From arnout at bzzt.net Wed Aug 5 06:26:11 2026 From: arnout at bzzt.net (Arnout Engelen) Date: Wed, 05 Aug 2026 08:26:11 +0200 Subject: RFC "2025 Minimum Elements for a Software Bill of Materials" In-Reply-To: <7b489289-77a4-4ce0-803d-a84804baf54b@app.fastmail.com> References: <62502c77-3d0a-4466-a30f-8eb1162b879b@app.fastmail.com> <3c9ad694-6fdf-445a-af55-c16686a8141b@archlinux.org> <7b489289-77a4-4ce0-803d-a84804baf54b@app.fastmail.com> Message-ID: <5092a7cd-dad3-4051-8a0c-095ba9840f05@app.fastmail.com> The document is now published: https://www.cisa.gov/sites/default/files/2026-07/2026_cisa_sbom_minimum_elements_508c.pdf We didn't reach enough consensus here to post a response 'from the R-B community', but I did include some of the points below in the response we prepared from the Apache Software Foundation. While I didn't get everything I wanted, at least the 'Timestamp' definition was adapted so that it no longer conflicts with reproducibility of generated SBOMs, so I'm happy about that :) Cheers, Arnout On Wed, Oct 1, 2025, at 14:36, Arnout Engelen wrote: > On Wed, Oct 1, 2025, at 13:45, kpcyrd wrote: >> On 9/29/25 3:28 PM, Arnout Engelen via rb-general wrote: >> > Do you agree with the comments above? Are there any changes you'd like to see, or additional comments you think would be valuable to relay in the context of reproducible builds? The timeline is relatively strict: if we can get rough consensus before, say, Wednesday, I think we could respond "as the Reproducible Builds project". >> >> It's really close to "until Wednesday" already > > Yeah, I meant to share all this much earlier, but 'life happened'. Luckily the 'upstream' deadline is Friday, so we have *some* time :) > > As Holger mentioned it's perhaps a bit too short notice to arrive at a 'Position of the Reproducible Builds project', but perhaps we can comment with something like: > > == > This document summarizes the position of from various project representatives in the R-B project, namely: > ? (...) > ? Arnout Engelen for Reproducible Builds in the NixOS project > ? (...) > == > > Let's say if we can get to '3' I'll post the comment? > >> in my opinion a missed opportunity in the original SBOM standard was: >> > The build tools/compiler are a material of your software executable >> >> Knowing which exact compiler and compiler version was used is necessary >> for triaging certain security issues[1], and it's also critical >> information for any reproducible builds efforts. >> >> At the moment this gap is filled by buildinfo files (each project having >> their own): >> >> https://reproducible-builds.org/docs/recording/ > > I agree having that information can be (in)valuable. More widely, realistically I think there's SBOMs for various use cases, and how far you go in declaring 'build-time context/dependencies' depends on the use case. Perhaps we could include this as a comment on the introduced 'Generation Context' field: we could confirm there are different kinds of context, and emphasize we believe that whether/which build-time dependencies you include depends on that context. Personally, I think it's to early to 'standardize' on such a field (I don't think there's any consensus what the exact meaning would be), so I would recommend to remove this field from the current version of the doc. We could also recommend adding a line saying the context can determine whether/which build-time dependencies should be included. > >> Also to any CISA staff following this thread: hi! ? > > ?? > > > -- > Arnout Engelen > Engelen Open Source > https://engelen.eu > -- Arnout Engelen Engelen Open Source https://engelen.eu -------------- next part -------------- An HTML attachment was scrubbed... URL: From chris at reproducible-builds.org Thu Aug 6 21:24:50 2026 From: chris at reproducible-builds.org (Chris Lamb) Date: Thu, 06 Aug 2026 14:24:50 -0700 Subject: Please review the draft for July's report Message-ID: <178605067521.566342.10623459382953716653@bigcat> Hi all, Please review the draft for July's Reproducible Builds report: https://reproducible-builds.org/reports/2026-07/?draft ? or, via the Git repository itself: https://salsa.debian.org/reproducible-builds/reproducible-website/blob/master/_reports/2026-07.md I intend to publish it no earlier than: $ date -d 'Sat, 08 Aug 2026 19:00:00 +0000' https://time.is/compare/1900_08_Aug_2026_in_UTC ? Please feel free and commit/push to drafts directly without the overhead of sending patches or merge requests. You should make your changes to the "_reports/2026-07.md" file in the "reproducible-website" repository: $ git clone https://salsa.debian.org/reproducible-builds/reproducible-website $ cd reproducible-website $ sensible-editor _reports/2026-07.md I am happy to reword and/or rework additions prior to publishing. If you currently do not have access to the above repository, you can request access by following the instructions at: https://reproducible-builds.org/contribute/salsa/ Regards, -- o ? ? Chris Lamb o o reproducible-builds.org ? ? ? o From chris at reproducible-builds.org Fri Aug 7 19:19:27 2026 From: chris at reproducible-builds.org (Chris Lamb) Date: Fri, 07 Aug 2026 12:19:27 -0700 Subject: =?UTF-8?Q?diffoscope_327_released_=F0=9F=92=A0?= Message-ID: <178611568044.771406.6034416915615816851@bigcat> Hi, The diffoscope maintainers are pleased to announce the release of version 327 of diffoscope. diffoscope tries to get to the bottom of what makes files or directories different. It will recursively unpack archives of many kinds and transform various binary formats into more human-readable form to compare them. It can compare two tarballs, ISO images, or PDF just as easily. Version 327 includes the following changes: [ Colin Watson ] * Handle missing openssh-client binaries in autopkgtests. ## Download Version 327 is available from Debian as well as PyPI, and will shortly be available on other platforms shortly. More details can be found here: https://diffoscope.org/ ? but source tarballs may be located here: https://diffoscope.org/archive/ The corresponding Docker image may be run via (for example): $ docker run --rm -t -w $(pwd) -v $(pwd):$(pwd):ro \ registry.salsa.debian.org/reproducible-builds/diffoscope a b ## Contribute diffoscope is developed within the "Reproducible builds" effort. - Git repository https://salsa.debian.org/reproducible-builds/diffoscope - Docker image, eg. registry.salsa.debian.org/reproducible-builds/diffoscope https://salsa.debian.org/reproducible-builds/diffoscope - Issues and feature requests https://salsa.debian.org/reproducible-builds/diffoscope/issues - Contribution instructions (eg. to file an issue) https://reproducible-builds.org/contribute/salsa/ Regards, -- o ? ? Chris Lamb o o reproducible-builds.org ? ? ? o From chris at reproducible-builds.org Sun Aug 9 19:16:54 2026 From: chris at reproducible-builds.org (Chris Lamb) Date: Sun, 09 Aug 2026 12:16:54 -0700 Subject: Please review the draft for July's report In-Reply-To: <178605067521.566342.10623459382953716653@bigcat> References: <178605067521.566342.10623459382953716653@bigcat> Message-ID: <3b9f93ea-6d90-4fab-a9de-319ea5cc3900@app.fastmail.com> Chris Lamb wrote: > Please review the draft for July's Reproducible Builds report: This has now been published ? thanks to all who contributed. If possible, please share the following link: https://reproducible-builds.org/reports/2026-07/ If you are on Mastodon, please consider boosting: https://fosstodon.org/@reproducible_builds/117067153161084007 Regards, -- o ? ? Chris Lamb o o reproducible-builds.org ? ? ? o From chris at reproducible-builds.org Fri Aug 14 18:29:16 2026 From: chris at reproducible-builds.org (Chris Lamb) Date: Fri, 14 Aug 2026 14:29:16 -0400 (EDT) Subject: =?utf-8?q?diffoscope_328_released_=F0=9F=92=A0?= Message-ID: <178673199531.1869056.12388133345693820435@bigcat> Hi, The diffoscope maintainers are pleased to announce the release of version 328 of diffoscope. diffoscope tries to get to the bottom of what makes files or directories different. It will recursively unpack archives of many kinds and transform various binary formats into more human-readable form to compare them. It can compare two tarballs, ISO images, or PDF just as easily. Version 328 includes the following changes: [ Chris Lamb ] * Don't require python3-guestfs in the autopkgtests on 32-bit architectures. (Closes: #1144372) [ Jochen Sprickerhof ] * Use the XML comparators for SVG vector image files. (Closes: #1144242) ## Download Version 328 is available from Debian as well as PyPI, and will shortly be available on other platforms shortly. More details can be found here: https://diffoscope.org/ ??? but source tarballs may be located here: https://diffoscope.org/archive/ The corresponding Docker image may be run via (for example): $ docker run --rm -t -w $(pwd) -v $(pwd):$(pwd):ro \ registry.salsa.debian.org/reproducible-builds/diffoscope a b ## Contribute diffoscope is developed within the "Reproducible builds" effort. - Git repository https://salsa.debian.org/reproducible-builds/diffoscope - Docker image, eg. registry.salsa.debian.org/reproducible-builds/diffoscope https://salsa.debian.org/reproducible-builds/diffoscope - Issues and feature requests https://salsa.debian.org/reproducible-builds/diffoscope/issues - Contribution instructions (eg. to file an issue) https://reproducible-builds.org/contribute/salsa/ Regards, -- o ??? ??? Chris Lamb o o reproducible-builds.org ???? ??? ??? o