian.org/reproducible-builds/diffoscope/commit/64ed5f38
 [46] https://salsa.debian.org/reproducible-builds/diffoscope/commit/bb887ddb
 [47] https://pypi.org/
 [48] https://salsa.debian.org/reproducible-builds/diffoscope/commit/e5e8d51e
 [49] https://tracker.debian.org/news/1479028/accepted-diffoscope-252-source-into-unstable/


                                §§§


## Website updates

A huge number of notes [50] were added to our website that were taken
at our recent Reproducible Builds Summit [51] held between October
31st and November 2nd in Hamburg, Germany. In particular, a big thanks
to Arnout Engelen, Bernhard M. Wiedemann, Daan De Meyer, Evangelos
Ribeiro Tzaras, Holger Levsen and Orhun Parmaksız.

In addition to this, a number of other changes were made, including:

* Chris Lamb migrated the website's homepage [52] to a "hero" image
  [53] [54], improved the documentation related to SOURCE_DATE_EPOCH
  and CMake [55] [56], added iomart [57] (neé Bytemark) and
  DigitalOcean [58] to our sponsors page [59] [60] and dropped an
  unnecessary link on some horizontal navigation buttons [61].

* Holger Levsen also made a large number of notes pages [62] from our
  2022 summit in Venice [63] [64], migrated the website's syntax
  highlighter from Pygments to Rouge [65][66], fixed some grammar on
  our donate page [67][68][69][70] and did a lot of updates to the
  Hamburg Summit's general information page [71][72].

 [50] https://reproducible-builds.org/events/hamburg2023/agenda/
 [51] https://reproducible-builds.org/events/hamburg2023/
 [52] https://reproducible-builds.org/
 [53] https://www.optimizely.com/optimization-glossary/hero-image/
 [54] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/2f50ba8a
 [55] https://reproducible-builds.org/docs/source-date-epoch/#cmake
 [56] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/ee0d0e19
 [57] https://www.iomart.com/
 [58] https://www.digitalocean.com/
 [59] https://reproducible-builds.org/who/sponsors/
 [60] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/16b73a33
 [61] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/25cd328b
 [62] https://reproducible-builds.org/events/venice2022/agenda/
 [63] https://reproducible-builds.org/events/venice2022/
 [64] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/65072a36
 [65] https://rouge.jneen.net/
 [66] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/5d46ea5d
 [67] https://reproducible-builds.org/donate/
 [68] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/0343dfea
 [69] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/24bf9105
 [70] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/31b26b15
 [71] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/c8a86c6b
 [72] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/66691658


                                §§§


## Upstream patches

The Reproducible Builds project detects, dissects and attempts to fix as
many currently-unreproducible packages as possible. We endeavour to send
all of our patches upstream where appropriate. This month, we wrote a
large number of such patches, including:

* Bernhard M. Wiedemann:

    * amber-cli [73] (date-related issue)
    * bin86 [74] (FTBFS-2038)
    * buildah [75] (timestamp)
    * colord [76] (CPU)
    * google-noto-fonts [77] (file modification issue)
    * grub2 [78] (directory-related metadata)
    * guile-fibers [79] (parallelism issue)
    * guile-newt [80] (parallelism issue)
    * gutenprint [81] (embedded date/hostname)
    * hub [82] (random build path)
    * ipxe [83] (nondeterministic behavoiour)
    * joker [84] / joker [85]
    * kopete [86] (undefined behaviour)
    * kraft [87] (embedde hostname)
    * libcamera [88] (signature)
    * libguestfs [89] (embeds build host file)
    * llvm [90] (toolchain/Rust-related issue)
    * nfdump [91] (date-related issue)
    * ovmf [92] (unknown cause)
    * quazip [93] (missing fonts)
    * rdflib [94] (nondeterminstic behaviour)
    * rpm [95] (toolchain)
    * tigervnc [96] (embedded an RSA signature)
    * whatsie [97] (date-related issue)
    * xen [98] (time-related issue)

* Cathy Hu:

    * policycoreutils [99] (sort-related issue)

* Chris Lamb:

    * #1055919 [100] filed against python-ansible-pygments [101].
    * #1055920 [102] filed against bidict [103].
    * #1056117 [104] filed against meson [105].
    * #1056118 [106] filed against radsecproxy [107].
    * #1056119 [108] filed against taffybar [109].
    * #1056398 [110] filed against php-doc [111].
    * #1056571 [112] filed against pelican [113].
    * #1056572 [114] filed against maildir-utils [115].
    * #1056573 [116] filed against openmrac-data [117].
    * #1056649 [118] filed against vectorscan [119].

* Vagrant Cascadian:

    * #1055969 [120] filed against kuttypy [121].

 [73] https://build.opensuse.org/request/show/1125191
 [74] https://bugzilla.opensuse.org/show_bug.cgi?id=1217049
 [75] https://github.com/containers/buildah/issues/5191
 [76] https://github.com/omgovich/colord/issues/122
 [77] https://build.opensuse.org/request/show/1127255
 [78] https://bugzilla.opensuse.org/show_bug.cgi?id=1217619
 [79] https://build.opensuse.org/request/show/1127368
 [80] https://build.opensuse.org/request/show/1127367
 [81] https://build.opensuse.org/request/show/1128769
 [82] https://github.com/mislav/hub/pull/3344
 [83] https://github.com/ipxe/ipxe/pull/1082
 [84] https://github.com/candid82/joker/pull/490
 [85] https://github.com/candid82/joker/issues/491
 [86] https://invent.kde.org/network/kopete/-/merge_requests/14
 [87] https://github.com/dragotin/kraft/pull/215
 [88] https://bugzilla.opensuse.org/show_bug.cgi?id=1217690
 [89] https://bugzilla.opensuse.org/show_bug.cgi?id=1216986
 [90] https://github.com/llvm/llvm-project/issues/72206
 [91] https://github.com/phaag/nfdump/pull/482
 [92] https://bugzilla.opensuse.org/show_bug.cgi?id=1217704
 [93] https://build.opensuse.org/request/show/1129303
 [94] https://github.com/RDFLib/rdflib/issues/2645
 [95] https://github.com/rpm-software-management/rpm/pull/2762
 [96] https://build.opensuse.org/request/show/1129040
 [97] https://github.com/keshavbhatt/whatsie/pull/146
 [98] https://build.opensuse.org/request/show/1127661
 [99] https://github.com/SELinuxProject/selinux/commit/84e0884260c550ef840de6d09573444d93fb209a
 [100] https://bugs.debian.org/1055919
 [101] https://tracker.debian.org/pkg/python-ansible-pygments
 [102] https://bugs.debian.org/1055920
 [103] https://tracker.debian.org/pkg/bidict
 [104] https://bugs.debian.org/1056117
 [105] https://tracker.debian.org/pkg/meson
 [106] https://bugs.debian.org/1056118
 [107] https://tracker.debian.org/pkg/radsecproxy
 [108] https://bugs.debian.org/1056119
 [109] https://tracker.debian.org/pkg/taffybar
 [110] https://bugs.debian.org/1056398
 [111] https://tracker.debian.org/pkg/php-doc
 [112] https://bugs.debian.org/1056571
 [113] https://tracker.debian.org/pkg/pelican
 [114] https://bugs.debian.org/1056572
 [115] https://tracker.debian.org/pkg/maildir-utils
 [116] https://bugs.debian.org/1056573
 [117] https://tracker.debian.org/pkg/openmrac-data
 [118] https://bugs.debian.org/1056649
 [119] https://tracker.debian.org/pkg/vectorscan
 [120] https://bugs.debian.org/1055969
 [121] https://tracker.debian.org/pkg/kuttypy


                                §§§


## Reproducibility testing framework

The Reproducible Builds project operates a comprehensive testing
framework (available at tests.reproducible-builds.org [122]) in order to
check packages and other artifacts for reproducibility. In October, a
number of changes were made by Holger Levsen:

* Debian-related changes:

    * Track packages marked as Priority: important in a new package
      set. [123][124]
    * Stop scheduling packages that fail to build from source in
      bookworm [125] and bullseye. [126].
    * Add old releases dashboard link in web navigation. [127]
    * Permit re-run of the pool_buildinfos script to be re-run for a
      specific year. [128]
    * Grant jbglaw access to the osuosl4 node [129][130] along with
      lynxis [131].
    * Increase RAM on the amd64 Ionos builders from 48 GiB to 64 GiB;
      thanks IONOS! [132]
    * Move buster to archived suites. [133][134]
    * Reduce the number of arm64 architecture workers from 24 to 16
      in order to improve stability [135], reduce the workers for
      amd64 from 32 to 28 and, for i386, reduce from 12 down to 8 [136].
    * Show the entire build history of each Debian package. [137]
    * Stop scheduling already tested package/version combinations in
      Debian bookworm. [138]

* Snapshot service for rebuilders [139]

    * Add an HTTP-based API endpoint. [140][141]
    * Add a Gunicorn [142] instance to serve the HTTP API. [143]
    * Add an NGINX [144] config [145][146][147][148]

* System-health:

    * Detect failures due to HTTP "503 Service Unavailable" errors. [149]
    * Detect failures to update package sets. [150]
    * Detect unmet dependencies. (This usually occurs with builds of
      Debian live-build.) [151]

* Misc-related changes:

    * do install systemd-ommd on jenkins. [152]
    * fix harmless typo in squid.conf for codethink04. [153]
    * fixup: reproducible Debian: add gunicorn service to serve /api
      for rebuilder-snapshot.d.o. [154]
    * Increase codethink04's Squid [155] cache_dir size setting to 16
      GiB. [156]
    * Don't install systemd-oomd as it unfortunately kills
      sshd… [157]
    * Use debootstrap from backports when commisioning nodes. [158]
    * Add the live_build_debian_stretch_gnome, debsums-tests_buster
      and debsums-tests_buster jobs to the "zombie" list. [159][160]
    * Run jekyll build with the --watch argument when building the
      Reproducible Builds website. [161][162]
    * Misc node maintenance. [163][164][165]

Other changes were made as well, however, including Mattia Rizzolo
fixing rc.local's Bash syntax so it can actually run [166], commenting
away some file cleanup code that is (potentially) deleting too much
[167] and fixing the html_brekages page for Debian package builds
[168]. Finally, наб diagnosed and submitted a patch to add a
AddEncoding gzip .gz line to the tests.reproducible-builds.org [169]
Apache configuration so that Gzip files aren't re-compressed as Gzip
which some clients can't deal with (as well as being a waste of
time). [170]

 [122] https://tests.reproducible-builds.org
 [123] https://salsa.debian.org/qa/jenkins.debian.net/commit/c6f29664f
 [124] https://salsa.debian.org/qa/jenkins.debian.net/commit/f07341613
 [125] https://salsa.debian.org/qa/jenkins.debian.net/commit/8eccb4d0a
 [126] https://salsa.debian.org/qa/jenkins.debian.net/commit/66d6790ba
 [127] https://salsa.debian.org/qa/jenkins.debian.net/commit/fec2cc86a
 [128] https://salsa.debian.org/qa/jenkins.debian.net/commit/e0a92972d
 [129] https://salsa.debian.org/qa/jenkins.debian.net/commit/bff966beb
 [130] https://salsa.debian.org/qa/jenkins.debian.net/commit/ae18d6cd8
 [131] https://salsa.debian.org/qa/jenkins.debian.net/commit/f360bb8bb
 [132] https://salsa.debian.org/qa/jenkins.debian.net/commit/75526062d
 [133] https://salsa.debian.org/qa/jenkins.debian.net/commit/0766c7a6d
 [134] https://salsa.debian.org/qa/jenkins.debian.net/commit/9f2a184a0
 [135] https://salsa.debian.org/qa/jenkins.debian.net/commit/fc4e7eb44
 [136] https://salsa.debian.org/qa/jenkins.debian.net/commit/beca4dce8
 [137] https://salsa.debian.org/qa/jenkins.debian.net/commit/bd88512fd
 [138] https://salsa.debian.org/qa/jenkins.debian.net/commit/5045b6451
 [139] https://rebuilder-snapshot.debian.net/
 [140] https://salsa.debian.org/qa/jenkins.debian.net/commit/0a7cd21a7
 [141] https://salsa.debian.org/qa/jenkins.debian.net/commit/7c3c91b1a
 [142] https://gunicorn.org/
 [143] https://salsa.debian.org/qa/jenkins.debian.net/commit/990c992bf
 [144] https://www.nginx.com/
 [145] https://salsa.debian.org/qa/jenkins.debian.net/commit/7fc0b85f8
 [146] https://salsa.debian.org/qa/jenkins.debian.net/commit/d426d96d2
 [147] https://salsa.debian.org/qa/jenkins.debian.net/commit/6bb41447b
 [148] https://salsa.debian.org/qa/jenkins.debian.net/commit/0371c3e4f
 [149] https://salsa.debian.org/qa/jenkins.debian.net/commit/dd1948b80
 [150] https://salsa.debian.org/qa/jenkins.debian.net/commit/e672d5cf2
 [151] https://salsa.debian.org/qa/jenkins.debian.net/commit/af6de23d1
 [152] https://salsa.debian.org/qa/jenkins.debian.net/commit/1f1d3828f
 [153] https://salsa.debian.org/qa/jenkins.debian.net/commit/1f216cdcf
 [154] https://salsa.debian.org/qa/jenkins.debian.net/commit/9f99f7271
 [155] http://www.squid-cache.org/
 [156] https://salsa.debian.org/qa/jenkins.debian.net/commit/1ee79e35e
 [157] https://salsa.debian.org/qa/jenkins.debian.net/commit/8205cd4ef
 [158] https://salsa.debian.org/qa/jenkins.debian.net/commit/458d30176
 [159] https://salsa.debian.org/qa/jenkins.debian.net/commit/0610b3eff
 [160] https://salsa.debian.org/qa/jenkins.debian.net/commit/fcd5c2dea
 [161] https://reproducible-builds.org/
 [162] https://salsa.debian.org/qa/jenkins.debian.net/commit/0ff00fef3
 [163] https://salsa.debian.org/qa/jenkins.debian.net/commit/19393c40c
 [164] https://salsa.debian.org/qa/jenkins.debian.net/commit/5506b75d2
 [165] https://salsa.debian.org/qa/jenkins.debian.net/commit/655872a15
 [166] https://salsa.debian.org/qa/jenkins.debian.net/commit/4d593279c
 [167] https://salsa.debian.org/qa/jenkins.debian.net/commit/222b5302e
 [168] https://salsa.debian.org/qa/jenkins.debian.net/commit/ae1bb04fe
 [169] https://tests.reproducible-builds.org/
 [170] https://salsa.debian.org/qa/jenkins.debian.net/commit/debcfa9ba


                                §§§


If you are interested in contributing to the Reproducible Builds
project, please visit our "Contribute" [171] page on our website.
However, you can get in touch with us via:

 * IRC: #reproducible-builds on irc.oftc.net.

 * Mailing list: <rb-general at lists.reproducible-builds.org> or [172]

 * Mastodon: @reproducible_builds or [173]

 * Twitter: @ReproBuilds or [174]

 [171] https://reproducible-builds.org/contribute/
 [172] https://lists.reproducible-builds.org/listinfo/rb-general
 [173] https://fosstodon.org/@reproducible_builds
 [174] https://twitter.com/ReproBuilds


-- 
      o
    ⬋   ⬊
   o     o     reproducible-builds.org 💠
    ⬊   ⬋
      o

More information about the rb-general mailing list