Sorry

This feed does not validate.

In addition, interoperability with the widest range of feed readers could be improved by implementing the following recommendations.

Source: https://reproducible-builds.org/blog/index.rss

  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  3.  <channel>
  4.    <title>reproducible-builds.org</title>
  5.    <description>Reproducible builds blog</description>
  6.    <link>https://reproducible-builds.org/blog/</link>
  7.    <atom:link href="https://reproducible-builds.org/blog/index.rss" rel="self" type="application/rss+xml" />
  8.    <pubDate>Fri, 12 May 2023 12:59:44 +0000</pubDate>
  9.    <lastBuildDate>Fri, 12 May 2023 12:59:44 +0000</lastBuildDate>
  10.    <generator>Jekyll v3.9.0</generator>
  11.  
  12.    
  13.  
  14.    
  15.      <item>
  16.        <title>Reproducible Builds in April 2023</title>
  17.        <pubDate>Sat, 06 May 2023 19:55:17 +0000</pubDate>
  18.        <link>https://reproducible-builds.org/reports/2023-04/</link>
  19.        <guid isPermaLink="true">https://reproducible-builds.org/reports/2023-04/</guid>
  20.        <description>&lt;p class=&quot;lead&quot;&gt;&lt;strong&gt;Welcome to the April 2023 report from the &lt;a href=&quot;https://reproducible-builds.org&quot;&gt;Reproducible Builds&lt;/a&gt; project!&lt;/strong&gt;&lt;/p&gt;
  21.  
  22. &lt;p&gt;&lt;a href=&quot;https://reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-04/reproducible-builds.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  23.  
  24. &lt;p&gt;In these reports we outline the most important things that we have been up to over the past month. And, as always, if you are interested in contributing to the project, please visit our &lt;a href=&quot;/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page on our website.&lt;/p&gt;
  25.  
  26. &lt;h2 id=&quot;general-news&quot;&gt;General news&lt;/h2&gt;
  27.  
  28. &lt;p&gt;&lt;a href=&quot;https://blog.josefsson.org/2023/04/10/trisquel-is-42-reproducible/&quot;&gt;&lt;img src=&quot;/images/reports/2023-04/trisquel.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  29.  
  30. &lt;p&gt;&lt;a href=&quot;https://trisquel.info/&quot;&gt;Trisquel&lt;/a&gt; is a fully-free operating system building on the work of &lt;a href=&quot;https://ubuntu.com/&quot;&gt;Ubuntu Linux&lt;/a&gt;. This month, &lt;a href=&quot;https://blog.josefsson.org/&quot;&gt;Simon Josefsson&lt;/a&gt; published an article on his blog titled &lt;a href=&quot;https://blog.josefsson.org/2023/04/10/trisquel-is-42-reproducible/&quot;&gt;&lt;em&gt;Trisquel is 42% Reproducible!&lt;/em&gt;&lt;/a&gt;. Simon wrote:&lt;/p&gt;
  31.  
  32. &lt;blockquote&gt;
  33.  &lt;p&gt;The absolute number may not be impressive, but what I hope is at least a useful contribution is that there actually is a number on how much of &lt;a href=&quot;https://trisquel.info/&quot;&gt;Trisquel&lt;/a&gt; is reproducible. Hopefully this will inspire others to help improve the actual metric.&lt;/p&gt;
  34. &lt;/blockquote&gt;
  35.  
  36. &lt;p&gt;Simon &lt;a href=&quot;https://blog.josefsson.org/2023/04/15/sigstore-protects-apt-archives-apt-verify-apt-sigstore/&quot;&gt;wrote another blog post&lt;/a&gt; this month on a new tool to ensure that updates to Linux distribution archive metadata (eg. via &lt;code&gt;apt-get update&lt;/code&gt;) will only use files that have been recorded in a globally immutable and tamper-resistant ledger. A similar solution exists for &lt;a href=&quot;https://archlinux.org/&quot;&gt;Arch Linux&lt;/a&gt; (called &lt;a href=&quot;https://github.com/kpcyrd/pacman-bintrans&quot;&gt;&lt;code&gt;pacman-bintrans&lt;/code&gt;&lt;/a&gt;) &lt;a href=&quot;https://vulns.xyz/2021/08/monthly-report/&quot;&gt;which was announced in August 2021&lt;/a&gt; where &lt;a href=&quot;https://pacman-bintrans.vulns.xyz/&quot;&gt;an archive of all issued signatures&lt;/a&gt; is publically accessible.&lt;/p&gt;
  37.  
  38. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  39.  
  40. &lt;p&gt;&lt;a href=&quot;https://www.joachim-breitner.de/&quot;&gt;Joachim Breitner&lt;/a&gt; wrote &lt;a href=&quot;https://www.joachim-breitner.de/blog/802-More_thoughts_on_a_bootstrappable_GHC&quot;&gt;an in-depth blog post&lt;/a&gt; on a bootstrap-capable &lt;a href=&quot;https://www.haskell.org/ghc/&quot;&gt;GHC&lt;/a&gt;, the primary compiler for the Haskell programming language. As a quick background to what this is trying to solve, in order to generate a fully trustworthy compile chain, trustworthy root binaries are needed… and a popular approach to address this problem is called &lt;a href=&quot;https://bootstrappable.org/&quot;&gt;bootstrappable builds&lt;/a&gt; where the core idea is to address previously-circular build dependencies by creating a new dependency path using simpler prerequisite versions of software. Joachim takes an somewhat recursive approach to the problem for Haskell, leading to the inadvertently humourous question: “Can I turn all of GHC into one module, and compile that?”&lt;/p&gt;
  41.  
  42. &lt;p&gt;Elsewhere in the world of bootstrapping, Janneke Nieuwenhuizen and Ludovic Courtès wrote a blog post on the &lt;a href=&quot;https://guix.gnu.org/en/blog/&quot;&gt;GNU Guix blog&lt;/a&gt; announcing &lt;a href=&quot;https://guix.gnu.org/en/blog/2023/the-full-source-bootstrap-building-from-source-all-the-way-down/&quot;&gt;&lt;em&gt;The Full-Source Bootstrap&lt;/em&gt;&lt;/a&gt;, specifically:&lt;/p&gt;
  43.  
  44. &lt;blockquote&gt;
  45.  &lt;p&gt;[…] the third reduction of the Guix bootstrap binaries has now been merged in the main branch of Guix! If you run &lt;code&gt;guix pull&lt;/code&gt; today, you get a package graph of more than 22,000 nodes &lt;strong&gt;rooted in a 357-byte program&lt;/strong&gt;—something that had never been achieved, to our knowledge, since the birth of Unix.&lt;/p&gt;
  46. &lt;/blockquote&gt;
  47.  
  48. &lt;p&gt;More info about this change &lt;a href=&quot;https://guix.gnu.org/blog/2023/the-full-source-bootstrap-building-from-source-all-the-way-down/&quot;&gt;is available on the post itself&lt;/a&gt;, including:&lt;/p&gt;
  49.  
  50. &lt;blockquote&gt;
  51.  &lt;p&gt;The full-source bootstrap was once deemed impossible. Yet, here we are, building the foundations of a GNU/Linux distro entirely from source, a long way towards the ideal that the Guix project has been aiming for from the start.&lt;/p&gt;
  52.  
  53.  &lt;p&gt;There are still some daunting tasks ahead. For example, what about the Linux kernel? The good news is that the bootstrappable community has grown a lot, from two people six years ago there are now around 100 people in the &lt;code&gt;#bootstrappable&lt;/code&gt; IRC channel.&lt;/p&gt;
  54. &lt;/blockquote&gt;
  55.  
  56. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  57.  
  58. &lt;p&gt;&lt;a href=&quot;https://abbbi.github.io/&quot;&gt;Michael Ablassmeier&lt;/a&gt; created a script called &lt;a href=&quot;https://abbbi.github.io//pypidiff/&quot;&gt;&lt;em&gt;pypidiff&lt;/em&gt;&lt;/a&gt; as they were looking for a way to track differences between packages published on &lt;a href=&quot;https://pypi.org/&quot;&gt;PyPI&lt;/a&gt;. According to Micahel, &lt;em&gt;pypidiff&lt;/em&gt; “uses &lt;a href=&quot;https://diffoscope.org/&quot;&gt;&lt;em&gt;diffoscope&lt;/em&gt;&lt;/a&gt; to create reports on the published releases and automatically pushes them to a GitHub repository.” This can be seen on the &lt;a href=&quot;https://github.com/pypi-diff&quot;&gt;&lt;em&gt;pypi-diff&lt;/em&gt;&lt;/a&gt; GitHub page (&lt;a href=&quot;https://github.com/pypi-diff/20230426/blob/master/D/DAJIN2/0.1.8-0.1.9/diff.md#comparing-dajin2-018srcdajin2coreclusteringscreen_difflocipy--dajin2-019srcdajin2coreclusteringscreen_difflocipy&quot;&gt;example&lt;/a&gt;).&lt;/p&gt;
  59.  
  60. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  61.  
  62. &lt;p&gt;&lt;a href=&quot;https://www.marktechpost.com/2023/04/09/a-new-ai-research-proposes-pythia-a-suite-of-decoder-only-autoregressive-language-models-ranging-from-70m-to-12b-parameters/&quot;&gt;&lt;img src=&quot;/images/reports/2023-04/eleutherai.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  63.  
  64. &lt;p&gt;&lt;a href=&quot;https://www.eleuther.ai/&quot;&gt;Eleuther AI&lt;/a&gt;, a non-profit AI research group, recently unveiled &lt;a href=&quot;https://github.com/EleutherAI/pythia&quot;&gt;Pythia&lt;/a&gt;, a collection of 16 &lt;a href=&quot;https://en.wikipedia.org/wiki/Large_language_model&quot;&gt;Large Language Model&lt;/a&gt; (LLMs) trained on public data in the same order designed specifically to facilitate scientific research. According to a &lt;a href=&quot;https://www.marktechpost.com/2023/04/09/a-new-ai-research-proposes-pythia-a-suite-of-decoder-only-autoregressive-language-models-ranging-from-70m-to-12b-parameters/&quot;&gt;post on MarkTechPost&lt;/a&gt;:&lt;/p&gt;
  65.  
  66. &lt;blockquote&gt;
  67.  &lt;p&gt;Pythia is the only publicly available model suite that includes models that were trained on the same data in the same order [and] all the corresponding &lt;strong&gt;data and tools to download and replicate the exact training process are publicly released&lt;/strong&gt; to facilitate further research.&lt;/p&gt;
  68. &lt;/blockquote&gt;
  69.  
  70. &lt;p&gt;These properties are intended to allow researchers to understand how gender bias (etc.) can affected by training data and model scale.&lt;/p&gt;
  71.  
  72. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  73.  
  74. &lt;p&gt;Back in &lt;a href=&quot;/reports/2023-02/&quot;&gt;February’s report&lt;/a&gt; we reported on a series of changes to the &lt;a href=&quot;https://www.sphinx-doc.org/&quot;&gt;Sphinx documentation generator&lt;/a&gt; that was initiated after attempts to get the &lt;a href=&quot;https://tracker.debian.org/pkg/alembic&quot;&gt;&lt;code&gt;alembic&lt;/code&gt;&lt;/a&gt; Debian package to build reproducibly. Although Chris Lamb was able to identify the source problem and &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/002862.html&quot;&gt;provided a potential patch that might fix it&lt;/a&gt;, James Addison has taken the issue in hand, leading to a &lt;a href=&quot;https://github.com/sphinx-doc/sphinx/issues/11198&quot;&gt;large amount of activity&lt;/a&gt; resulting in a &lt;a href=&quot;https://github.com/sphinx-doc/sphinx/pull/11312&quot;&gt;proposed pull request&lt;/a&gt; that is waiting to be merged.&lt;/p&gt;
  75.  
  76. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  77.  
  78. &lt;p&gt;&lt;a href=&quot;https://lists.zx2c4.com/pipermail/wireguard/2023-April/008045.html&quot;&gt;&lt;img src=&quot;/images/reports/2023-04/fdroid.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  79.  
  80. &lt;p&gt;&lt;a href=&quot;https://www.wireguard.com/&quot;&gt;WireGuard&lt;/a&gt; is a popular &lt;a href=&quot;https://en.wikipedia.org/wiki/Virtual_private_network&quot;&gt;Virtual Private Network&lt;/a&gt; (VPN) service that aims to be faster, simpler and leaner than other solutions to create secure connections between computing devices. According to a post on the &lt;a href=&quot;https://lists.zx2c4.com/pipermail/wireguard/&quot;&gt;WireGuard developer mailing list&lt;/a&gt;, the &lt;a href=&quot;https://f-droid.org/en/packages/com.wireguard.android/&quot;&gt;WireGuard Android app&lt;/a&gt; can now be built reproducibly so that its contents can be publicly verified. According to &lt;a href=&quot;https://lists.zx2c4.com/pipermail/wireguard/2023-April/008045.html&quot;&gt;the post by Jason A. Donenfeld&lt;/a&gt;, “the &lt;a href=&quot;https://f-droid.org&quot;&gt;F-Droid&lt;/a&gt; project now does this verification by comparing &lt;a href=&quot;https://f-droid.org/en/packages/com.wireguard.android/&quot;&gt;their build of WireGuard&lt;/a&gt; to the build that the WireGuard project publishes. When they match, the new version becomes available. This is very positive news.”&lt;/p&gt;
  81.  
  82. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  83.  
  84. &lt;p&gt;Author and public speaker, &lt;a href=&quot;https://en.wikipedia.org/wiki/VM_Brasseur&quot;&gt;V. M. Brasseur&lt;/a&gt; published a sample chapter from her upcoming book on “corporate open source strategy” which is the topic of &lt;a href=&quot;https://anonymoushash.vmbrasseur.com/2023/04/24/software-bill-of-materials-sbom&quot;&gt;Software Bill of Materials&lt;/a&gt; (SBOM):&lt;/p&gt;
  85.  
  86. &lt;blockquote&gt;
  87.  &lt;p&gt;A software bill of materials (SBOM) is defined as “…a nested inventory for software, a list of ingredients that make up software components.” When you receive a physical delivery of some sort, the bill of materials tells you what’s inside the box. Similarly, when you use software created outside of your organisation, the SBOM tells you what’s inside that software. The SBOM is a file that declares the software supply chain (SSC) for that specific piece of software. [&lt;a href=&quot;https://anonymoushash.vmbrasseur.com/2023/04/24/software-bill-of-materials-sbom&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  88. &lt;/blockquote&gt;
  89.  
  90. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  91.  
  92. &lt;p&gt;Several distributions noticed recent versions of the Linux Kernel are no longer reproducible because the &lt;a href=&quot;https://www.kernel.org/doc/html/latest/bpf/btf.html&quot;&gt;BPF Type Format&lt;/a&gt; (BTF) metadata is not generated in a deterministic way. This was discussed on the &lt;code&gt;#reproducible-builds&lt;/code&gt; IRC channel, but no solution appears to be in sight for now.&lt;/p&gt;
  93.  
  94. &lt;hr /&gt;
  95.  
  96. &lt;h2 id=&quot;community-news&quot;&gt;Community news&lt;/h2&gt;
  97.  
  98. &lt;p&gt;On &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general/&quot;&gt;our mailing list&lt;/a&gt; this month:&lt;/p&gt;
  99.  
  100. &lt;ul&gt;
  101.  &lt;li&gt;
  102.    &lt;p&gt;Larry Doolittle shared an interesting puzzle with the group where &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-April/002919.html&quot;&gt;three bytes in a &lt;code&gt;.zip&lt;/code&gt; file&lt;/a&gt; were different between two builds.&lt;/p&gt;
  103.  &lt;/li&gt;
  104.  &lt;li&gt;
  105.    &lt;p&gt;Alexis PM wrote a message as they &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-April/002931.html&quot;&gt;had observed a difference between binaries available in the Debian archive and the ones on &lt;em&gt;tests.reproducible-builds.org&lt;/em&gt;&lt;/a&gt;. The &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-April/thread.html#2931&quot;&gt;thread&lt;/a&gt; generated a number of replies, including interesting responses from Vagrant Cascadian [&lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-April/002939.html&quot;&gt;…&lt;/a&gt;] and &lt;em&gt;kpcyrd&lt;/em&gt; [&lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-April/002934.html&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  106.  &lt;/li&gt;
  107. &lt;/ul&gt;
  108.  
  109. &lt;p&gt;&lt;a href=&quot;https://foss-north.se/2023&quot;&gt;&lt;img src=&quot;/images/reports/2023-04/foss-north.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  110.  
  111. &lt;p&gt;Holger Levsen gave a talk at &lt;a href=&quot;https://foss-north.se/2023&quot;&gt;foss-north 2023&lt;/a&gt; in Gothenburg, Sweden on the topic of &lt;a href=&quot;https://foss-north.se/2023/speakers-and-talks.html#hlevsen&quot;&gt;&lt;em&gt;Reproducible Builds, the first ten years&lt;/em&gt;&lt;/a&gt;.&lt;/p&gt;
  112.  
  113. &lt;p&gt;Lastly, there were a number of updates to &lt;a href=&quot;/&quot;&gt;our website&lt;/a&gt;, including:&lt;/p&gt;
  114.  
  115. &lt;ul&gt;
  116.  &lt;li&gt;
  117.    &lt;p&gt;Chris Lamb attempted a number of ways to try and fix literal &lt;code&gt;{: .lead}&lt;/code&gt; appearing in the page [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/b4e11377&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/f55c283b&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/2d01c3d8&quot;&gt;…&lt;/a&gt;], made all the &lt;em&gt;Back to who is involved&lt;/em&gt; links italics [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/762c5a6a&quot;&gt;…&lt;/a&gt;], and corrected the syntax of the &lt;code&gt;_data/sponsors.yml&lt;/code&gt; file [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/ec53c429&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  118.  &lt;/li&gt;
  119.  &lt;li&gt;
  120.    &lt;p&gt;Holger Levsen added his recent talk [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/0314c0db&quot;&gt;…&lt;/a&gt;], added Simon Josefsson, Mike Perry and Seth Schoen to the contributors page [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/ea3966bc&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/a909974d&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/d14f94fe&quot;&gt;…&lt;/a&gt;], reworked the &lt;em&gt;People&lt;/em&gt; page a little [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/759b1ef0&quot;&gt;…&lt;/a&gt;] [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/b312ea5f&quot;&gt;…&lt;/a&gt;], as well as fixed spelling of ‘Arch Linux’ [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/626a4af0&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  121.  &lt;/li&gt;
  122. &lt;/ul&gt;
  123.  
  124. &lt;p&gt;Lastly, Mattia Rizzolo moved some old sponsors to a ‘former’ section [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/85f22ddb&quot;&gt;…&lt;/a&gt;] and Simon Josefsson added Trisquel GNU/Linux. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/c8316971&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  125.  
  126. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  127.  
  128. &lt;hr /&gt;
  129.  
  130. &lt;h2 id=&quot;debian&quot;&gt;Debian&lt;/h2&gt;
  131.  
  132. &lt;p&gt;&lt;a href=&quot;https://debian.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-04/debian.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  133.  
  134. &lt;ul&gt;
  135.  &lt;li&gt;
  136.    &lt;p&gt;Vagrant Cascadian &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-May/002961.html&quot;&gt;reported on the Debian’s &lt;code&gt;build-essential&lt;/code&gt; package set&lt;/a&gt;, which was “inspired by how close we are to making the Debian &lt;code&gt;build-essential&lt;/code&gt; set reproducible and how important that set of packages are in general”. Vagrant mentioned that: “I have some progress, some hope, and I daresay, some fears…”. &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-May/002961.html&quot;&gt;[…]&lt;/a&gt;&lt;/p&gt;
  137.  &lt;/li&gt;
  138.  &lt;li&gt;
  139.    &lt;p&gt;Debian Developer &lt;a href=&quot;https://mraw.org/&quot;&gt;Cyril Brulebois (&lt;em&gt;kibi&lt;/em&gt;)&lt;/a&gt; filed a bug against &lt;a href=&quot;https://snapshot.debian.org/&quot;&gt;&lt;em&gt;snapshot.debian.org&lt;/em&gt;&lt;/a&gt; after they noticed that “there are many missing &lt;code&gt;dinstalls&lt;/code&gt;” — that is to say, the snapshot service is not capturing 100% of all of historical states of the Debian archive. This is relevant to reproducibility because without the availability historical versions, it is becomes impossible to repeat a build at a future date in order to correlate checksums. .&lt;a href=&quot;https://bugs.debian.org/1031628&quot;&gt;…&lt;/a&gt;&lt;/p&gt;
  140.  &lt;/li&gt;
  141.  &lt;li&gt;
  142.    &lt;p&gt;20 reviews of Debian packages were added, 21 were updated and 5 were removed this month adding to our &lt;a href=&quot;https://tests.reproducible-builds.org/debian/index_issues.html&quot;&gt;knowledge about identified issues&lt;/a&gt;. Chris Lamb added a new &lt;code&gt;build_path_in_line_annotations_added_by_ruby_ragel&lt;/code&gt; toolchain issue. &lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/f62c135d&quot;&gt;[…]&lt;/a&gt;&lt;/p&gt;
  143.  &lt;/li&gt;
  144.  &lt;li&gt;
  145.    &lt;p&gt;Mattia Rizzolo announced that the data for the &lt;em&gt;stretch&lt;/em&gt; archive on &lt;em&gt;tests.reproducible-builds.org&lt;/em&gt; &lt;a href=&quot;https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20230424/014118.html&quot;&gt;has been archived&lt;/a&gt;. This matches the &lt;a href=&quot;https://lists.debian.org/debian-devel-announce/2023/03/msg00006.html&quot;&gt;archival of &lt;em&gt;stretch&lt;/em&gt; within Debian itself&lt;/a&gt;. This is of some historical interest, as &lt;em&gt;stretch&lt;/em&gt; was the first Debian release regularly tested by the Reproducible Builds project.&lt;/p&gt;
  146.  &lt;/li&gt;
  147. &lt;/ul&gt;
  148.  
  149. &lt;hr /&gt;
  150.  
  151. &lt;h2 id=&quot;upstream-patches&quot;&gt;Upstream patches&lt;/h2&gt;
  152.  
  153. &lt;p&gt;The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where appropriate. This month, we wrote a large number of such patches, including:&lt;/p&gt;
  154.  
  155. &lt;ul&gt;
  156.  &lt;li&gt;
  157.    &lt;p&gt;Bernhard M. Wiedemann:&lt;/p&gt;
  158.  
  159.    &lt;ul&gt;
  160.      &lt;li&gt;&lt;a href=&quot;https://github.com/opensuse-haskell/ghc-rpm-macros/pull/1&quot;&gt;&lt;code&gt;ghc&lt;/code&gt;&lt;/a&gt; (workaround a parallelism-related issue)&lt;/li&gt;
  161.    &lt;/ul&gt;
  162.  &lt;/li&gt;
  163.  &lt;li&gt;
  164.    &lt;p&gt;Jan Zerebecki:&lt;/p&gt;
  165.  
  166.    &lt;ul&gt;
  167.      &lt;li&gt;&lt;a href=&quot;https://gitlab.haskell.org/ghc/ghc/-/issues/23299&quot;&gt;&lt;code&gt;ghc&lt;/code&gt;&lt;/a&gt; (report a parallelism-related issue)&lt;/li&gt;
  168.    &lt;/ul&gt;
  169.  &lt;/li&gt;
  170.  &lt;li&gt;
  171.    &lt;p&gt;Chris Lamb:&lt;/p&gt;
  172.  
  173.    &lt;ul&gt;
  174.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1034147&quot;&gt;#1034147&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/ruby-regexp-parser&quot;&gt;&lt;code&gt;ruby-regexp-parser&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  175.    &lt;/ul&gt;
  176.  &lt;/li&gt;
  177.  &lt;li&gt;
  178.    &lt;p&gt;Vagrant Cascadian:&lt;/p&gt;
  179.  
  180.    &lt;ul&gt;
  181.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1033954&quot;&gt;#1033954&lt;/a&gt;, &lt;a href=&quot;https://bugs.debian.org/1033955&quot;&gt;#1033955&lt;/a&gt; and &lt;a href=&quot;https://bugs.debian.org/1033957&quot;&gt;#1033957&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/pike8.0&quot;&gt;&lt;code&gt;pike8.0&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  182.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1033958&quot;&gt;#1033958&lt;/a&gt; and &lt;a href=&quot;https://bugs.debian.org/1033959&quot;&gt;#1033959&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/binutils&quot;&gt;&lt;code&gt;binutils&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  183.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1034129&quot;&gt;#1034129&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/lomiri-action-api&quot;&gt;&lt;code&gt;lomiri-action-api&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  184.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1034199&quot;&gt;#1034199&lt;/a&gt; and &lt;a href=&quot;https://bugs.debian.org/1034200&quot;&gt;#1034200&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/lomiri&quot;&gt;&lt;code&gt;lomiri&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  185.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1034327&quot;&gt;#1034327&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/nmodl&quot;&gt;&lt;code&gt;nmodl&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  186.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1034423&quot;&gt;#1034423&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/php8.2&quot;&gt;&lt;code&gt;php8.2&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  187.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1034431&quot;&gt;#1034431&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/qemu&quot;&gt;&lt;code&gt;qemu&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  188.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1034499&quot;&gt;#1034499&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/twisted&quot;&gt;&lt;code&gt;twisted&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  189.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1034740&quot;&gt;#1034740&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/boost1.74&quot;&gt;&lt;code&gt;boost1.74&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  190.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1034892&quot;&gt;#1034892&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/php8.2&quot;&gt;&lt;code&gt;php8.2&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  191.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1035324&quot;&gt;#1035324&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/shaderc&quot;&gt;&lt;code&gt;shaderc&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  192.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1035329&quot;&gt;#1035329&lt;/a&gt; and &lt;a href=&quot;https://bugs.debian.org/1035331&quot;&gt;#1035331&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/jackd2&quot;&gt;&lt;code&gt;jackd2&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  193.    &lt;/ul&gt;
  194.  &lt;/li&gt;
  195. &lt;/ul&gt;
  196.  
  197. &lt;hr /&gt;
  198.  
  199. &lt;h2 id=&quot;diffoscope-development&quot;&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;em&gt;diffoscope&lt;/em&gt;&lt;/a&gt; development&lt;/h2&gt;
  200.  
  201. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;img src=&quot;/images/reports/2023-04/diffoscope.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  202.  
  203. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;em&gt;diffoscope&lt;/em&gt;&lt;/a&gt; version &lt;code&gt;241&lt;/code&gt; was &lt;a href=&quot;https://tracker.debian.org/news/1429548/accepted-diffoscope-241-source-into-unstable/&quot;&gt;uploaded to Debian unstable&lt;/a&gt; by Chris Lamb. It &lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commits/241&quot;&gt;included contributions already covered in previous months&lt;/a&gt; as well a change by Chris Lamb to add a missing &lt;code&gt;raise&lt;/code&gt; statement that was &lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/2d95ae41efad&quot;&gt;accidentally dropped in a previous commit&lt;/a&gt;. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/52a55da5&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  204.  
  205. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  206.  
  207. &lt;hr /&gt;
  208.  
  209. &lt;h2 id=&quot;testing-framework&quot;&gt;Testing framework&lt;/h2&gt;
  210.  
  211. &lt;p&gt;&lt;a href=&quot;https://tests.reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-04/testframework.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  212.  
  213. &lt;p&gt;The Reproducible Builds project operates a comprehensive testing framework (available at &lt;a href=&quot;https://tests.reproducible-builds.org&quot;&gt;tests.reproducible-builds.org&lt;/a&gt;) in order to check packages and other artifacts for reproducibility. In April, a number of changes were made, including:&lt;/p&gt;
  214.  
  215. &lt;ul&gt;
  216.  &lt;li&gt;
  217.    &lt;p&gt;Holger Levsen:&lt;/p&gt;
  218.  
  219.    &lt;ul&gt;
  220.      &lt;li&gt;Significant work on a new Documented Jenkins Maintenance (djm) script to support logged maintenance of nodes, etc. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/291bc540d&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/ddd8e480e&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/63b29e66f&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/2a08b4568&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/ad826396b&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/05d3c235a&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  221.      &lt;li&gt;Add the new APT repo url for Jenkins itself with a new signing key. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/1990ba553&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/f1733a4ba&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  222.      &lt;li&gt;In the Jenkins shell monitor, allow 40 GiB of files for &lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;em&gt;diffoscope&lt;/em&gt;&lt;/a&gt; for the Debian &lt;em&gt;experimental&lt;/em&gt; distribution as Debian is frozen around the release at the moment. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/7e83620d0&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  223.      &lt;li&gt;Updated Arch Linux testing to cleanup leftover files left in &lt;code&gt;/tmp/archlinux-ci/&lt;/code&gt; after three days. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/e9cb00e87&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/065d4e172&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/bd09d3dcc&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  224.      &lt;li&gt;Mark a number of nodes hosted by &lt;a href=&quot;https://osuosl.org/&quot;&gt;Oregon State University Open Source Lab&lt;/a&gt; (OSUOSL) as online and offline. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/7121c81c6&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/bd84a1b6f&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/cdd4b5c15&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  225.      &lt;li&gt;Update the node health checks to detect failures to end &lt;code&gt;schroot&lt;/code&gt; sessions. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/b9f3487dd&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  226.      &lt;li&gt;Filter out another duplicate contributor from the contributor statistics. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/462fa2454&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  227.    &lt;/ul&gt;
  228.  &lt;/li&gt;
  229.  &lt;li&gt;
  230.    &lt;p&gt;Mattia Rizzolo:&lt;/p&gt;
  231.  
  232.    &lt;ul&gt;
  233.      &lt;li&gt;Code changes to properly &lt;a href=&quot;https://alioth-lists.debian.net/pipermail/reproducible-builds/Week-of-Mon-20230424/014118.html&quot;&gt;archive the &lt;code&gt;stretch&lt;/code&gt; Debian distribution&lt;/a&gt;. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/f0f2dab30369c4a44c7bb7a8fe0129dcb9db011c&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/1a3aaf3c47df97adeea95016b1e9679a7b1172c2&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/cabef2f6ac8defa5b9f809b704a08e4a6ee879dc&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/7a90bbd77e5eb2a6aff2ecd97fe32faa7024ab31&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  234.      &lt;li&gt;Introduce the “archived suites” configuration option. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/dadd1a38c798058399c1d8aa7dfd10c90853cb47&quot;&gt;…&lt;/a&gt;]][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/66df6f97098063a41a4f1479ce2425928265957a&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  235.      &lt;li&gt;Fix the &lt;a href=&quot;https://salsa.debian.org/kgb-team/kgb/-/wikis/home&quot;&gt;KGB bot&lt;/a&gt; configuration to support &lt;code&gt;pyyaml&lt;/code&gt; 6.0 as present in Debian &lt;em&gt;bookworm&lt;/em&gt;. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/bf6fdb5edeb2a57afe25cb9b3cb2f76b9fbf0068&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  236.    &lt;/ul&gt;
  237.  &lt;/li&gt;
  238. &lt;/ul&gt;
  239.  
  240. &lt;p&gt;&lt;br /&gt;
  241. &lt;br /&gt;&lt;/p&gt;
  242.  
  243. &lt;hr /&gt;
  244.  
  245. &lt;p&gt;If you are interested in contributing to the Reproducible Builds project, please visit our &lt;a href=&quot;https://reproducible-builds.org/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page on our website. However, you can get in touch with us via:&lt;/p&gt;
  246.  
  247. &lt;ul&gt;
  248.  &lt;li&gt;
  249.    &lt;p&gt;IRC: &lt;code&gt;#reproducible-builds&lt;/code&gt; on &lt;code&gt;irc.oftc.net&lt;/code&gt;.&lt;/p&gt;
  250.  &lt;/li&gt;
  251.  &lt;li&gt;
  252.    &lt;p&gt;Twitter: &lt;a href=&quot;https://twitter.com/ReproBuilds&quot;&gt;@ReproBuilds&lt;/a&gt;&lt;/p&gt;
  253.  &lt;/li&gt;
  254.  &lt;li&gt;
  255.    &lt;p&gt;Mailing list: &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general&quot;&gt;&lt;code&gt;rb-general@lists.reproducible-builds.org&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;
  256.  &lt;/li&gt;
  257. &lt;/ul&gt;
  258. </description>
  259.      </item>
  260.    
  261.      <item>
  262.        <title>Reproducible Builds in March 2023</title>
  263.        <pubDate>Thu, 06 Apr 2023 13:52:40 +0000</pubDate>
  264.        <link>https://reproducible-builds.org/reports/2023-03/</link>
  265.        <guid isPermaLink="true">https://reproducible-builds.org/reports/2023-03/</guid>
  266.        <description>&lt;p class=&quot;lead&quot;&gt;&lt;strong&gt;Welcome to the March 2023 report from the &lt;a href=&quot;https://reproducible-builds.org&quot;&gt;Reproducible Builds&lt;/a&gt; project.&lt;/strong&gt;&lt;/p&gt;
  267.  
  268. &lt;p&gt;&lt;a href=&quot;https://reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-03/reproducible-builds.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  269.  
  270. &lt;p&gt;In these reports we outline the most important things that we have been up to over the past month. As a quick recap, the motivation behind the reproducible builds effort is to ensure no malicious flaws have been introduced during compilation and distributing processes. It does this by ensuring identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised.&lt;/p&gt;
  271.  
  272. &lt;p&gt;If you are interested in contributing to the project, please do visit our &lt;a href=&quot;/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page on our website.&lt;/p&gt;
  273.  
  274. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  275.  
  276. &lt;h2 id=&quot;news&quot;&gt;News&lt;/h2&gt;
  277.  
  278. &lt;p&gt;&lt;a href=&quot;https://github.com/golang/go/issues/57120&quot;&gt;&lt;img src=&quot;/images/reports/2023-03/golang.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  279.  
  280. &lt;p&gt;There was progress towards making the &lt;a href=&quot;https://go.dev&quot;&gt;Go programming language&lt;/a&gt; reproducible this month, with the overall goal remaining making the Go binaries distributed from Google and by &lt;a href=&quot;https://archlinux.org/&quot;&gt;Arch Linux&lt;/a&gt; (and others) to be bit-for-bit identical. These changes could become part of the upcoming version 1.21 release of Go. An &lt;a href=&quot;https://github.com/golang/go/issues/57120&quot;&gt;issue in the Go issue tracker (#57120)&lt;/a&gt; is being used to follow and record progress on this.&lt;/p&gt;
  281.  
  282. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  283.  
  284. &lt;p&gt;Arnout Engelen updated &lt;a href=&quot;/&quot;&gt;our website&lt;/a&gt; to add and update reproducibility-related links for &lt;a href=&quot;https://nixos.org/&quot;&gt;NixOS&lt;/a&gt; to &lt;a href=&quot;https://reproducible.nixos.org&quot;&gt;&lt;em&gt;reproducible.nixos.org&lt;/em&gt;&lt;/a&gt;. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/04aa8023&quot;&gt;…&lt;/a&gt;]. In addition, Chris Lamb made some cosmetic changes to our &lt;a href=&quot;/resources/&quot;&gt;presentations and resources&lt;/a&gt; page. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/18424a3c&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/05507724&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  285.  
  286. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  287.  
  288. &lt;p&gt;&lt;a href=&quot;https://www.intel.com/content/www/us/en/developer/articles/technical/intel-trust-domain-extensions.html&quot;&gt;&lt;img src=&quot;/images/reports/2023-03/intel.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  289.  
  290. &lt;p&gt;&lt;a href=&quot;https://www.intel.com&quot;&gt;Intel&lt;/a&gt; published &lt;a href=&quot;https://www.intel.com/content/www/us/en/developer/articles/technical/intel-trust-domain-extensions.html&quot;&gt;a guide&lt;/a&gt; on how to reproducibly build their Trust Domain Extensions (TDX) firmware. TDX here refers to an Intel technology that combines their existing virtual machine and memory encryption technology with a new kind of virtual machine guest called a Trust Domain. This runs the CPU in a mode that protects the confidentiality of its memory contents and its state from any other software.&lt;/p&gt;
  291.  
  292. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  293.  
  294. &lt;p&gt;A &lt;a href=&quot;https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93371&quot;&gt;reproducibility-related bug from early 2020&lt;/a&gt; in the &lt;a href=&quot;https://gcc.gnu.org/&quot;&gt;GNU GCC compiler&lt;/a&gt; as been fixed. The issues was that if GCC was invoked via the &lt;code&gt;as&lt;/code&gt; frontend, the &lt;code&gt;-ffile-prefix-map&lt;/code&gt; was being ignored. We were tracking this in Debian via the &lt;a href=&quot;https://tests.reproducible-builds.org/debian/issues/unstable/build_path_captured_in_assembly_objects_issue.html&quot;&gt;&lt;code&gt;build_path_captured_in_assembly_objects&lt;/code&gt;&lt;/a&gt; issue. It has now been fixed and will be reflected in GCC version 13.&lt;/p&gt;
  295.  
  296. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  297.  
  298. &lt;p&gt;&lt;a href=&quot;https://foss-north.se/2023&quot;&gt;&lt;img src=&quot;/images/reports/2023-03/foss-north.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  299.  
  300. &lt;p&gt;Holger Levsen will present at &lt;a href=&quot;https://foss-north.se/2023&quot;&gt;foss-north 2023&lt;/a&gt; in April of this year in Gothenburg, Sweden on the topic of &lt;em&gt;Reproducible Builds, the first ten years&lt;/em&gt;.&lt;/p&gt;
  301.  
  302. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  303.  
  304. &lt;p&gt;Anthony Andreoli, Anis Lounis, Mourad Debbabi and Aiman Hanna of the &lt;a href=&quot;https://www.concordia.ca/ginacody/research/security-research-centre.html&quot;&gt;Security Research Centre&lt;/a&gt; at &lt;a href=&quot;https://www.concordia.ca/&quot;&gt;Concordia University, Montreal&lt;/a&gt; published a paper this month entitled &lt;a href=&quot;https://www.sciencedirect.com/science/article/abs/pii/S2666281723000094&quot;&gt;&lt;em&gt;On the prevalence of software supply chain attacks: Empirical study and investigative framework&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;
  305.  
  306. &lt;blockquote&gt;
  307.  &lt;p&gt;Software Supply Chain Attacks (SSCAs) typically compromise hosts through trusted but infected software. The intent of this paper is twofold: First, we present an empirical study of the most prominent software supply chain attacks and their characteristics. Second, we propose an investigative framework for identifying, expressing, and evaluating characteristic behaviours of newfound attacks for mitigation and future defense purposes. We hypothesize that these behaviours are statistically malicious, existed in the past, and thus could have been thwarted in modernity through their cementation x-years ago. [&lt;a href=&quot;https://www.sciencedirect.com/science/article/abs/pii/S2666281723000094&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  308. &lt;/blockquote&gt;
  309.  
  310. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  311.  
  312. &lt;p&gt;On &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general/&quot;&gt;our mailing list&lt;/a&gt; this month:&lt;/p&gt;
  313.  
  314. &lt;ul&gt;
  315.  &lt;li&gt;
  316.    &lt;p&gt;Mattia Rizzolo is asking everyone in the community to save the date for the 2023’s Reproducible Builds summit which will take place between October 31st and November 2nd at &lt;a href=&quot;https://dock-europe.net/&quot;&gt;Dock Europe&lt;/a&gt; in Hamburg, Germany. Separate announcement(s) to follow. [&lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-March/002915.html&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  317.  &lt;/li&gt;
  318.  &lt;li&gt;
  319.    &lt;p&gt;&lt;em&gt;ahojlm&lt;/em&gt; posted an message announcing a new project which is “the first project offering bootstrappable and verifiable builds without any binary seeds.” That is to say, a way of providing a verifiable path towards trusted software development platform without relying on pre-provided binary code in order to prevent against various forms of &lt;a href=&quot;https://en.wikipedia.org/wiki/Backdoor_(computing)#Compiler_backdoors&quot;&gt;compiler backdoors&lt;/a&gt;. The &lt;a href=&quot;http://rbzfp7h25zcnmxu4wnxhespe64addpopah5ckfpdfyy4qetpziitp5qd.onion/&quot;&gt;project’s homepage&lt;/a&gt; is hosted on Tor (&lt;a href=&quot;https://www.zq1.de/~bernhard/mirror/rbzfp7h25zcnmxu4wnxhespe64addpopah5ckfpdfyy4qetpziitp5qd.onion/&quot;&gt;mirror&lt;/a&gt;).&lt;/p&gt;
  320.  &lt;/li&gt;
  321. &lt;/ul&gt;
  322.  
  323. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  324.  
  325. &lt;p&gt;The &lt;a href=&quot;http://meetbot.debian.net/reproducible-builds/2023/reproducible-builds.2023-03-28-14.58.html&quot;&gt;minutes and logs from our March 2023 IRC meeting&lt;/a&gt; have been published. In case you missed this one, our next IRC meeting will take place on &lt;strong&gt;Tuesday 25th April at 15:00 UTC&lt;/strong&gt; on &lt;code&gt;#reproducible-builds&lt;/code&gt; on the &lt;a href=&quot;https://oftc.net&quot;&gt;OFTC&lt;/a&gt; network.&lt;/p&gt;
  326.  
  327. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  328.  
  329. &lt;p&gt;&lt;a href=&quot;http://layer-acht.org/thinking/blog/20230214-i-love-osuosl/&quot;&gt;&lt;img src=&quot;/images/reports/2023-03/osuosl.jpg#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  330.  
  331. &lt;p&gt;… and as a Valentines Day present, Holger Levsen wrote on his blog on 14th February to express his thanks to &lt;a href=&quot;https://osuosl.org/&quot;&gt;OSUOSL&lt;/a&gt; for their continuous support of &lt;em&gt;reproducible-builds.org&lt;/em&gt;. [&lt;a href=&quot;http://layer-acht.org/thinking/blog/20230214-i-love-osuosl/&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  332.  
  333. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  334.  
  335. &lt;hr /&gt;
  336.  
  337. &lt;h2 id=&quot;debian&quot;&gt;Debian&lt;/h2&gt;
  338.  
  339. &lt;p&gt;&lt;a href=&quot;https://debian.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-03/debian.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  340.  
  341. &lt;p&gt;Vagrant Cascadian developed an easier setup for testing debian packages which uses &lt;a href=&quot;https://wiki.debian.org/sbuild&quot;&gt;&lt;em&gt;sbuild&lt;/em&gt;&lt;/a&gt;’s “&lt;a href=&quot;https://wiki.debian.org/sbuild#Using_unshare_with_mmdebstrap_.28no_root_needed.29&quot;&gt;unshare mode&lt;/a&gt;” along and &lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reprotest&quot;&gt;&lt;em&gt;reprotest&lt;/em&gt;&lt;/a&gt;, our tool for building the same source code twice in different environments and then checking the binaries produced by each build for any differences. [&lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-March/002917.html&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  342.  
  343. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  344.  
  345. &lt;p&gt;Over 30 reviews of Debian packages were added, 14 were updated and 7 were removed this month, all adding to &lt;a href=&quot;https://tests.reproducible-builds.org/debian/index_issues.html&quot;&gt;our knowledge about identified issues&lt;/a&gt;. A number of issues were updated, including the Holger Levsen updating &lt;code&gt;build_path_captured_in_assembly_objects&lt;/code&gt; to note that it has been fixed for GCC 13 [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/3233540c&quot;&gt;…&lt;/a&gt;] and Vagrant Cascadian added new issues to mark packages where the build path is being captured via the &lt;a href=&quot;https://www.rust-lang.org/&quot;&gt;Rust&lt;/a&gt; toolchain [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/2691bc83&quot;&gt;…&lt;/a&gt;] as well as new categorisation for where &lt;a href=&quot;https://www.debian.org/doc/debian-policy/ch-binary.html#s-virtual-pkg&quot;&gt;virtual packages&lt;/a&gt; have nondeterministic versioned dependencies [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/ccaaab5f&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  346.  
  347. &lt;hr /&gt;
  348.  
  349. &lt;h2 id=&quot;upstream-patches&quot;&gt;Upstream patches&lt;/h2&gt;
  350.  
  351. &lt;p&gt;The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where appropriate. This month, we wrote a large number of such patches, including:&lt;/p&gt;
  352.  
  353. &lt;ul&gt;
  354.  &lt;li&gt;
  355.    &lt;p&gt;Bernhard M. Wiedemann:&lt;/p&gt;
  356.  
  357.    &lt;ul&gt;
  358.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1073723&quot;&gt;&lt;code&gt;cockpit&lt;/code&gt;&lt;/a&gt; (gzip mtime)&lt;/li&gt;
  359.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1072113&quot;&gt;&lt;code&gt;crmsh&lt;/code&gt;&lt;/a&gt; (by mcepl: rewrite to avoid python toolchain issue)&lt;/li&gt;
  360.      &lt;li&gt;&lt;a href=&quot;https://github.com/marcelotduarte/cx_Freeze/pull/1860&quot;&gt;&lt;code&gt;cx_Freeze&lt;/code&gt;&lt;/a&gt; (merged, FTBFS-2038)&lt;/li&gt;
  361.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1073618&quot;&gt;&lt;code&gt;golangci-lint&lt;/code&gt;&lt;/a&gt; (date)&lt;/li&gt;
  362.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1072597&quot;&gt;&lt;code&gt;guestfs-tools&lt;/code&gt;&lt;/a&gt; (gzip mtime)&lt;/li&gt;
  363.      &lt;li&gt;&lt;a href=&quot;https://lore.kernel.org/linux-perf-users/20230320201841.1133-1-bwiedemann@suse.de/T/#u&quot;&gt;&lt;code&gt;perf&lt;/code&gt;&lt;/a&gt; (merged, sort python scandir)&lt;/li&gt;
  364.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1072531&quot;&gt;&lt;code&gt;perl-Date-Calc-XS&lt;/code&gt;&lt;/a&gt; (FTBFS-2038)&lt;/li&gt;
  365.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1072525&quot;&gt;&lt;code&gt;perl-Date-Calc&lt;/code&gt;&lt;/a&gt; (FTBFS-2038)&lt;/li&gt;
  366.      &lt;li&gt;&lt;a href=&quot;https://github.com/PerryWerneck/pw3270/pull/50&quot;&gt;&lt;code&gt;pw3270&lt;/code&gt;&lt;/a&gt; (merged, date)&lt;/li&gt;
  367.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1068462&quot;&gt;&lt;code&gt;python-dtaidistance&lt;/code&gt;&lt;/a&gt; (drop unreproducible unnecessary file)&lt;/li&gt;
  368.      &lt;li&gt;&lt;a href=&quot;https://bugzilla.opensuse.org/show_bug.cgi?id=1208969&quot;&gt;&lt;code&gt;sonic-pi&lt;/code&gt;&lt;/a&gt; (FTBFS-2038)&lt;/li&gt;
  369.      &lt;li&gt;&lt;a href=&quot;https://github.com/spack/spack/pull/36064&quot;&gt;&lt;code&gt;spack&lt;/code&gt;&lt;/a&gt; (parallelism)&lt;/li&gt;
  370.      &lt;li&gt;&lt;a href=&quot;https://github.com/tesseract-ocr/tesseract/issues/4030&quot;&gt;&lt;code&gt;tesseract&lt;/code&gt;&lt;/a&gt; (fixed, CPU, -march=native)&lt;/li&gt;
  371.    &lt;/ul&gt;
  372.  &lt;/li&gt;
  373.  &lt;li&gt;
  374.    &lt;p&gt;Chris Lamb:&lt;/p&gt;
  375.  
  376.    &lt;ul&gt;
  377.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1032409&quot;&gt;#1032409&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/esda&quot;&gt;&lt;code&gt;esda&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  378.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1032759&quot;&gt;#1032759&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/gle-graphics-manual&quot;&gt;&lt;code&gt;gle-graphics-manual&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  379.    &lt;/ul&gt;
  380.  &lt;/li&gt;
  381.  &lt;li&gt;
  382.    &lt;p&gt;Stefan Brüns:&lt;/p&gt;
  383.  
  384.    &lt;ul&gt;
  385.      &lt;li&gt;&lt;a href=&quot;https://sourceforge.net/p/mcj/fig2dev/ci/fc429e73ff70f3da13434a6787ee2c7be41dfa51/&quot;&gt;&lt;code&gt;transfig/fig2dev&lt;/code&gt;&lt;/a&gt; (also &lt;a href=&quot;https://build.opensuse.org/request/show/1070627&quot;&gt;in openSUSE&lt;/a&gt; ; date in PDF)&lt;/li&gt;
  386.    &lt;/ul&gt;
  387.  &lt;/li&gt;
  388.  &lt;li&gt;
  389.    &lt;p&gt;Vagrant Cascadian:&lt;/p&gt;
  390.  
  391.    &lt;ul&gt;
  392.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1033032&quot;&gt;#1033032&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/buddy&quot;&gt;&lt;code&gt;buddy&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  393.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1033089&quot;&gt;#1033089&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/subread&quot;&gt;&lt;code&gt;subread&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  394.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1033663&quot;&gt;#1033663&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/linux&quot;&gt;&lt;code&gt;linux&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  395.    &lt;/ul&gt;
  396.  &lt;/li&gt;
  397. &lt;/ul&gt;
  398.  
  399. &lt;p&gt;In addition, Vagrant Cascadian &lt;a href=&quot;https://savannah.nongnu.org/bugs/index.php?63944&quot;&gt;filed a bug with a patch&lt;/a&gt; to ensure &lt;a href=&quot;https://www.nongnu.org/gm2/homepage.html&quot;&gt;GNU Modula-2&lt;/a&gt; supports the &lt;a href=&quot;/docs/source-date-epoch/&quot;&gt;&lt;code&gt;SOURCE_DATE_EPOCH&lt;/code&gt;&lt;/a&gt; environment variable.&lt;/p&gt;
  400.  
  401. &lt;hr /&gt;
  402.  
  403. &lt;h2 id=&quot;testing-framework&quot;&gt;Testing framework&lt;/h2&gt;
  404.  
  405. &lt;p&gt;&lt;a href=&quot;https://tests.reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-03/testframework.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  406.  
  407. &lt;p&gt;The Reproducible Builds project operates a comprehensive testing framework (available at &lt;a href=&quot;https://tests.reproducible-builds.org&quot;&gt;tests.reproducible-builds.org&lt;/a&gt;) in order to check packages and other artifacts for reproducibility. In March, the following changes were made by Holger Levsen:&lt;/p&gt;
  408.  
  409. &lt;ul&gt;
  410.  &lt;li&gt;
  411.    &lt;p&gt;&lt;a href=&quot;https://archlinux.org/&quot;&gt;Arch Linux&lt;/a&gt;-related changes:&lt;/p&gt;
  412.  
  413.    &lt;ul&gt;
  414.      &lt;li&gt;Build Arch packages in &lt;code&gt;/tmp/archlinux-ci/$SRCPACKAGE&lt;/code&gt; instead of &lt;code&gt;/tmp/$SRCPACKAGE&lt;/code&gt;. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/83d7c78f0&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  415.      &lt;li&gt;Start 2/3 of the builds on the &lt;code&gt;o1&lt;/code&gt; node, the rest on &lt;code&gt;o2&lt;/code&gt;. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/b798a3111&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  416.      &lt;li&gt;Add graphs for Arch Linux (and OpenWrt) builds. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/93c0abe7d&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  417.      &lt;li&gt;Toggle Arch-related builders to debug why a specific node overloaded. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/2f3214451&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/0c68f8d80&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/f65123374&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/9aaa1a5f9&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  418.    &lt;/ul&gt;
  419.  &lt;/li&gt;
  420.  &lt;li&gt;
  421.    &lt;p&gt;Node health checks:&lt;/p&gt;
  422.  
  423.    &lt;ul&gt;
  424.      &lt;li&gt;Detect &lt;code&gt;SetuptoolsDeprecationWarning&lt;/code&gt; tracebacks in Python builds. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/950256a89&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  425.      &lt;li&gt;Detect failures do perform &lt;code&gt;chdist&lt;/code&gt; calls. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/b87374d28&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/39ade4464&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  426.    &lt;/ul&gt;
  427.  &lt;/li&gt;
  428.  &lt;li&gt;
  429.    &lt;p&gt;&lt;a href=&quot;https://osuosl.org/&quot;&gt;OSUOSL&lt;/a&gt; node migration.&lt;/p&gt;
  430.  
  431.    &lt;ul&gt;
  432.      &lt;li&gt;Install &lt;code&gt;megacli&lt;/code&gt; packages that are needed for hardware RAID. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/649a70080&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/52fae771e&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  433.      &lt;li&gt;Add health check and maintenance jobs for new nodes. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/11a38325e&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  434.      &lt;li&gt;Add mail config for new nodes. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/3ca9e3a8d&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/72f3fbb89&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  435.      &lt;li&gt;Handle a node running in the future correctly. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/8cdfe61f0&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/3bc4af860&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  436.      &lt;li&gt;Migrate some nodes to Debian &lt;em&gt;bookworm&lt;/em&gt;. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/95e7d0773&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  437.      &lt;li&gt;Fix nodes health overview for osuosl3. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/e29233697&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  438.      &lt;li&gt;Make sure the &lt;code&gt;/srv/workspace&lt;/code&gt; directory is owned by by the &lt;code&gt;jenkins&lt;/code&gt; user. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/c30f8722f&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  439.      &lt;li&gt;Use &lt;code&gt;.debian.net&lt;/code&gt; names everywhere, except when communicating with the outside world. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/e3df5ea5d&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  440.      &lt;li&gt;Grant &lt;em&gt;fpierret&lt;/em&gt; access to a new node. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/13c01e232&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  441.      &lt;li&gt;Update documentation. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/b350fd3d2&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  442.      &lt;li&gt;Misc migration changes. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/66051839c&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/e95106f82&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/a8815d1c9&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/a9ef6c0c2&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/11fc197ac&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/9a74cdaf9&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/5c9a894a1&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/627e56fa3&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  443.    &lt;/ul&gt;
  444.  &lt;/li&gt;
  445.  &lt;li&gt;
  446.    &lt;p&gt;Misc changes:&lt;/p&gt;
  447.  
  448.    &lt;ul&gt;
  449.      &lt;li&gt;Enable fail2ban everywhere and monitor it with munin [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/2d5c765d0&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  450.      &lt;li&gt;Gracefully deal with non-existing &lt;a href=&quot;https://www.alpinelinux.org/&quot;&gt;Alpine&lt;/a&gt; schroots. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/a8d44f889&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  451.    &lt;/ul&gt;
  452.  &lt;/li&gt;
  453. &lt;/ul&gt;
  454.  
  455. &lt;p&gt;In addition, Roland Clobus is continuing his work on &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/002877.html&quot;&gt;reproducible Debian ISO images&lt;/a&gt;:&lt;/p&gt;
  456.  
  457. &lt;ul&gt;
  458.  &lt;li&gt;Add/update &lt;a href=&quot;http://open.qa/&quot;&gt;openQA&lt;/a&gt; configuration [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/962a721f4&quot;&gt;…&lt;/a&gt;], and use the actual timestamp for openQA builds [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/f0ac16d13&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  459.  &lt;li&gt;Moved adding the user to the &lt;code&gt;docker&lt;/code&gt; group from the &lt;code&gt;janitor_setup_worker&lt;/code&gt; script to the (more general) &lt;code&gt;update_jdn.sh&lt;/code&gt; script. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/25835d550&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  460.  &lt;li&gt;Use the (short-term) ‘reproducible’ source when generating &lt;code&gt;live-build&lt;/code&gt; images. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/b1c218dad&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  461. &lt;/ul&gt;
  462.  
  463. &lt;hr /&gt;
  464.  
  465. &lt;h2 id=&quot;diffoscope-development&quot;&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;em&gt;diffoscope&lt;/em&gt;&lt;/a&gt; development&lt;/h2&gt;
  466.  
  467. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;img src=&quot;/images/reports/2023-03/diffoscope.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  468.  
  469. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;em&gt;diffoscope&lt;/em&gt;&lt;/a&gt; is our in-depth and content-aware diff utility. Not only can it locate and diagnose reproducibility issues, it can provide human-readable diffs from many kinds of binary formats as well. This month, Mattia Rizzolo released versions &lt;a href=&quot;https://diffoscope.org/news/diffoscope-238-released/&quot;&gt;&lt;code&gt;238&lt;/code&gt;&lt;/a&gt;, and Chris Lamb released versions &lt;a href=&quot;https://diffoscope.org/news/diffoscope-239-released/&quot;&gt;&lt;code&gt;239&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;https://diffoscope.org/news/diffoscope-240-released/&quot;&gt;&lt;code&gt;240&lt;/code&gt;&lt;/a&gt;. Chris Lamb also made the following changes:&lt;/p&gt;
  470.  
  471. &lt;ul&gt;
  472.  &lt;li&gt;Fix compatibility with PyPDF 3.x, and correctly restore test data. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/a91f8bfe&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  473.  &lt;li&gt;Rework PDF annotation handling into a separate method. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/2b268980&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  474. &lt;/ul&gt;
  475.  
  476. &lt;p&gt;In addition, Holger Levsen performed a long-overdue overhaul of the &lt;a href=&quot;https://lintian.debian.org/&quot;&gt;Lintian&lt;/a&gt; overrides in the Debian packaging [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/7d0fd9c3&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/8b0fe07a&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/e430e268&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/04f2114f&quot;&gt;…&lt;/a&gt;], and Mattia Rizzolo updated the packaging to silence an &lt;code&gt;include_package_data=True&lt;/code&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/f2f30420&quot;&gt;…&lt;/a&gt;], fixed the build under Debian &lt;em&gt;bullseye&lt;/em&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/9e525a8e&quot;&gt;…&lt;/a&gt;], fixed tool name in a list of tools permitted to be absent during package build tests [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/36854d06&quot;&gt;…&lt;/a&gt;] and as well as documented sending out an email upon  [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/635c404d&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  477.  
  478. &lt;p&gt;In addition, Vagrant Cascadian updated the version of &lt;a href=&quot;https://guix.gnu.org/&quot;&gt;GNU Guix&lt;/a&gt; to 238 [&lt;a href=&quot;https://issues.guix.gnu.org/62312&quot;&gt;…&lt;/a&gt; and 239 [&lt;a href=&quot;https://issues.guix.gnu.org/62312&quot;&gt;…&lt;/a&gt;]. Vagrant also updated &lt;em&gt;reprotest&lt;/em&gt; to version 0.7.23. [&lt;a href=&quot;https://issues.guix.gnu.org/62172&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  479.  
  480. &lt;hr /&gt;
  481.  
  482. &lt;h2 id=&quot;other-development-work&quot;&gt;Other development work&lt;/h2&gt;
  483.  
  484. &lt;p&gt;&lt;a href=&quot;https://www.opensuse.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-03/opensuse.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  485.  
  486. &lt;p&gt;Bernhard M. Wiedemann published another &lt;a href=&quot;https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/WB5NTG4Q6KK2YLIZ4OF65MI5CQDOEA3B/&quot;&gt;monthly report about reproducibility within openSUSE&lt;/a&gt;&lt;/p&gt;
  487.  
  488. &lt;p&gt;&lt;br /&gt;
  489. &lt;br /&gt;&lt;/p&gt;
  490.  
  491. &lt;hr /&gt;
  492.  
  493. &lt;p&gt;If you are interested in contributing to the Reproducible Builds project, please visit our &lt;a href=&quot;https://reproducible-builds.org/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page on our website. However, you can get in touch with us via:&lt;/p&gt;
  494.  
  495. &lt;ul&gt;
  496.  &lt;li&gt;
  497.    &lt;p&gt;IRC: &lt;code&gt;#reproducible-builds&lt;/code&gt; on &lt;code&gt;irc.oftc.net&lt;/code&gt;.&lt;/p&gt;
  498.  &lt;/li&gt;
  499.  &lt;li&gt;
  500.    &lt;p&gt;Twitter: &lt;a href=&quot;https://twitter.com/ReproBuilds&quot;&gt;@ReproBuilds&lt;/a&gt;&lt;/p&gt;
  501.  &lt;/li&gt;
  502.  &lt;li&gt;
  503.    &lt;p&gt;Mailing list: &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general&quot;&gt;&lt;code&gt;rb-general@lists.reproducible-builds.org&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;
  504.  &lt;/li&gt;
  505. &lt;/ul&gt;
  506. </description>
  507.      </item>
  508.    
  509.      <item>
  510.        <title>Reproducible Builds in February 2023</title>
  511.        <pubDate>Sun, 05 Mar 2023 08:53:40 +0000</pubDate>
  512.        <link>https://reproducible-builds.org/reports/2023-02/</link>
  513.        <guid isPermaLink="true">https://reproducible-builds.org/reports/2023-02/</guid>
  514.        <description>&lt;p&gt;&lt;a href=&quot;https://reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-02/reproducible-builds.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  515.  
  516. &lt;p&gt;&lt;strong&gt;Welcome to the February 2023 report from the &lt;a href=&quot;https://reproducible-builds.org&quot;&gt;Reproducible Builds&lt;/a&gt; project.&lt;/strong&gt; As ever, if you are interested in contributing to our project, please visit the &lt;a href=&quot;/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page on our website.&lt;/p&gt;
  517.  
  518. &lt;hr /&gt;
  519.  
  520. &lt;p&gt;&lt;a href=&quot;FOSDEM&quot;&gt;&lt;img src=&quot;/images/reports/2023-02/fosdem.jpeg#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  521.  
  522. &lt;p&gt;&lt;a href=&quot;https://fosdem.org/2023/&quot;&gt;FOSDEM 2023&lt;/a&gt; was held in Brussels on the 4th &amp;amp; 5th of February and featured a number of talks related to reproducibility. In particular, Akihiro Suda gave a talk titled &lt;a href=&quot;https://fosdem.org/2023/schedule/event/container_reproducible_dockerfile&quot;&gt;&lt;em&gt;Bit-for-bit reproducible builds with Dockerfile&lt;/em&gt;&lt;/a&gt; discussing deterministic timestamps and deterministic &lt;code&gt;apt-get&lt;/code&gt; (&lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/002842.html&quot;&gt;original announcement&lt;/a&gt;). There was also an entire &lt;a href=&quot;https://fosdem.org/2023/schedule/track/software_bill_of_materials/&quot;&gt;‘track’ of talks on Software Bill of Materials&lt;/a&gt; (SBOMs). SBOMs are an inventory for software with the intention of increasing the transparency of software components (the US &lt;a href=&quot;https://ntia.gov/&quot;&gt;National Telecommunications and Information Administration&lt;/a&gt; (NTIA) published a useful &lt;a href=&quot;https://ntia.gov/sites/default/files/publications/sbom_myths_vs_facts_nov2021_0.pdf&quot;&gt;&lt;em&gt;Myths vs. Facts&lt;/em&gt;&lt;/a&gt; document in 2021).&lt;/p&gt;
  523.  
  524. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  525.  
  526. &lt;p&gt;On &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general/&quot;&gt;our mailing list&lt;/a&gt; this month, Larry Doolittle was puzzled why the &lt;a href=&quot;https://tracker.debian.org/pkg/verilator&quot;&gt;Debian &lt;code&gt;verilator&lt;/code&gt; package&lt;/a&gt; was not reproducible [&lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/002856.html&quot;&gt;…&lt;/a&gt;], but Chris Lamb pointed out that this was due to the use of Python’s &lt;a href=&quot;https://docs.python.org/3/library/datetime.html#datetime.datetime.fromtimestamp&quot;&gt;&lt;code&gt;datetime.fromtimestamp&lt;/code&gt;&lt;/a&gt; over &lt;a href=&quot;https://docs.python.org/3/library/datetime.html#datetime.datetime.utcfromtimestamp&quot;&gt;&lt;code&gt;datetime.utcfromtimestamp&lt;/code&gt;&lt;/a&gt; [&lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/002859.html&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  527.  
  528. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  529.  
  530. &lt;p&gt;James Addison also was having issues with a Debian package: in this case, the &lt;a href=&quot;https://tracker.debian.org/pkg/alembic&quot;&gt;&lt;code&gt;alembic&lt;/code&gt;&lt;/a&gt; package. Chris Lamb was also able to identify the &lt;a href=&quot;https://www.sphinx-doc.org/en/master/&quot;&gt;Sphinx documentation generator&lt;/a&gt; as the cause of the problem, and &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/002862.html&quot;&gt;provided a potential patch that might fix it&lt;/a&gt;. This was later filed upstream [&lt;a href=&quot;https://github.com/sphinx-doc/sphinx/issues/11198&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  531.  
  532. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  533.  
  534. &lt;p&gt;Anthony Harrison wrote to our list twice, first by &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/002871.html&quot;&gt;introducing himself and their background&lt;/a&gt; and later to mention the increasing relevance of Software Bill of Materials (SBOMs):&lt;/p&gt;
  535.  
  536. &lt;blockquote&gt;
  537.  &lt;p&gt;As I am sure everyone is aware, there is a growing interest in [SBOMs] as a
  538. way of improving software security and resilience. In the last two years, the
  539. US through the Exec Order, the EU through the proposed Cyber Resilience Act
  540. (CRA) and this month the UK has issued a consultation paper looking at
  541. software security and SBOMs appear very prominently in each
  542. publication. [&lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/002872.html&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  543. &lt;/blockquote&gt;
  544.  
  545. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  546.  
  547. &lt;p&gt;&lt;a href=&quot;https://retout.co.uk/2023/02/04/almalinux-and-sboms/&quot;&gt;&lt;img src=&quot;/images/reports/2023-02/almalinux.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  548.  
  549. &lt;p&gt;&lt;a href=&quot;https://retout.co.uk/&quot;&gt;Tim Retout&lt;/a&gt; wrote a blog post discussing &lt;a href=&quot;https://almalinux.org/&quot;&gt;AlmaLinux&lt;/a&gt; in the context of CentOS, RHEL and supply-chain security in general [&lt;a href=&quot;https://retout.co.uk/2023/02/04/almalinux-and-sboms/&quot;&gt;…&lt;/a&gt;]:&lt;/p&gt;
  550.  
  551. &lt;blockquote&gt;
  552.  &lt;p&gt;Alma are generating and publishing Software Bill of Material (SBOM) files for
  553. every package; these are becoming a requirement for all software sold to the
  554. US federal government. What’s more, they are sending these SBOMs to a third
  555. party (&lt;a href=&quot;https://codenotary.com/&quot;&gt;CodeNotary&lt;/a&gt;) who store them in some sort of
  556. &lt;a href=&quot;https://en.wikipedia.org/wiki/Merkle_tree&quot;&gt;Merkle tree&lt;/a&gt; system to make it
  557. difficult for people to tamper with later. This should theoretically allow
  558. end users of the distribution to verify the supply chain of the packages they
  559. have installed?&lt;/p&gt;
  560. &lt;/blockquote&gt;
  561.  
  562. &lt;hr /&gt;
  563.  
  564. &lt;h2 id=&quot;debian&quot;&gt;Debian&lt;/h2&gt;
  565.  
  566. &lt;p&gt;&lt;a href=&quot;https://debian.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-02/debian.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  567.  
  568. &lt;ul&gt;
  569.  &lt;li&gt;
  570.    &lt;p&gt;Vagrant Cascadian noted that the Debian &lt;em&gt;bookworm&lt;/em&gt; distribution has finally surpassed &lt;em&gt;bullseye&lt;/em&gt; for reproducibility: 96.1% vs. 96.0%, despite having over 3500 more packages in the distribution.&lt;/p&gt;
  571.  &lt;/li&gt;
  572.  &lt;li&gt;
  573.    &lt;p&gt;Roland Clobus posted his &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/002877.html&quot;&gt;latest update of the status of reproducible Debian ISO images&lt;/a&gt; noting that “all major desktops build reproducibly with &lt;em&gt;bullseye&lt;/em&gt;, &lt;em&gt;bookworm&lt;/em&gt; and &lt;em&gt;sid&lt;/em&gt;,” with the caveat that “when non-free firmware is activated, some non-reproducible files are generated”.&lt;/p&gt;
  574.  &lt;/li&gt;
  575.  &lt;li&gt;
  576.    &lt;p&gt;FC Stegerman submitted a new &lt;a href=&quot;https://wiki.debian.org/ITP&quot;&gt;Intent to Package (ITP)&lt;/a&gt; bug report &lt;a href=&quot;https://bugs.debian.org/1030768&quot;&gt;representing an intention to package &lt;code&gt;repro-apk&lt;/code&gt;&lt;/a&gt;, a set of &lt;a href=&quot;https://github.com/obfusk/reproducible-apk-tools&quot;&gt;scripts to make Android &lt;code&gt;.apk&lt;/code&gt; files reproducible&lt;/a&gt;.&lt;/p&gt;
  577.  &lt;/li&gt;
  578.  &lt;li&gt;
  579.    &lt;p&gt;23 reviews of Debian packages were added, 24 were updated and 20 were removed this month adding to &lt;a href=&quot;https://tests.reproducible-builds.org/debian/index_issues.html&quot;&gt;our knowledge about identified issues&lt;/a&gt;. A new issue was added and identified by Chris Lamb [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/c2b3882c&quot;&gt;…&lt;/a&gt;], and the &lt;code&gt;timestamps_embedded_in_manpages_by_node_marked_man&lt;/code&gt; issue has been marked as resolved [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/5cb5d781&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  580.  &lt;/li&gt;
  581. &lt;/ul&gt;
  582.  
  583. &lt;hr /&gt;
  584.  
  585. &lt;h2 id=&quot;f-droid--android&quot;&gt;F-Droid &amp;amp; Android&lt;/h2&gt;
  586.  
  587. &lt;p&gt;&lt;a href=&quot;https://f-droid.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-02/fdroid.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  588.  
  589. &lt;ul&gt;
  590.  &lt;li&gt;
  591.    &lt;p&gt;This month, F-Droid added 21 apps published with reproducible builds (out of 33 new apps in total), the &lt;a href=&quot;https://gitlab.com/obfusk/fdroid-misc-scripts/-/blob/master/reproducible/overview.md&quot;&gt;overview of F-Droid apps published with Reproducible Builds&lt;/a&gt; now includes graphs, and there are now also some &lt;a href=&quot;https://gitlab.com/obfusk/fdroid-misc-scripts/-/blob/master/verification/graphs.md&quot;&gt;graphs of F-Droid apps verified by the Verification Server&lt;/a&gt;.&lt;/p&gt;
  592.  &lt;/li&gt;
  593.  &lt;li&gt;
  594.    &lt;p&gt;FC Stegerman noticed that &lt;a href=&quot;https://github.com/obfusk/apksigcopier/issues/88&quot;&gt;signatures made by older versions of Android Gradle plugin cannot be copied&lt;/a&gt; because the signing method differs too much from that used by &lt;a href=&quot;https://developer.android.com/studio/command-line/apksigner&quot;&gt;&lt;em&gt;apksigner&lt;/em&gt;&lt;/a&gt; (and &lt;a href=&quot;https://android.googlesource.com/platform/tools/base/+/studio-master-dev/signflinger/&quot;&gt;&lt;em&gt;signflinger&lt;/em&gt;&lt;/a&gt;).&lt;/p&gt;
  595.  &lt;/li&gt;
  596.  &lt;li&gt;
  597.    &lt;p&gt;FC Stegerman also created a helpful HOWTO page on the &lt;a href=&quot;https://gitlab.com/fdroid/wiki/-/wikis/pages&quot;&gt;F-Droid Wiki&lt;/a&gt; detailing how to &lt;a href=&quot;https://gitlab.com/fdroid/wiki/-/wikis/HOWTO:-diff-&amp;amp;-fix-APKs-for-Reproducible-Builds&quot;&gt;compare and subsequently make APKs reproducible&lt;/a&gt;.&lt;/p&gt;
  598.  &lt;/li&gt;
  599.  &lt;li&gt;
  600.    &lt;p&gt;A long-running thread on &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/thread.html#2828&quot;&gt;&lt;em&gt;Hiding data/code in Android APK embedded signatures&lt;/em&gt;&lt;/a&gt; continued on &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general/&quot;&gt;our mailing list&lt;/a&gt; this month; &lt;a href=&quot;https://github.com/obfusk/apksigcopier&quot;&gt;&lt;em&gt;apksigcopier&lt;/em&gt;&lt;/a&gt; &lt;code&gt;v1.1.1&lt;/code&gt; and &lt;a href=&quot;https://github.com/obfusk/reproducible-apk-tools&quot;&gt;&lt;em&gt;reproducible-apk-tools&lt;/em&gt;&lt;/a&gt; &lt;code&gt;v0.2.2&lt;/code&gt; + &lt;code&gt;v0.2.3&lt;/code&gt; were also &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/002853.html&quot;&gt;announced&lt;/a&gt; on the same list.&lt;/p&gt;
  601.  &lt;/li&gt;
  602.  &lt;li&gt;
  603.    &lt;p&gt;Lastly, FC Stegerman reported two issues on Google’s own issue tracker: one related to a non-deterministic “Dependency Info Block” [&lt;a href=&quot;https://issuetracker.google.com/issues/268071369&quot;&gt;…&lt;/a&gt;] and another about a “virtual entry” added by the &lt;a href=&quot;https://android.googlesource.com/platform/tools/base/+/studio-master-dev/signflinger/&quot;&gt;&lt;em&gt;signflinger&lt;/em&gt;&lt;/a&gt; tool causing unexpected differences between signed and unsigned APKs [&lt;a href=&quot;https://issuetracker.google.com/issues/268071371&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  604.  &lt;/li&gt;
  605. &lt;/ul&gt;
  606.  
  607. &lt;hr /&gt;
  608.  
  609. &lt;h2 id=&quot;diffoscope&quot;&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;diffoscope&lt;/a&gt;&lt;/h2&gt;
  610.  
  611. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;img src=&quot;/images/reports/2023-02/diffoscope.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  612.  
  613. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;em&gt;diffoscope&lt;/em&gt;&lt;/a&gt; is our in-depth and content-aware diff utility. Not only can it locate and diagnose reproducibility issues, it can provide human-readable diffs from many kinds of binary formats.&lt;/p&gt;
  614.  
  615. &lt;p&gt;This month, Chris Lamb released versions &lt;a href=&quot;https://diffoscope.org/news/diffoscope-235-released/&quot;&gt;&lt;code&gt;235&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;https://diffoscope.org/news/diffoscope-236-released/&quot;&gt;&lt;code&gt;236&lt;/code&gt;&lt;/a&gt;; Mattia Rizzolo later released version &lt;a href=&quot;https://diffoscope.org/news/diffoscope-237-released/&quot;&gt;&lt;code&gt;237&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;
  616.  
  617. &lt;p&gt;Contributions include:&lt;/p&gt;
  618. &lt;ul&gt;
  619.  &lt;li&gt;Chris Lamb:
  620.    &lt;ul&gt;
  621.      &lt;li&gt;Fix compatibility with PyPDF2 (re. issue &lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/331&quot;&gt;#331&lt;/a&gt;) [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/82a767d2&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/ff6d9bbd&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/ccf3c2a4&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  622.      &lt;li&gt;Fix compatibility with &lt;a href=&quot;https://imagemagick.org&quot;&gt;ImageMagick&lt;/a&gt; version 7.1 [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/60ea9cc6&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  623.      &lt;li&gt;Require at least version 23.1.0 to run the &lt;a href=&quot;https://github.com/psf/black&quot;&gt;Black&lt;/a&gt; source code tests [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/c45de0a1&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  624.      &lt;li&gt;Update &lt;code&gt;debian/tests/control&lt;/code&gt; after merging changes from others [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/72e5b2a1&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  625.      &lt;li&gt;Don’t write test data during a test [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/25dcd1e6&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  626.      &lt;li&gt;Update copyright years [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/be3973b0&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  627.      &lt;li&gt;Merged a large number of changes from others.&lt;/li&gt;
  628.    &lt;/ul&gt;
  629.  &lt;/li&gt;
  630.  &lt;li&gt;
  631.    &lt;p&gt;Akihiro Suda edited the &lt;code&gt;.gitlab-ci.yml&lt;/code&gt; configuration file to ensure that versioned tags are pushed to the container registry [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/637c2985&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  632.  &lt;/li&gt;
  633.  &lt;li&gt;
  634.    &lt;p&gt;Daniel Kahn Gillmor provided a way to migrate from PyPDF2 to pypdf (&lt;a href=&quot;https://bugs.debian.org/1029742&quot;&gt;#1029741&lt;/a&gt;).&lt;/p&gt;
  635.  &lt;/li&gt;
  636.  &lt;li&gt;
  637.    &lt;p&gt;Efraim Flashner updated the tool metadata for &lt;code&gt;isoinfo&lt;/code&gt; on &lt;a href=&quot;https://guix.gnu.org/&quot;&gt;GNU Guix&lt;/a&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/7d6ce503&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  638.  &lt;/li&gt;
  639.  &lt;li&gt;
  640.    &lt;p&gt;FC Stegerman added support for Android &lt;code&gt;resources.arsc&lt;/code&gt; files [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/7cf77ed1&quot;&gt;…&lt;/a&gt;], improved a number of file-matching regular expressions [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/8d7762f6&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/c988c3ad&quot;&gt;…&lt;/a&gt;] and added support for Android &lt;code&gt;dexdump&lt;/code&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/1bb9b812&quot;&gt;…&lt;/a&gt;]; they also &lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/f48fbe61&quot;&gt;fixed&lt;/a&gt; a test failure (&lt;a href=&quot;https://bugs.debian.org/1031433&quot;&gt;#1031433&lt;/a&gt;) caused by Debian’s &lt;code&gt;black&lt;/code&gt; package having been updated to a newer version.&lt;/p&gt;
  641.  &lt;/li&gt;
  642.  &lt;li&gt;Mattia Rizzolo:
  643.    &lt;ul&gt;
  644.      &lt;li&gt;updated the release documentation [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/b17b0595&quot;&gt;…&lt;/a&gt;],&lt;/li&gt;
  645.      &lt;li&gt;fixed a number of &lt;a href=&quot;https://flake8.pycqa.org/en/latest/&quot;&gt;Flake8&lt;/a&gt; errors [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/8f710cd5&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/6eb8d06f&quot;&gt;…&lt;/a&gt;],&lt;/li&gt;
  646.      &lt;li&gt;updated the autopkgtest configuration to only install &lt;code&gt;aapt&lt;/code&gt; and &lt;code&gt;dexdump&lt;/code&gt; on architectures where they are available [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/61f7c2b3&quot;&gt;…&lt;/a&gt;], making sure that the latest diffoscope release is in a good fit for the upcoming Debian bookworm freeze.&lt;/li&gt;
  647.    &lt;/ul&gt;
  648.  &lt;/li&gt;
  649. &lt;/ul&gt;
  650.  
  651. &lt;hr /&gt;
  652.  
  653. &lt;h2 id=&quot;reprotest&quot;&gt;&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reprotest&quot;&gt;reprotest&lt;/a&gt;&lt;/h2&gt;
  654.  
  655. &lt;p&gt;&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reprotest&quot;&gt;Reprotest&lt;/a&gt; version 0.7.23 was uploaded to both &lt;a href=&quot;https://pypi.org/&quot;&gt;PyPI&lt;/a&gt; and Debian unstable, including the following changes:&lt;/p&gt;
  656.  
  657. &lt;ul&gt;
  658.  &lt;li&gt;
  659.    &lt;p&gt;Holger Levsen improved a lot of documentation [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reprotest/commit/296800e&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reprotest/commit/82d585b&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reprotest/commit/b2a6f6f&quot;&gt;…&lt;/a&gt;], tidied the documentation as well [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reprotest/commit/e8d9476&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reprotest/commit/84496fa&quot;&gt;…&lt;/a&gt;], and experimented with a new &lt;code&gt;--random-locale&lt;/code&gt; flag [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reprotest/commit/f76f6e1&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  660.  &lt;/li&gt;
  661.  &lt;li&gt;
  662.    &lt;p&gt;Vagrant Cascadian adjusted &lt;em&gt;reprotest&lt;/em&gt; to no longer randomise the build locale and use a UTF-8 supported locale instead &lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reprotest/-/commit/610e6cae&quot;&gt;[…]&lt;/a&gt; (re. &lt;a href=&quot;https://bugs.debian.org/925879&quot;&gt;#925879&lt;/a&gt;, &lt;a href=&quot;https://bugs.debian.org/1004950&quot;&gt;#1004950&lt;/a&gt;), and to also support passing &lt;code&gt;--vary=locales.locale=LOCALE&lt;/code&gt; to specify the locale to vary [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reprotest/commit/a92f741&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  663.  &lt;/li&gt;
  664. &lt;/ul&gt;
  665.  
  666. &lt;p&gt;Separate to this, Vagrant Cascadian started a thread on our &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general&quot;&gt;mailing list&lt;/a&gt; questioning the &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/002876.html&quot;&gt;future development and direction of &lt;em&gt;reprotest&lt;/em&gt;&lt;/a&gt;.&lt;/p&gt;
  667.  
  668. &lt;hr /&gt;
  669.  
  670. &lt;h2 id=&quot;upstream-patches&quot;&gt;Upstream patches&lt;/h2&gt;
  671.  
  672. &lt;p&gt;The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where appropriate. This month, we wrote a large number of such patches, including:&lt;/p&gt;
  673.  
  674. &lt;ul&gt;
  675.  &lt;li&gt;
  676.    &lt;p&gt;Bernhard M. Wiedemann:&lt;/p&gt;
  677.  
  678.    &lt;ul&gt;
  679.      &lt;li&gt;&lt;a href=&quot;https://github.com/aio-libs/aiohttp/pull/7191&quot;&gt;&lt;code&gt;aiohttp&lt;/code&gt;&lt;/a&gt; (build fails in the future)&lt;/li&gt;
  680.      &lt;li&gt;&lt;a href=&quot;https://bugzilla.opensuse.org/show_bug.cgi?id=1180471&quot;&gt;&lt;code&gt;diff-pdf&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;
  681.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1067125&quot;&gt;&lt;code&gt;dpdk&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;
  682.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1066747&quot;&gt;&lt;code&gt;ebumeter&lt;/code&gt;&lt;/a&gt; (CPU-related issue)&lt;/li&gt;
  683.      &lt;li&gt;&lt;a href=&quot;https://github.com/firecracker-microvm/firecracker/issues/3439&quot;&gt;&lt;code&gt;firecracker&lt;/code&gt;&lt;/a&gt; (hashmap ordering issue)&lt;/li&gt;
  684.      &lt;li&gt;&lt;a href=&quot;https://bugzilla.opensuse.org/show_bug.cgi?id=1208386&quot;&gt;&lt;code&gt;jhead/gcc&lt;/code&gt;&lt;/a&gt; (used random temporary directory name)&lt;/li&gt;
  685.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1068331&quot;&gt;&lt;code&gt;libhugetlbfs&lt;/code&gt;&lt;/a&gt; (drop unused unreproducible file)&lt;/li&gt;
  686.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1066043&quot;&gt;&lt;code&gt;prosody&lt;/code&gt;&lt;/a&gt; (generates nondeterministic example SSL certificates)&lt;/li&gt;
  687.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1067129&quot;&gt;&lt;code&gt;python-sqlalchemy-migrate&lt;/code&gt;&lt;/a&gt; (clean files leftover by &lt;a href=&quot;https://www.sphinx-doc.org/en/master/&quot;&gt;Sphinx&lt;/a&gt;)&lt;/li&gt;
  688.      &lt;li&gt;&lt;a href=&quot;https://bugzilla.opensuse.org/show_bug.cgi?id=1208478&quot;&gt;&lt;code&gt;tigervnc&lt;/code&gt;&lt;/a&gt; (random RSA key)&lt;/li&gt;
  689.    &lt;/ul&gt;
  690.  &lt;/li&gt;
  691.  &lt;li&gt;
  692.    &lt;p&gt;Chris Lamb:&lt;/p&gt;
  693.  
  694.    &lt;ul&gt;
  695.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1030708&quot;&gt;#1030708&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/gap-browse&quot;&gt;&lt;code&gt;gap-browse&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  696.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1030714&quot;&gt;#1030714&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/cwltool&quot;&gt;&lt;code&gt;cwltool&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  697.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1030715&quot;&gt;#1030715&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/adacgi&quot;&gt;&lt;code&gt;adacgi&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  698.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1030724&quot;&gt;#1030724&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/node-marked-man&quot;&gt;&lt;code&gt;node-marked-man&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://github.com/kapouer/marked-man/pull/32&quot;&gt;forwarded upstream&lt;/a&gt;).&lt;/li&gt;
  699.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1030727&quot;&gt;#1030727&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/multipath-tools&quot;&gt;&lt;code&gt;multipath-tools&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  700.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1031030&quot;&gt;#1031030&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/ruby-pgplot&quot;&gt;&lt;code&gt;ruby-pgplot&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  701.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1031412&quot;&gt;#1031412&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/pysdl2&quot;&gt;&lt;code&gt;pysdl2&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  702.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1031829&quot;&gt;#1031829&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/gawk&quot;&gt;&lt;code&gt;gawk&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  703.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1032057&quot;&gt;#1032057&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/pyproject-api&quot;&gt;&lt;code&gt;pyproject-api&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  704.    &lt;/ul&gt;
  705.  &lt;/li&gt;
  706.  &lt;li&gt;
  707.    &lt;p&gt;Gioele Barabucci:&lt;/p&gt;
  708.  
  709.    &lt;ul&gt;
  710.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1032056&quot;&gt;#1032056&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/systemtap&quot;&gt;&lt;code&gt;systemtap&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  711.    &lt;/ul&gt;
  712.  &lt;/li&gt;
  713.  &lt;li&gt;
  714.    &lt;p&gt;Larry Doolittle:&lt;/p&gt;
  715.  
  716.    &lt;ul&gt;
  717.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1031711&quot;&gt;#1031711&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/verilator&quot;&gt;&lt;code&gt;verilator&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  718.    &lt;/ul&gt;
  719.  &lt;/li&gt;
  720.  &lt;li&gt;
  721.    &lt;p&gt;Vagrant Cascadian:&lt;/p&gt;
  722.  
  723.    &lt;ul&gt;
  724.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1030270&quot;&gt;#1030270&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/libreoffice&quot;&gt;&lt;code&gt;libreoffice&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  725.    &lt;/ul&gt;
  726.  &lt;/li&gt;
  727. &lt;/ul&gt;
  728.  
  729. &lt;hr /&gt;
  730.  
  731. &lt;h2 id=&quot;testing-framework&quot;&gt;Testing framework&lt;/h2&gt;
  732.  
  733. &lt;p&gt;&lt;a href=&quot;https://tests.reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-02/testframework.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  734.  
  735. &lt;p&gt;The Reproducible Builds project operates a comprehensive testing framework (available at &lt;a href=&quot;https://tests.reproducible-builds.org&quot;&gt;tests.reproducible-builds.org&lt;/a&gt;) in order to check packages and other artifacts for reproducibility. In February, the following changes were made by Holger Levsen:&lt;/p&gt;
  736.  
  737. &lt;ul&gt;
  738.  &lt;li&gt;Add three new &lt;a href=&quot;https://osuosl.org/&quot;&gt;OSUOSL&lt;/a&gt; nodes [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/d188805b&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/f9f9c65d&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/f57dbeb1&quot;&gt;…&lt;/a&gt;] and decommission the &lt;code&gt;osuosl174&lt;/code&gt; node [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/f05f9ce7&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  739.  &lt;li&gt;Change the order of listed Debian architectures to show the 64-bit ones first [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/0b65129f&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  740.  &lt;li&gt;Reduce the frequency that the Debian package sets and &lt;code&gt;dd-list&lt;/code&gt; HTML pages update [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/965b4358&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  741.  &lt;li&gt;Sort “Tested suite” consistently (and Debian &lt;em&gt;unstable&lt;/em&gt; first) [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/6503fafd&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  742.  &lt;li&gt;Update the Jenkins shell monitor script to only query disk statistics every 230min [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/7eafae2d&quot;&gt;…&lt;/a&gt;] and improve the documentation [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/5ed88c03&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/8d882964&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  743. &lt;/ul&gt;
  744.  
  745. &lt;hr /&gt;
  746.  
  747. &lt;h2 id=&quot;other-development-work&quot;&gt;Other development work&lt;/h2&gt;
  748.  
  749. &lt;p&gt;&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/disorderfs&quot;&gt;&lt;em&gt;disorderfs&lt;/em&gt;&lt;/a&gt; version &lt;code&gt;0.5.11-3&lt;/code&gt; was uploaded by Holger Levsen, fixing a number of issues with the manual page [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/disorderfs/commit/2c3df22&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/disorderfs/commit/e92c9c2&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/disorderfs/commit/76c9e78&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  750.  
  751. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  752.  
  753. &lt;p&gt;&lt;a href=&quot;https://www.opensuse.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-02/opensuse.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  754.  
  755. &lt;p&gt;Bernhard M. Wiedemann published another &lt;a href=&quot;https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/5TURLU4YB6PL2ES5GFWUJIQS22Z4YRKZ/&quot;&gt;monthly report about reproducibility within openSUSE&lt;/a&gt;.&lt;/p&gt;
  756.  
  757. &lt;hr /&gt;
  758.  
  759. &lt;p&gt;If you are interested in contributing to the Reproducible Builds project, please visit the &lt;a href=&quot;https://reproducible-builds.org/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page on our website. You can get in touch with us via:&lt;/p&gt;
  760.  
  761. &lt;ul&gt;
  762.  &lt;li&gt;
  763.    &lt;p&gt;IRC: &lt;code&gt;#reproducible-builds&lt;/code&gt; on &lt;code&gt;irc.oftc.net&lt;/code&gt;.&lt;/p&gt;
  764.  &lt;/li&gt;
  765.  &lt;li&gt;
  766.    &lt;p&gt;Twitter: &lt;a href=&quot;https://twitter.com/ReproBuilds&quot;&gt;@ReproBuilds&lt;/a&gt;&lt;/p&gt;
  767.  &lt;/li&gt;
  768.  &lt;li&gt;
  769.    &lt;p&gt;Mastodon: &lt;a href=&quot;https://fosstodon.org/@reproducible_builds&quot;&gt;@reproducible_builds@fosstodon.org&lt;/a&gt;&lt;/p&gt;
  770.  &lt;/li&gt;
  771.  &lt;li&gt;
  772.    &lt;p&gt;Mailing list: &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general&quot;&gt;&lt;code&gt;rb-general@lists.reproducible-builds.org&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;
  773.  &lt;/li&gt;
  774. &lt;/ul&gt;
  775. </description>
  776.      </item>
  777.    
  778.      <item>
  779.        <title>Reproducible Builds in January 2023</title>
  780.        <pubDate>Mon, 06 Feb 2023 00:37:36 +0000</pubDate>
  781.        <link>https://reproducible-builds.org/reports/2023-01/</link>
  782.        <guid isPermaLink="true">https://reproducible-builds.org/reports/2023-01/</guid>
  783.        <description>&lt;p class=&quot;lead&quot;&gt;&lt;strong&gt;Welcome to the first report for 2023 from the &lt;a href=&quot;https://reproducible-builds.org&quot;&gt;Reproducible Builds&lt;/a&gt; project!&lt;/strong&gt;&lt;/p&gt;
  784.  
  785. &lt;p&gt;&lt;a href=&quot;https://reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-01/reproducible-builds.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  786.  
  787. &lt;p&gt;In these reports we try and outline the most important things that we have been up to over the past month, as well as the most important things in/around the community. As a quick recap, the motivation behind the reproducible builds effort is to ensure no malicious flaws can be deliberately introduced during compilation and distribution of the software that we run on our devices. As ever, if you are interested in contributing to the project, please visit our &lt;a href=&quot;/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page on our website.&lt;/p&gt;
  788.  
  789. &lt;hr /&gt;
  790.  
  791. &lt;h2 id=&quot;news&quot;&gt;News&lt;/h2&gt;
  792.  
  793. &lt;p&gt;&lt;a href=&quot;https://github.blog/changelog/2023-01-30-git-archive-checksums-may-change/&quot;&gt;&lt;img src=&quot;/images/reports/2023-01/github.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  794.  
  795. &lt;p&gt;In a curious turn of events, GitHub first announced this month that the checksums of various Git archives may be subject to change, specifically that because:&lt;/p&gt;
  796.  
  797. &lt;blockquote&gt;
  798.  &lt;p&gt;… the default compression for Git archives has recently changed. As result, archives downloaded from GitHub may have different checksums even though the contents are completely unchanged.&lt;/p&gt;
  799. &lt;/blockquote&gt;
  800.  
  801. &lt;p&gt;This change (which &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-October/002709.html&quot;&gt;was brought up on our mailing list&lt;/a&gt; last October) would have had quite wide-ranging implications for anyone wishing to validate and verify downloaded archives using cryptographic signatures. However, GitHub reversed this decision, updating their &lt;a href=&quot;https://github.blog/changelog/2023-01-30-git-archive-checksums-may-change/&quot;&gt;original announcement&lt;/a&gt; with a message that “We are reverting this change for now. More details to follow.” It appears that this was informed in part by an &lt;a href=&quot;https://github.com/orgs/community/discussions/45830&quot;&gt;in-depth discussion in the GitHub Community issue tracker&lt;/a&gt;.&lt;/p&gt;
  802.  
  803. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  804.  
  805. &lt;p&gt;&lt;a href=&quot;https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2022.pdf?__blob=publicationFile&amp;amp;v=6&quot;&gt;&lt;img src=&quot;/images/reports/2023-01/bsi.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  806.  
  807. &lt;p&gt;The &lt;em&gt;Bundesamt für Sicherheit in der Informationstechnik&lt;/em&gt; (BSI) (trans: ‘The Federal Office for Information Security’) is the agency in charge of managing computer and communication security for the German federal government. They recently produced a report that touches on attacks on software supply-chains (&lt;em&gt;Supply-Chain-Angriff&lt;/em&gt;). (&lt;a href=&quot;https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Lageberichte/Lagebericht2022.pdf?__blob=publicationFile&amp;amp;v=6&quot;&gt;German PDF&lt;/a&gt;)&lt;/p&gt;
  808.  
  809. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  810.  
  811. &lt;p&gt;&lt;a href=&quot;https://reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-01/reproducible-builds.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  812.  
  813. &lt;p&gt;Contributor &lt;em&gt;Seb35&lt;/em&gt; updated &lt;a href=&quot;/&quot;&gt;our website&lt;/a&gt; to fix broken links to &lt;a href=&quot;https://tails.boum.org/&quot;&gt;Tails&lt;/a&gt;’ Git repository [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/7f98d24b&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/f3ae46cc&quot;&gt;…&lt;/a&gt;], and Holger updated a large number of pages around our &lt;a href=&quot;/events/venice2022/&quot;&gt;recent summit in Venice&lt;/a&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/80e4e5b9&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/af639729&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/78a0a627&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/385c83e9&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  814.  
  815. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  816.  
  817. &lt;p&gt;&lt;a href=&quot;https://www.cesarsotovalero.net/files/publications/The_State_Of_Software_Diversity_In_The_Software_Supply_Chain.pdf&quot;&gt;&lt;img src=&quot;/images/reports/2023-01/jonsson-paper.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  818.  
  819. &lt;p&gt;Noak Jönsson has written an interesting paper entitled &lt;a href=&quot;https://www.cesarsotovalero.net/files/publications/The_State_Of_Software_Diversity_In_The_Software_Supply_Chain.pdf&quot;&gt;&lt;em&gt;The State of Software Diversity in the Software Supply Chain of Ethereum Clients&lt;/em&gt;&lt;/a&gt;. As the paper outlines:&lt;/p&gt;
  820.  
  821. &lt;blockquote&gt;
  822.  &lt;p&gt;In this report, the software supply chains of the most popular Ethereum clients are cataloged and analyzed. The dependency graphs of Ethereum clients developed in Go, Rust, and Java, are studied. These client are Geth, Prysm, OpenEthereum, Lighthouse, Besu, and Teku. To do so, their dependency graphs are transformed into a unified format. Quantitative metrics are used to depict the software supply chain of the blockchain. The results show a clear difference in the size of the software supply chain required for the execution layer and consensus layer of Ethereum.&lt;/p&gt;
  823. &lt;/blockquote&gt;
  824.  
  825. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  826.  
  827. &lt;p&gt;Yongkui Han posted to &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/&quot;&gt;our mailing list&lt;/a&gt; discussing &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-January/002813.html&quot;&gt;making reproducible builds &amp;amp; GitBOM work together without gitBOM-ID embedding&lt;/a&gt;. GitBOM (now renamed to &lt;a href=&quot;https://omnibor.io/&quot;&gt;OmniBOR&lt;/a&gt;) is a project to “enable automatic, verifiable artifact resolution across today’s diverse software supply-chains” [&lt;a href=&quot;https://omnibor.io/&quot;&gt;…&lt;/a&gt;]. In addition, Fabian Keil wrote to us asking whether &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-January/002811.html&quot;&gt;anyone in the community would be at Chemnitz Linux Days 2023&lt;/a&gt;, which is due to take place on 11th and 12th March (&lt;a href=&quot;https://chemnitzer.linux-tage.de/2023/en&quot;&gt;event info&lt;/a&gt;).&lt;/p&gt;
  828.  
  829. &lt;p&gt;&lt;a href=&quot;https://fosdem.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-01/fosdem.jpeg#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  830.  
  831. &lt;p&gt;Separate to this, Akihiro Suda posted to our mailing list just after the end of the month with a &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-February/002842.html&quot;&gt;status report of bit-for-bit reproducible Docker/OCI images&lt;/a&gt;. As Akihiro mentions in their post, they will be giving a talk at &lt;a href=&quot;https://fosdem.org/&quot;&gt;FOSDEM&lt;/a&gt; in the &lt;a href=&quot;https://fosdem.org/2023/schedule/track/containers/&quot;&gt;‘Containers’ devroom&lt;/a&gt; titled &lt;a href=&quot;https://fosdem.org/2023/schedule/event/container_reproducible_dockerfile/&quot;&gt;&lt;em&gt;Bit-for-bit reproducible builds with &lt;code&gt;Dockerfile&lt;/code&gt;&lt;/em&gt;&lt;/a&gt; and that “my talk will also mention how to pin the apt/dnf/apk/pacman packages with my &lt;a href=&quot;https://github.com/reproducible-containers/repro-get&quot;&gt;&lt;code&gt;repro-get&lt;/code&gt;&lt;/a&gt; tool.”&lt;/p&gt;
  832.  
  833. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  834.  
  835. &lt;p&gt;&lt;a href=&quot;https://signal.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-01/signal.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  836.  
  837. &lt;p&gt;The extremely popular &lt;a href=&quot;https://signal.org/&quot;&gt;Signal messenger app&lt;/a&gt; added upstream support for the &lt;a href=&quot;/docs/source-date-epoch/&quot;&gt;&lt;code&gt;SOURCE_DATE_EPOCH&lt;/code&gt;&lt;/a&gt; environment variable this month. This means that release tarballs of the Signal desktop client do not embed nondeterministic release information. [&lt;a href=&quot;https://github.com/signalapp/Signal-Desktop/pull/5753&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://github.com/signalapp/Signal-Desktop/pull/6212&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  838.  
  839. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  840.  
  841. &lt;hr /&gt;
  842.  
  843. &lt;h2 id=&quot;distribution-work&quot;&gt;Distribution work&lt;/h2&gt;
  844.  
  845. &lt;h3 id=&quot;f-droid--android&quot;&gt;F-Droid &amp;amp; Android&lt;/h3&gt;
  846.  
  847. &lt;p&gt;&lt;a href=&quot;https://f-droid.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-01/fdroid.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  848.  
  849. &lt;p&gt;There was a very large number of changes in the &lt;a href=&quot;https://f-droid.org/&quot;&gt;F-Droid&lt;/a&gt; and wider Android ecosystem this month:&lt;/p&gt;
  850.  
  851. &lt;p&gt;On January 15th, a blog post entitled &lt;a href=&quot;https://f-droid.org/en/2023/01/15/towards-a-reproducible-fdroid.html&quot;&gt;&lt;em&gt;Towards a reproducible F-Droid&lt;/em&gt;&lt;/a&gt; was published on the &lt;a href=&quot;https://f-droid.org/&quot;&gt;F-Droid website&lt;/a&gt;, outlining the reasons why “F-Droid signs published APKs with its own keys” and how reproducible builds allow using upstream developers’ keys instead. In particular:&lt;/p&gt;
  852.  
  853. &lt;blockquote&gt;
  854.  &lt;p&gt;In response to […] criticisms, we started &lt;a href=&quot;https://gitlab.com/fdroid/fdroiddata/-/issues/2816&quot;&gt;encouraging new apps to enable reproducible builds&lt;/a&gt;. It turns out that reproducible builds are not so difficult to achieve for many apps. &lt;a href=&quot;https://gitlab.com/fdroid/fdroiddata/-/issues/2844&quot;&gt;In the past few months we’ve gotten many more reproducible apps in F-Droid than before&lt;/a&gt;. Currently we can’t highlight which apps are reproducible in the client, so maybe you haven’t noticed that there are many new apps signed with upstream developers’ keys.&lt;/p&gt;
  855. &lt;/blockquote&gt;
  856.  
  857. &lt;p&gt;(There was a &lt;a href=&quot;https://news.ycombinator.com/item?id=34457143&quot;&gt;discussion about this post&lt;/a&gt; on &lt;a href=&quot;https://news.ycombinator.com/&quot;&gt;Hacker News&lt;/a&gt;.)&lt;/p&gt;
  858.  
  859. &lt;p&gt;In addition:&lt;/p&gt;
  860.  
  861. &lt;ul&gt;
  862.  &lt;li&gt;
  863.    &lt;p&gt;F-Droid added 13 apps published with reproducible builds this month. [&lt;a href=&quot;https://gitlab.com/fdroid/fdroiddata/-/issues/2844&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  864.  &lt;/li&gt;
  865.  &lt;li&gt;
  866.    &lt;p&gt;FC Stegerman outlined a bug where &lt;a href=&quot;https://gist.github.com/obfusk/61046e09cee352ae6dd109911534b12e&quot;&gt;&lt;code&gt;baseline.profm&lt;/code&gt; files are nondeterministic&lt;/a&gt;, developed a workaround, and provided all the details required for a fix. As they note, this issue &lt;a href=&quot;https://android.googlesource.com/platform/tools/base/+/2f2c6b30b55e18e2672edf5ee8e8e583be759d3e&quot;&gt;has now been fixed&lt;/a&gt; but the fix is not yet part of an official &lt;a href=&quot;https://developer.android.com/studio/releases/gradle-plugin&quot;&gt;Android Gradle plugin release&lt;/a&gt;.&lt;/p&gt;
  867.  &lt;/li&gt;
  868.  &lt;li&gt;
  869.    &lt;p&gt;GitLab user &lt;a href=&quot;https://gitlab.com/Parwor&quot;&gt;&lt;em&gt;Parwor&lt;/em&gt;&lt;/a&gt; discovered that the number of CPU cores can affect the reproducibility of &lt;code&gt;.dex&lt;/code&gt; files. [&lt;a href=&quot;https://gitlab.com/fdroid/rfp/-/issues/1519#note_1226216164&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  870.  &lt;/li&gt;
  871.  &lt;li&gt;
  872.    &lt;p&gt;FC Stegerman also announced the &lt;code&gt;0.2.0&lt;/code&gt; and &lt;code&gt;0.2.1&lt;/code&gt; releases of &lt;a href=&quot;https://github.com/obfusk/reproducible-apk-tools&quot;&gt;&lt;em&gt;reproducible-apk-tools&lt;/em&gt;&lt;/a&gt;, a suite of tools to help make &lt;code&gt;.apk&lt;/code&gt; files reproducible. Several new subcommands and scripts were added, and a number of bugs were fixed as well [&lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-January/002815.html&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-January/002816.html&quot;&gt;…&lt;/a&gt;]. They also updated the &lt;a href=&quot;https://f-droid.org/&quot;&gt;F-Droid website&lt;/a&gt; to improve the reproducibility-related documentation. [&lt;a href=&quot;https://gitlab.com/fdroid/fdroid-website/-/merge_requests/895/diffs&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://gitlab.com/fdroid/fdroid-website/-/merge_requests/901/diffs&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  873.  &lt;/li&gt;
  874.  &lt;li&gt;
  875.    &lt;p&gt;On the F-Droid issue tracker, FC Stegerman &lt;a href=&quot;https://gitlab.com/fdroid/fdroiddata/-/merge_requests/12145#note_1231715091&quot;&gt;discussed reproducible builds&lt;/a&gt; with one of the developers of the &lt;a href=&quot;https://threema.ch/&quot;&gt;Threema messenger app&lt;/a&gt; and reported that Android SDK &lt;em&gt;build-tools&lt;/em&gt; &lt;code&gt;31.0.0&lt;/code&gt; and &lt;code&gt;32.0.0&lt;/code&gt; (unlike earlier and later versions) have a &lt;a href=&quot;https://gitlab.com/fdroid/fdroiddata/-/issues/2816#note_1249683547&quot;&gt;&lt;code&gt;zipalign&lt;/code&gt; command that produces incorrect padding&lt;/a&gt;.&lt;/p&gt;
  876.  &lt;/li&gt;
  877.  &lt;li&gt;
  878.    &lt;p&gt;A number of bugs related to reproducibility were discovered in Android itself. Firstly, the non-deterministic order of &lt;code&gt;.zip&lt;/code&gt; entries in &lt;code&gt;.apk&lt;/code&gt; files [&lt;a href=&quot;https://issuetracker.google.com/issues/265653160&quot;&gt;…&lt;/a&gt;] and then newline differences between building on Windows versus Linux that can make builds not reproducible as well. [&lt;a href=&quot;https://issuetracker.google.com/issues/266109851&quot;&gt;…&lt;/a&gt;] (Note that these links may require a Google account to view.)&lt;/p&gt;
  879.  &lt;/li&gt;
  880.  &lt;li&gt;
  881.    &lt;p&gt;And just before the end of the month, FC Stegerman started a thread on &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general&quot;&gt;our mailing list&lt;/a&gt; on the topic of &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-January/002825.html&quot;&gt;hiding data/code in APK embedded signatures&lt;/a&gt; which has been made possible by the &lt;a href=&quot;https://source.android.com/docs/security/features/apksigning&quot;&gt;Android APK Signature Scheme v2/v3&lt;/a&gt;. As part of this, they made an Android app that reads the APK Signing block of its own APK and extracts a payload in order to alter its behaviour called &lt;a href=&quot;https://github.com/obfusk/sigblock-code-poc&quot;&gt;&lt;em&gt;sigblock-code-poc&lt;/em&gt;&lt;/a&gt;.&lt;/p&gt;
  882.  &lt;/li&gt;
  883. &lt;/ul&gt;
  884.  
  885. &lt;h3 id=&quot;debian&quot;&gt;Debian&lt;/h3&gt;
  886.  
  887. &lt;p&gt;&lt;a href=&quot;https://debian.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-01/debian.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  888.  
  889. &lt;p&gt;As mentioned in &lt;a href=&quot;/reports/2022-12/&quot;&gt;last month’s report&lt;/a&gt;, Vagrant Cascadian has been organising a series of online sprints in order to ‘clear the huge backlog of reproducible builds patches submitted’ by performing NMUs (&lt;a href=&quot;https://wiki.debian.org/NonMaintainerUpload&quot;&gt;Non-Maintainer Uploads&lt;/a&gt;). During January, a sprint took place on the 10th, resulting in the following uploads:&lt;/p&gt;
  890.  
  891. &lt;ul&gt;
  892.  &lt;li&gt;
  893.    &lt;p&gt;Chris Lamb:&lt;/p&gt;
  894.  
  895.    &lt;ul&gt;
  896.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/critcl&quot;&gt;&lt;code&gt;critcl&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/963600&quot;&gt;#963600&lt;/a&gt;)&lt;/li&gt;
  897.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/log4cpp&quot;&gt;&lt;code&gt;log4cpp&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/1020662&quot;&gt;#1020662&lt;/a&gt;)&lt;/li&gt;
  898.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/logapp&quot;&gt;&lt;code&gt;logapp&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/1010845&quot;&gt;#1010845&lt;/a&gt;)&lt;/li&gt;
  899.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/nanomsg&quot;&gt;&lt;code&gt;nanomsg&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/1001853&quot;&gt;#1001853&lt;/a&gt;)&lt;/li&gt;
  900.    &lt;/ul&gt;
  901.  &lt;/li&gt;
  902.  &lt;li&gt;
  903.    &lt;p&gt;Holger Levsen:&lt;/p&gt;
  904.  
  905.    &lt;ul&gt;
  906.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/netkit-rsh&quot;&gt;&lt;code&gt;netkit-rsh&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/1020798&quot;&gt;#1020798&lt;/a&gt;)&lt;/li&gt;
  907.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/wcwidth&quot;&gt;&lt;code&gt;wcwidth&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/1005408&quot;&gt;#1005408&lt;/a&gt;)&lt;/li&gt;
  908.    &lt;/ul&gt;
  909.  &lt;/li&gt;
  910.  &lt;li&gt;
  911.    &lt;p&gt;Vagrant Cascadian:&lt;/p&gt;
  912.  
  913.    &lt;ul&gt;
  914.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/mc&quot;&gt;&lt;code&gt;mc&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/828683&quot;&gt;#828683&lt;/a&gt;)&lt;/li&gt;
  915.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/gtk-sharp3&quot;&gt;&lt;code&gt;gtk-sharp3&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/989965&quot;&gt;#989965&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/989966&quot;&gt;#989966&lt;/a&gt;)&lt;/li&gt;
  916.    &lt;/ul&gt;
  917.  &lt;/li&gt;
  918. &lt;/ul&gt;
  919.  
  920. &lt;p&gt;During this sprint, Holger Levsen filed Debian bug &lt;a href=&quot;https://bugs.debian.org/1028615&quot;&gt;#1028615&lt;/a&gt; to request that the &lt;a href=&quot;https://tracker.debian.org&quot;&gt;&lt;code&gt;tracker.debian.org&lt;/code&gt;&lt;/a&gt; service display results of reproducible rebuilds, not just reproducible ‘CI’ results.&lt;/p&gt;
  921.  
  922. &lt;p&gt;Elsewhere in Debian, &lt;a href=&quot;https://tracker.debian.org/pkg/strip-nondeterminism&quot;&gt;&lt;em&gt;strip-nondeterminism&lt;/em&gt;&lt;/a&gt; is our tool to remove specific non-deterministic results from a completed build. This month, version &lt;code&gt;1.13.1-1&lt;/code&gt; was &lt;a href=&quot;https://tracker.debian.org/news/1409573/accepted-strip-nondeterminism-1131-1-source-into-unstable/&quot;&gt;uploaded to Debian unstable&lt;/a&gt; by Holger Levsen, including a fix by FC Stegerman (&lt;em&gt;obfusk&lt;/em&gt;) to update a regular expression for the latest version of &lt;code&gt;file(1)&lt;/code&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/strip-nondeterminism/commit/f1017c6&quot;&gt;…&lt;/a&gt;]. (&lt;a href=&quot;https://bugs.debian.org/1028892&quot;&gt;#1028892&lt;/a&gt;)&lt;/p&gt;
  923.  
  924. &lt;p&gt;Lastly, 65 reviews of Debian packages were added, 21 were updated and 35 were removed this month adding to &lt;a href=&quot;https://tests.reproducible-builds.org/debian/index_issues.html&quot;&gt;our knowledge about identified issues&lt;/a&gt;.&lt;/p&gt;
  925.  
  926. &lt;h3 id=&quot;other-distributions&quot;&gt;Other distributions&lt;/h3&gt;
  927.  
  928. &lt;p&gt;In other distributions:&lt;/p&gt;
  929.  
  930. &lt;p&gt;&lt;a href=&quot;https://www.opensuse.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-01/opensuse.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  931.  
  932. &lt;ul&gt;
  933.  &lt;li&gt;
  934.    &lt;p&gt;Bernhard M. Wiedemann published another &lt;a href=&quot;https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/RQ3TMTIOU7HUX5TIP7IE7KT7ZWERWPXB/&quot;&gt;monthly report for reproducibility within openSUSE&lt;/a&gt;, as well as &lt;a href=&quot;https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/2DKRGC4EIBVUVP6RWHBCEL5SJKCTWRFM/&quot;&gt;a belated report for December 2022&lt;/a&gt;.&lt;/p&gt;
  935.  &lt;/li&gt;
  936.  &lt;li&gt;
  937.    &lt;p&gt;It was announced that &lt;a href=&quot;https://docs.fedoraproject.org/en-US/releases/rawhide/&quot;&gt;Fedora Rawhide&lt;/a&gt; now ‘clamps’  file modification types to &lt;a href=&quot;/docs/source-date-epoch/&quot;&gt;&lt;code&gt;SOURCE_DATE_EPOCH&lt;/code&gt;&lt;/a&gt;. [&lt;a href=&quot;https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/2BDU7CFZGEXUWBHJIZDB2QAOIR2R5TFN/&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  938.  &lt;/li&gt;
  939.  &lt;li&gt;
  940.    &lt;p&gt;Finally, an existing tool called &lt;a href=&quot;https://github.com/fepitre/rpmreproduce&quot;&gt;&lt;em&gt;rpmreproduce&lt;/em&gt;&lt;/a&gt; was (re-)discovered this month, which claims that “given a buildinfo file from a RPM package, [it can] generate instructions for attempting to reproduce the binary packages built from the associated source and build information.”&lt;/p&gt;
  941.  &lt;/li&gt;
  942. &lt;/ul&gt;
  943.  
  944. &lt;hr /&gt;
  945.  
  946. &lt;h2 id=&quot;diffoscope&quot;&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;diffoscope&lt;/a&gt;&lt;/h2&gt;
  947.  
  948. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;img src=&quot;/images/reports/2023-01/diffoscope.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  949.  
  950. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;em&gt;diffoscope&lt;/em&gt;&lt;/a&gt; is our in-depth and content-aware diff utility. Not only can it locate and diagnose reproducibility issues, it can provide human-readable diffs from many kinds of binary formats. This month, Chris Lamb made the following changes to &lt;a href=&quot;https://diffoscope.org&quot;&gt;diffoscope&lt;/a&gt;, including preparing and uploading versions &lt;code&gt;231&lt;/code&gt;, &lt;code&gt;232&lt;/code&gt;, &lt;code&gt;233&lt;/code&gt; and &lt;code&gt;234&lt;/code&gt; to Debian:&lt;/p&gt;
  951.  
  952. &lt;ul&gt;
  953.  &lt;li&gt;No need for &lt;code&gt;from __future__ import print_function&lt;/code&gt; import anymore. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/7a1dc409&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  954.  &lt;li&gt;Comment and tidy the &lt;code&gt;extras_require.json&lt;/code&gt; handling. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/7129af15&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  955.  &lt;li&gt;Split inline Python code to generate test &lt;code&gt;Recommends&lt;/code&gt; into a separate Python script. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/c341b63a&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  956.  &lt;li&gt;Update &lt;code&gt;debian/tests/control&lt;/code&gt; after merging support for &lt;a href=&quot;https://pypdf2.readthedocs.io/&quot;&gt;PyPDF&lt;/a&gt; support. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/2e317927&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  957.  &lt;li&gt;Correctly catch segfaulting &lt;code&gt;cd-iccdump&lt;/code&gt; binary. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/2d95ae41&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  958.  &lt;li&gt;Drop some old debugging code. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/fca2293a&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  959.  &lt;li&gt;Allow ICC tests to (temporarily) fail. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/dff253b5&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  960. &lt;/ul&gt;
  961.  
  962. &lt;p&gt;In addition, FC Stegerman (&lt;em&gt;obfusk&lt;/em&gt;) made a number of changes, including:&lt;/p&gt;
  963.  
  964. &lt;ul&gt;
  965.  &lt;li&gt;Updating the &lt;code&gt;test_text_proper_indentation&lt;/code&gt; test to support the latest version(s) of &lt;a href=&quot;https://en.wikipedia.org/wiki/File_(command)&quot;&gt;&lt;code&gt;file(1)&lt;/code&gt;&lt;/a&gt;. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/329&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  966.  &lt;li&gt;Use an &lt;code&gt;extras_require.json&lt;/code&gt; file to store some build/release metadata, instead of accessing the internet. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/325&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  967.  &lt;li&gt;Updating an APK-related &lt;a href=&quot;https://en.wikipedia.org/wiki/File_(command)&quot;&gt;&lt;code&gt;file(1)&lt;/code&gt;&lt;/a&gt; regular expression. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/72f8f33d&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  968.  &lt;li&gt;On the &lt;a href=&quot;https://diffoscope.org/&quot;&gt;&lt;em&gt;diffoscope.org&lt;/em&gt; website&lt;/a&gt;, de-duplicate contributors by e-mail. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope-website/commit/1ebaa67&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  969. &lt;/ul&gt;
  970.  
  971. &lt;p&gt;Lastly, Sam James added support for &lt;a href=&quot;https://pypi.org/project/pypdf/&quot;&gt;PyPDF&lt;/a&gt; version 3 [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/6aed2e53&quot;&gt;…&lt;/a&gt;] and Vagrant Cascadian updated a handful of tool references for &lt;a href=&quot;https://guix.gnu.org/&quot;&gt;GNU Guix&lt;/a&gt;. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/a0b80552&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/a10a169c&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  972.  
  973. &lt;hr /&gt;
  974.  
  975. &lt;h3 id=&quot;upstream-patches&quot;&gt;Upstream patches&lt;/h3&gt;
  976.  
  977. &lt;p&gt;The Reproducible Builds project attempts to fix as many currently-unreproducible packages as possible. This month, we wrote a large number of such patches, including:&lt;/p&gt;
  978.  
  979. &lt;ul&gt;
  980.  &lt;li&gt;
  981.    &lt;p&gt;Bernhard M. Wiedemann:&lt;/p&gt;
  982.  
  983.    &lt;ul&gt;
  984.      &lt;li&gt;&lt;a href=&quot;https://github.com/praiskup/argparse-manpage/pull/76&quot;&gt;&lt;code&gt;argparse&lt;/code&gt;&lt;/a&gt; (date-related issue)&lt;/li&gt;
  985.      &lt;li&gt;&lt;a href=&quot;https://github.com/peterbrittain/asciimatics/pull/365&quot;&gt;&lt;code&gt;asciimatics&lt;/code&gt;&lt;/a&gt; (build failure)&lt;/li&gt;
  986.      &lt;li&gt;&lt;a href=&quot;https://github.com/MagicStack/asyncpg/issues/997&quot;&gt;&lt;code&gt;asyncpg&lt;/code&gt;&lt;/a&gt; (fails to build in 2032)&lt;/li&gt;
  987.      &lt;li&gt;&lt;a href=&quot;https://github.com/python/cpython/issues/101069&quot;&gt;&lt;code&gt;cpython&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  988.      &lt;li&gt;&lt;a href=&quot;https://github.com/django/django/pull/16459&quot;&gt;&lt;code&gt;django&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  989.      &lt;li&gt;&lt;a href=&quot;https://github.com/GrandOrgue/grandorgue/pull/1358&quot;&gt;&lt;code&gt;grandorgue&lt;/code&gt;&lt;/a&gt; (&lt;code&gt;.zip&lt;/code&gt;-related issue)&lt;/li&gt;
  990.      &lt;li&gt;&lt;a href=&quot;https://github.com/libarchive/libarchive/pull/1836&quot;&gt;&lt;code&gt;libarchive&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  991.      &lt;li&gt;&lt;a href=&quot;https://github.com/libarchive/libarchive/pull/1838&quot;&gt;&lt;code&gt;libarchive&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  992.      &lt;li&gt;&lt;a href=&quot;https://github.com/RusXMMS/librcc/pull/5&quot;&gt;&lt;code&gt;librcc&lt;/code&gt;&lt;/a&gt; (date)&lt;/li&gt;
  993.      &lt;li&gt;&lt;a href=&quot;https://github.com/Mbed-TLS/mbedtls/issues/6978&quot;&gt;&lt;code&gt;mbedtls&lt;/code&gt;&lt;/a&gt; (fails to build in 2023)&lt;/li&gt;
  994.      &lt;li&gt;&lt;a href=&quot;https://bugzilla.mozilla.org/show_bug.cgi?id=1813401&quot;&gt;&lt;code&gt;mozilla-nss&lt;/code&gt;&lt;/a&gt; (fails to build in 2023)&lt;/li&gt;
  995.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1061850&quot;&gt;&lt;code&gt;ocaml-rpm-macros&lt;/code&gt;&lt;/a&gt; (fix fallout from an RPM-related change)&lt;/li&gt;
  996.      &lt;li&gt;&lt;a href=&quot;https://github.com/libwww-perl/HTTP-Cookies/pull/72&quot;&gt;&lt;code&gt;perl HTTP::Cookies&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  997.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1058352&quot;&gt;&lt;code&gt;python-aiosmtplib/python-trustme&lt;/code&gt;&lt;/a&gt; (fails to build in 2038 due to SSL certificate)&lt;/li&gt;
  998.      &lt;li&gt;&lt;a href=&quot;https://github.com/intel/bmap-tools/issues/116&quot;&gt;&lt;code&gt;python-bmap&lt;/code&gt;&lt;/a&gt; (fails to build in 2024)&lt;/li&gt;
  999.      &lt;li&gt;&lt;a href=&quot;https://github.com/fedora-python/compileall2/pull/26&quot;&gt;&lt;code&gt;python-compileall2&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  1000.      &lt;li&gt;&lt;a href=&quot;https://github.com/GothenburgBitFactory/taskwarrior/issues/3050&quot;&gt;&lt;code&gt;taskwarrior&lt;/code&gt;&lt;/a&gt; (&lt;code&gt;python-tasklib&lt;/code&gt; fails to build in 2038)&lt;/li&gt;
  1001.      &lt;li&gt;&lt;a href=&quot;https://github.com/GothenburgBitFactory/taskwarrior/pull/3052&quot;&gt;&lt;code&gt;taskwarrior&lt;/code&gt;&lt;/a&gt; (fix fails to build in 2038)&lt;/li&gt;
  1002.      &lt;li&gt;&lt;a href=&quot;https://github.com/wg/wrk/issues/507&quot;&gt;&lt;code&gt;wrk&lt;/code&gt;&lt;/a&gt; (hash ordering issue)&lt;/li&gt;
  1003.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1058331&quot;&gt;&lt;code&gt;xemacs&lt;/code&gt;&lt;/a&gt; (fails to build in 2038 stuck)&lt;/li&gt;
  1004.    &lt;/ul&gt;
  1005.  &lt;/li&gt;
  1006.  &lt;li&gt;
  1007.    &lt;p&gt;Chris Lamb:&lt;/p&gt;
  1008.  
  1009.    &lt;ul&gt;
  1010.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1027988&quot;&gt;#1027988&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/click&quot;&gt;&lt;code&gt;click&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1011.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1027992&quot;&gt;#1027992&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/towncrier&quot;&gt;&lt;code&gt;towncrier&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1012.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1028051&quot;&gt;#1028051&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/unifrac-tools&quot;&gt;&lt;code&gt;unifrac-tools&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1013.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1028310&quot;&gt;#1028310&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/hamster-time-tracker&quot;&gt;&lt;code&gt;hamster-time-tracker&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1014.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1028515&quot;&gt;#1028515&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/accel-config&quot;&gt;&lt;code&gt;accel-config&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1015.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1029295&quot;&gt;#1029295&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/python-miio&quot;&gt;&lt;code&gt;python-miio&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1016.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1029297&quot;&gt;#1029297&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/python-graphviz&quot;&gt;&lt;code&gt;python-graphviz&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1017.    &lt;/ul&gt;
  1018.  &lt;/li&gt;
  1019.  &lt;li&gt;
  1020.    &lt;p&gt;Vagrant Cascadian:&lt;/p&gt;
  1021.  
  1022.    &lt;ul&gt;
  1023.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1029227&quot;&gt;#1029227&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/ectrans&quot;&gt;&lt;code&gt;ectrans&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1024.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1029303&quot;&gt;#1029303&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/fiat-ecmwf&quot;&gt;&lt;code&gt;fiat-ecmwf&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1025.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1029307&quot;&gt;#1029307&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/node-katex&quot;&gt;&lt;code&gt;node-katex&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1026.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1029800&quot;&gt;#1029800&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/aribas&quot;&gt;&lt;code&gt;aribas&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1027.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1029801&quot;&gt;#1029801&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/tbox&quot;&gt;&lt;code&gt;tbox&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1028.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1029807&quot;&gt;#1029807&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/borgbackup2&quot;&gt;&lt;code&gt;borgbackup2&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1029.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1029809&quot;&gt;#1029809&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/dnf-plugins-core&quot;&gt;&lt;code&gt;dnf-plugins-core&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1030.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1030057&quot;&gt;#1030057&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/refpolicy&quot;&gt;&lt;code&gt;refpolicy&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1031.    &lt;/ul&gt;
  1032.  &lt;/li&gt;
  1033.  &lt;li&gt;
  1034.    &lt;p&gt;FC Stegerman:&lt;/p&gt;
  1035.  
  1036.    &lt;ul&gt;
  1037.      &lt;li&gt;Several patches for &lt;a href=&quot;https://en.wikipedia.org/wiki/File_(command)&quot;&gt;&lt;code&gt;file(1)&lt;/code&gt;&lt;/a&gt; (which is used by reproducible builds tools like &lt;em&gt;diffoscope&lt;/em&gt; and &lt;em&gt;strip-nondeterminism&lt;/em&gt;) that improve detection of various file formats are now included in the Debian packaging. [&lt;a href=&quot;https://github.com/file/file/search?q=FC+Stegerman&amp;amp;type=commits&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1038.    &lt;/ul&gt;
  1039.  &lt;/li&gt;
  1040. &lt;/ul&gt;
  1041.  
  1042. &lt;hr /&gt;
  1043.  
  1044. &lt;h2 id=&quot;testing-framework&quot;&gt;Testing framework&lt;/h2&gt;
  1045.  
  1046. &lt;p&gt;&lt;a href=&quot;https://tests.reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2023-01/testframework.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1047.  
  1048. &lt;p&gt;The Reproducible Builds project operates a comprehensive testing framework at &lt;a href=&quot;https://tests.reproducible-builds.org&quot;&gt;tests.reproducible-builds.org&lt;/a&gt; in order to check packages and other artifacts for reproducibility. In January, the following changes were made by Holger Levsen:&lt;/p&gt;
  1049.  
  1050. &lt;ul&gt;
  1051.  &lt;li&gt;
  1052.    &lt;p&gt;Node changes:&lt;/p&gt;
  1053.  
  1054.    &lt;ul&gt;
  1055.      &lt;li&gt;Add three new nodes hosted at the &lt;a href=&quot;https://osuosl.org/&quot;&gt;Oregon State University Open Source Lab&lt;/a&gt; including integrating them into the DNS, maintenance and monitoring systems. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/48a18e51&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/26497180&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/e151cc7c&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/93115d67&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/840dc8da&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1056.    &lt;/ul&gt;
  1057.  &lt;/li&gt;
  1058.  &lt;li&gt;
  1059.    &lt;p&gt;Debian-related changes:&lt;/p&gt;
  1060.  
  1061.    &lt;ul&gt;
  1062.      &lt;li&gt;Only keep &lt;a href=&quot;https://diffoscope.org&quot;&gt;diffoscope&lt;/a&gt;’s HTML output (ie. no &lt;code&gt;.json&lt;/code&gt; or &lt;code&gt;.txt&lt;/code&gt;) for LTS suites and older in order to save diskspace on the Jenkins host. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/098742fb&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1063.      &lt;li&gt;Re-create &lt;code&gt;pbuilder&lt;/code&gt; base less frequently for the &lt;code&gt;stretch&lt;/code&gt;, &lt;code&gt;bookworm&lt;/code&gt; and &lt;code&gt;experimental&lt;/code&gt; suites. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/d2d7923c&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1064.    &lt;/ul&gt;
  1065.  &lt;/li&gt;
  1066.  &lt;li&gt;
  1067.    &lt;p&gt;OpenWrt-related changes:&lt;/p&gt;
  1068.  
  1069.    &lt;ul&gt;
  1070.      &lt;li&gt;Add gcc-multilib to &lt;code&gt;OPENWRT_HOST_PACKAGES&lt;/code&gt; and install it on the nodes that need it. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/7f88cba8&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1071.      &lt;li&gt;Detect more problems in the health check when failing to build OpenWrt. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/02ce1d17&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1072.    &lt;/ul&gt;
  1073.  &lt;/li&gt;
  1074.  &lt;li&gt;
  1075.    &lt;p&gt;Misc changes:&lt;/p&gt;
  1076.  
  1077.    &lt;ul&gt;
  1078.      &lt;li&gt;Update the &lt;code&gt;chroot-run&lt;/code&gt; script to correctly manage &lt;code&gt;/dev&lt;/code&gt; and &lt;code&gt;/dev/pts&lt;/code&gt;. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/0e49a9eb&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/a68ae0fd&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/f18ba089&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1079.      &lt;li&gt;Update the Jenkins ‘shell monitor’ script to collect disk stats less frequently [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/2ea61357&quot;&gt;…&lt;/a&gt;] and to include various directory stats. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/00400ad4&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/e5b31286&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1080.      &lt;li&gt;Update the ‘real’ year in the configuration in order to be able to detect whether a node is running in the future or not. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/3827ba7c&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1081.      &lt;li&gt;Bump copyright years in the default page footer. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/ff82ec5f&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1082.    &lt;/ul&gt;
  1083.  &lt;/li&gt;
  1084. &lt;/ul&gt;
  1085.  
  1086. &lt;p&gt;In addition, Christian Marangi submitted a patch to build OpenWrt packages with the &lt;code&gt;V=s&lt;/code&gt; flag to enable debugging. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/e8db59c3&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  1087.  
  1088. &lt;hr /&gt;
  1089.  
  1090. &lt;p&gt;If you are interested in contributing to the Reproducible Builds project, please visit the &lt;a href=&quot;https://reproducible-builds.org/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page on our website. You can get in touch with us via:&lt;/p&gt;
  1091.  
  1092. &lt;ul&gt;
  1093.  &lt;li&gt;
  1094.    &lt;p&gt;IRC: &lt;code&gt;#reproducible-builds&lt;/code&gt; on &lt;code&gt;irc.oftc.net&lt;/code&gt;.&lt;/p&gt;
  1095.  &lt;/li&gt;
  1096.  &lt;li&gt;
  1097.    &lt;p&gt;Twitter: &lt;a href=&quot;https://twitter.com/ReproBuilds&quot;&gt;@ReproBuilds&lt;/a&gt;&lt;/p&gt;
  1098.  &lt;/li&gt;
  1099.  &lt;li&gt;
  1100.    &lt;p&gt;Mastodon: &lt;a href=&quot;https://fosstodon.org/@reproducible_builds&quot;&gt;@reproducible_builds@fosstodon.org&lt;/a&gt;&lt;/p&gt;
  1101.  &lt;/li&gt;
  1102.  &lt;li&gt;
  1103.    &lt;p&gt;Mailing list: &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general&quot;&gt;&lt;code&gt;rb-general@lists.reproducible-builds.org&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;
  1104.  &lt;/li&gt;
  1105. &lt;/ul&gt;
  1106. </description>
  1107.      </item>
  1108.    
  1109.      <item>
  1110.        <title>Reproducible Builds in December 2022</title>
  1111.        <pubDate>Sat, 07 Jan 2023 15:22:28 +0000</pubDate>
  1112.        <link>https://reproducible-builds.org/reports/2022-12/</link>
  1113.        <guid isPermaLink="true">https://reproducible-builds.org/reports/2022-12/</guid>
  1114.        <description>&lt;p&gt;&lt;a href=&quot;https://reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-12/reproducible-builds.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1115.  
  1116. &lt;p&gt;&lt;strong&gt;Welcome to the December 2022 report from the &lt;a href=&quot;https://reproducible-builds.org&quot;&gt;Reproducible Builds&lt;/a&gt; project.&lt;/strong&gt;&lt;/p&gt;
  1117.  
  1118. &lt;hr /&gt;
  1119.  
  1120. &lt;p&gt;&lt;a href=&quot;/events/hamburg2023/&quot;&gt;&lt;img src=&quot;/images/reports/2022-12/summit_photo.jpg#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1121.  
  1122. &lt;p&gt;We are extremely pleased to announce that the dates for the &lt;a href=&quot;/events/hamburg2023/&quot;&gt;Reproducible Builds Summit in 2023&lt;/a&gt; have been announced in 2022 already:&lt;/p&gt;
  1123.  
  1124. &lt;ul&gt;
  1125.  &lt;li&gt;When: October 31st, November 1st, November 2nd 2023.&lt;/li&gt;
  1126.  &lt;li&gt;Where: &lt;a href=&quot;https://dock-europe.net/&quot;&gt;&lt;em&gt;Dock Europe&lt;/em&gt;&lt;/a&gt;, Hamburg, Germany.&lt;/li&gt;
  1127. &lt;/ul&gt;
  1128.  
  1129. &lt;p&gt;We plan to spend three days continuing to the grow of the Reproducible Builds effort. As in previous events, the exact content of the meeting will be shaped by the participants. And, as mentioned in &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-December/002804.html&quot;&gt;Holger Levsen’s post to our mailing list&lt;/a&gt;, the dates have been booked and confirmed with the venue, so if you are considering attending, &lt;strong&gt;please reserve these dates&lt;/strong&gt; in your calendar today.&lt;/p&gt;
  1130.  
  1131. &lt;hr /&gt;
  1132.  
  1133. &lt;p&gt;&lt;a href=&quot;https://remy.grunblatt.org/nix-and-nixos-my-pain-points.html&quot;&gt;&lt;img src=&quot;/images/reports/2022-12/nixos.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1134.  
  1135. &lt;p&gt;&lt;a href=&quot;https://remy.grunblatt.org/&quot;&gt;Rémy Grünblatt&lt;/a&gt;, an associate professor in the &lt;a href=&quot;https://telecom-sudparis.eu/&quot;&gt;Télécom Sud-Paris&lt;/a&gt; engineering school wrote up his &lt;a href=&quot;https://remy.grunblatt.org/nix-and-nixos-my-pain-points.html&quot;&gt;“pain points” of using Nix and NixOS&lt;/a&gt;. Although some of the points do not touch on reproducible builds, Rémy touches on problems he has encountered with the different kinds of reproducibility that these distributions appear to promise including configuration files affecting the behaviour of systems, the fragility of upstream sources as well as the conventional idea of binary reproducibility.&lt;/p&gt;
  1136.  
  1137. &lt;hr /&gt;
  1138.  
  1139. &lt;p&gt;&lt;a href=&quot;https://go.dev/&quot;&gt;&lt;img src=&quot;/images/reports/2022-12/golang.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1140.  
  1141. &lt;p&gt;Morten Linderud reported that he is quietly optimistic that if &lt;a href=&quot;https://go.dev&quot;&gt;Go programming language&lt;/a&gt; resolves all of its issues with reproducible builds (&lt;a href=&quot;https://github.com/golang/go/issues/57120&quot;&gt;tracking issue&lt;/a&gt;) then the Go binaries distributed from Google and by &lt;a href=&quot;https://archlinux.org/&quot;&gt;Arch Linux&lt;/a&gt; may be bit-for-bit identical. “It’s just a bit early to sorta figure out what roadblocks there are. [But] Go bootstraps itself every build, so in theory I think it should be possible.”&lt;/p&gt;
  1142.  
  1143. &lt;hr /&gt;
  1144.  
  1145. &lt;p&gt;&lt;a href=&quot;/news/2022/12/15/supporter-spotlight-davidawheeler-supply-chain-security/&amp;quot;&quot;&gt;&lt;img src=&quot;/images/reports/2022-12/dwheeler-2003c.jpg#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1146.  
  1147. &lt;p&gt;On December 15th, Holger Levsen published an &lt;a href=&quot;/news/2022/12/15/supporter-spotlight-davidawheeler-supply-chain-security/&quot;&gt;in-depth interview he performed with David A. Wheeler&lt;/a&gt; on supply-chain security and reproducible builds, but it also touches on the biggest challenges in computing as well.&lt;/p&gt;
  1148.  
  1149. &lt;p&gt;This is part of a larger series of posts featuring the projects, companies and individuals who support the Reproducible Builds project. Other instalments include an article &lt;a href=&quot;/news/2020/10/21/supporter-spotlight-cip-project/&quot;&gt;featuring the Civil Infrastructure Platform&lt;/a&gt; project and followed this up with a &lt;a href=&quot;/news/2021/04/06/supporter-spotlight-ford-foundation/&quot;&gt;post about the Ford Foundation&lt;/a&gt; as well as a recent ones about &lt;a href=&quot;/news/2022/04/14/supporter-spotlight-ardc/&quot;&gt;ARDC&lt;/a&gt;, the &lt;a href=&quot;/news/2022/04/26/supporter-spotlight-google-open-source-security-team/&quot;&gt;Google Open Source Security Team (GOSST)&lt;/a&gt;, &lt;a href=&quot;/news/2022/05/18/jan-nieuwenhuizen-on-bootrappable-builds-gnu-mes-and-gnu-guix/&quot;&gt;Jan Nieuwenhuizen on Bootstrappable Builds, GNU Mes and GNU Guix&lt;/a&gt; and &lt;a href=&quot;/news/2022/06/24/supporter-spotlight-hans-christoph-steiner-f-droid-project/&quot;&gt;Hans-Christoph Steiner of the F-Droid project&lt;/a&gt;.&lt;/p&gt;
  1150.  
  1151. &lt;hr /&gt;
  1152.  
  1153. &lt;p&gt;&lt;a href=&quot;/&quot;&gt;&lt;img src=&quot;/images/reports/2022-12/reproducible-builds.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1154.  
  1155. &lt;p&gt;A number of changes were made to the Reproducible Builds website and documentation this month, including FC Stegerman adding an F-Droid/apksigcopier example to our &lt;a href=&quot;/docs/embedded-signatures/&quot;&gt;embedded signatures&lt;/a&gt; page [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/34817389&quot;&gt;…&lt;/a&gt;], Holger Levsen making a large number of changes related to the 2022 summit in Venice as well as 2023’s summit in Hamburg [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/6ae3578d&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/41a1779c&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/0539562a&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/ba9a56a9&quot;&gt;…&lt;/a&gt;] and Simon Butler updated our &lt;a href=&quot;/docs/publications/&quot;&gt;publications page&lt;/a&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/6cc6f723&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/bbdda2b4&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  1156.  
  1157. &lt;hr /&gt;
  1158.  
  1159. &lt;p&gt;On &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general/&quot;&gt;our mailing list&lt;/a&gt; this month, James Addison asked a question about whether there has been any effort to trace the files used by a build system in order to identify the corresponding build-dependency packages. [&lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-December/002779.html&quot;&gt;…&lt;/a&gt;] In addition, Bernhard M. Wiedemann then posed a thought-provoking question asking “&lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-December/002782.html&quot;&gt;How to talk to skeptics?&lt;/a&gt;”, which was occasioned by a colleague who had &lt;a href=&quot;https://fy.blackhats.net.au/blog/html/2021/05/12/compiler_bootstrapping_can_we_trust_rust.html&quot;&gt;published a blog post in May 2021 skeptical of reproducible builds&lt;/a&gt;. The thread generated a number of replies.&lt;/p&gt;
  1160.  
  1161. &lt;hr /&gt;
  1162.  
  1163. &lt;h3 id=&quot;android-news&quot;&gt;Android news&lt;/h3&gt;
  1164.  
  1165. &lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Android_(operating_system)&quot;&gt;&lt;img src=&quot;/images/reports/2022-12/android.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1166.  
  1167. &lt;p&gt;&lt;em&gt;obfusk&lt;/em&gt; (FC Stegerman) &lt;a href=&quot;https://gist.github.com/obfusk/c51ebbf571e04ddf29e21146096675f8&quot;&gt;performed a thought-provoking review&lt;/a&gt; of tools designed to determine the difference between two different &lt;code&gt;.apk&lt;/code&gt; files shipped by a number of free-software instant messenger applications.&lt;/p&gt;
  1168.  
  1169. &lt;p&gt;These scripts are often necessary in the Android/APK ecosystem due to these files containing embedded signatures so the conventional bit-for-bit comparison cannot be used. After detailing a litany of issues with these tools, they come to the conclusion that:&lt;/p&gt;
  1170.  
  1171. &lt;blockquote&gt;
  1172.  &lt;p&gt;It’s quite possible these messengers actually have reproducible builds, but the verification scripts they use don’t actually allow us to verify whether they do.&lt;/p&gt;
  1173. &lt;/blockquote&gt;
  1174.  
  1175. &lt;p&gt;This reflects the consensus view within the Reproducible Builds project: pursuing a situation in language or package ecosystems where binaries are bit-for-bit identical (over requiring a bespoke ecosystem-specific tool) is not a luxury demanded by purist engineers, but rather the only &lt;em&gt;practical&lt;/em&gt; way to demonstrate reproducibility. &lt;em&gt;obfusk&lt;/em&gt; also &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-December/002769.html&quot;&gt;announced the first release of their own set of tools&lt;/a&gt; on our mailing list.&lt;/p&gt;
  1176.  
  1177. &lt;p&gt;Related to this, &lt;em&gt;obfusk&lt;/em&gt; also &lt;a href=&quot;https://github.com/mastodon/mastodon-android/issues/4#issuecomment-1336259343&quot;&gt;posted to an issue filed against Mastodon&lt;/a&gt; regarding the difficulties of creating bit-by-bit identical APKs, especially with respect to copying &lt;a href=&quot;https://source.android.com/docs/security/features/apksigning/v2&quot;&gt;v2/v3 APK signatures&lt;/a&gt; created by different tools; they also reported that some APK ordering differences were not caused by building on macOS after all, but by using &lt;a href=&quot;https://developer.android.com/studio&quot;&gt;Android Studio&lt;/a&gt; [&lt;a href=&quot;https://gitlab.com/fdroid/fdroiddata/-/issues/2816#note_1204147286&quot;&gt;…&lt;/a&gt;] and that F-Droid &lt;a href=&quot;https://gitlab.com/fdroid/fdroiddata/-/issues/2844&quot;&gt;added 16 more apps published with Reproducible Builds&lt;/a&gt; in December.&lt;/p&gt;
  1178.  
  1179. &lt;hr /&gt;
  1180.  
  1181. &lt;h3 id=&quot;debian&quot;&gt;Debian&lt;/h3&gt;
  1182.  
  1183. &lt;p&gt;&lt;a href=&quot;https://debian.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-12/debian.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1184.  
  1185. &lt;p&gt;As mentioned in &lt;a href=&quot;/reports/2022-11/&quot;&gt;last months report&lt;/a&gt;, Vagrant Cascadian has been organising a series of online sprints in order to ‘clear the huge backlog of reproducible builds patches submitted’ by performing NMUs (&lt;a href=&quot;https://wiki.debian.org/NonMaintainerUpload&quot;&gt;Non-Maintainer Uploads&lt;/a&gt;).&lt;/p&gt;
  1186.  
  1187. &lt;p&gt;During December, meetings were held on the 1st, 8th, 15th, 22nd and 29th, resulting in a large number of uploads and bugs being addressed:&lt;/p&gt;
  1188.  
  1189. &lt;ul&gt;
  1190.  &lt;li&gt;
  1191.    &lt;p&gt;Chris Lamb: &lt;a href=&quot;https://tracker.debian.org/pkg/aespipe&quot;&gt;&lt;code&gt;aespipe&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/661079&quot;&gt;#661079&lt;/a&gt;, &lt;a href=&quot;https://bugs.debian.org/1020809&quot;&gt;#1020809&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/cdbackup&quot;&gt;&lt;code&gt;cdbackup&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/1011428&quot;&gt;#1011428&lt;/a&gt;) &amp;amp; &lt;a href=&quot;https://tracker.debian.org/pkg/xmlrpc-epi&quot;&gt;&lt;code&gt;xmlrpc-epi&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/865688&quot;&gt;#865688&lt;/a&gt;, &lt;a href=&quot;https://bugs.debian.org/1020651&quot;&gt;#1020651&lt;/a&gt;)&lt;/p&gt;
  1192.  &lt;/li&gt;
  1193.  &lt;li&gt;
  1194.    &lt;p&gt;Holger Levsen: &lt;a href=&quot;https://tracker.debian.org/pkg/apr-util&quot;&gt;&lt;code&gt;apr-util&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/1006865&quot;&gt;#1006865&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/lirc&quot;&gt;&lt;code&gt;lirc&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/979024&quot;&gt;#979024&lt;/a&gt;) &amp;amp; &lt;a href=&quot;https://tracker.debian.org/pkg/ruby-omniauth-tumblr&quot;&gt;&lt;code&gt;ruby-omniauth-tumblr&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;
  1195.  &lt;/li&gt;
  1196.  &lt;li&gt;
  1197.    &lt;p&gt;Vagrant Cascadian: &lt;a href=&quot;https://tracker.debian.org/pkg/amavisd-milter&quot;&gt;&lt;code&gt;amavisd-milter&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/975954&quot;&gt;#975954&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/apophenia&quot;&gt;&lt;code&gt;apophenia&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/940013&quot;&gt;#940013&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/cfi&quot;&gt;&lt;code&gt;cfi&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/995647&quot;&gt;#995647&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/chessx&quot;&gt;&lt;code&gt;chessx&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/881664&quot;&gt;#881664&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/cmocka&quot;&gt;&lt;code&gt;cmocka&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/991181&quot;&gt;#991181&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/desmume&quot;&gt;&lt;code&gt;desmume&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/890312&quot;&gt;#890312&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/golang-gonum-v1-plot&quot;&gt;&lt;code&gt;golang-gonum-v1-plot&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/968045&quot;&gt;#968045&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/intel-gpu-tools&quot;&gt;&lt;code&gt;intel-gpu-tools&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/945105&quot;&gt;#945105&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/jhbuild&quot;&gt;&lt;code&gt;jhbuild&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/971420&quot;&gt;#971420&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/libjama&quot;&gt;&lt;code&gt;libjama&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/986601&quot;&gt;#986601&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/libjs-qunit&quot;&gt;&lt;code&gt;libjs-qunit&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/976445&quot;&gt;#976445&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/liblip&quot;&gt;&lt;code&gt;liblip&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/1001513&quot;&gt;#1001513&lt;/a&gt;, &lt;a href=&quot;https://bugs.debian.org/989583&quot;&gt;#989583&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/libstatgrab&quot;&gt;&lt;code&gt;libstatgrab&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/961747&quot;&gt;#961747&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/mlpost&quot;&gt;&lt;code&gt;mlpost&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/977179&quot;&gt;#977179&lt;/a&gt; and &lt;a href=&quot;https://bugs.debian.org/977180&quot;&gt;#977180&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/netcdf-parallel&quot;&gt;&lt;code&gt;netcdf-parallel&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/972930&quot;&gt;#972930&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/netgen-lvs&quot;&gt;&lt;code&gt;netgen-lvs&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/955783&quot;&gt;#955783&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/perfect-scrollbar&quot;&gt;&lt;code&gt;perfect-scrollbar&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/1000770&quot;&gt;#1000770&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/python-tomli&quot;&gt;&lt;code&gt;python-tomli&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/994979&quot;&gt;#994979&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/pytsk&quot;&gt;&lt;code&gt;pytsk&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/992060&quot;&gt;#992060&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/smplayer&quot;&gt;&lt;code&gt;smplayer&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/997689&quot;&gt;#997689&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/squeak-plugins-scratch&quot;&gt;&lt;code&gt;squeak-plugins-scratch&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/876771&quot;&gt;#876771&lt;/a&gt;, &lt;a href=&quot;https://bugs.debian.org/942006&quot;&gt;#942006&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/stgit&quot;&gt;&lt;code&gt;stgit&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/942009&quot;&gt;#942009&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/strace&quot;&gt;&lt;code&gt;strace&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/896016&quot;&gt;#896016&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/surgescript&quot;&gt;&lt;code&gt;surgescript&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/992061&quot;&gt;#992061&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/sympow&quot;&gt;&lt;code&gt;sympow&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/973601&quot;&gt;#973601&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/wxmaxima&quot;&gt;&lt;code&gt;wxmaxima&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/983148&quot;&gt;#983148&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/xavs2&quot;&gt;&lt;code&gt;xavs2&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/952493&quot;&gt;#952493&lt;/a&gt;), &lt;a href=&quot;https://tracker.debian.org/pkg/xaw3d&quot;&gt;&lt;code&gt;xaw3d&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/991180&quot;&gt;#991180&lt;/a&gt;, &lt;a href=&quot;https://bugs.debian.org/986704&quot;&gt;#986704&lt;/a&gt;) and &lt;a href=&quot;https://tracker.debian.org/pkg/yard&quot;&gt;&lt;code&gt;yard&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://bugs.debian.org/972668&quot;&gt;#972668&lt;/a&gt;).&lt;/p&gt;
  1198.  &lt;/li&gt;
  1199. &lt;/ul&gt;
  1200.  
  1201. &lt;p&gt;The next sprint is &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2023-January/002807.html&quot;&gt;due to take place this coming Tuesday, January 10th at 16:00 UTC&lt;/a&gt;.&lt;/p&gt;
  1202.  
  1203. &lt;hr /&gt;
  1204.  
  1205. &lt;h3 id=&quot;upstream-patches&quot;&gt;Upstream patches&lt;/h3&gt;
  1206.  
  1207. &lt;p&gt;The Reproducible Builds project attempts to fix as many currently-unreproducible packages as possible. This month, we wrote a large number of such patches, including:&lt;/p&gt;
  1208.  
  1209. &lt;ul&gt;
  1210.  &lt;li&gt;
  1211.    &lt;p&gt;Bernhard M. Wiedemann:&lt;/p&gt;
  1212.  
  1213.    &lt;ul&gt;
  1214.      &lt;li&gt;&lt;a href=&quot;https://gitlab.com/CalcProgrammer1/OpenRGB/-/merge_requests/1567&quot;&gt;&lt;code&gt;OpenRGB&lt;/code&gt;&lt;/a&gt; (filesystem ordering issue)&lt;/li&gt;
  1215.      &lt;li&gt;&lt;a href=&quot;https://bugzilla.opensuse.org/show_bug.cgi?id=1206342&quot;&gt;&lt;code&gt;python-maturin&lt;/code&gt;&lt;/a&gt; (report an issue regarding random numbers)&lt;/li&gt;
  1216.      &lt;li&gt;&lt;a href=&quot;https://github.com/xiph/rav1e/pull/3081&quot;&gt;&lt;code&gt;rav1e&lt;/code&gt;&lt;/a&gt; (datetime-related issue)&lt;/li&gt;
  1217.      &lt;li&gt;&lt;a href=&quot;https://github.com/WeblateOrg/weblate/issues/8556&quot;&gt;&lt;code&gt;weblate&lt;/code&gt;&lt;/a&gt; (report that the build fails in 2038)&lt;/li&gt;
  1218.    &lt;/ul&gt;
  1219.  &lt;/li&gt;
  1220.  &lt;li&gt;
  1221.    &lt;p&gt;Chris Lamb:&lt;/p&gt;
  1222.  
  1223.    &lt;ul&gt;
  1224.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1025415&quot;&gt;#1025415&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/cctools&quot;&gt;&lt;code&gt;cctools&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1225.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1025801&quot;&gt;#1025801&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/sphinx&quot;&gt;&lt;code&gt;sphinx&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://github.com/sphinx-doc/sphinx/pull/11037&quot;&gt;forwarded upstream&lt;/a&gt;)&lt;/li&gt;
  1226.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1026381&quot;&gt;#1026381&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/python-django-health-check&quot;&gt;&lt;code&gt;python-django-health-check&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1227.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1026876&quot;&gt;#1026876&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/jamin&quot;&gt;&lt;code&gt;jamin&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1228.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1026877&quot;&gt;#1026877&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/opari2&quot;&gt;&lt;code&gt;opari2&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1229.    &lt;/ul&gt;
  1230.  &lt;/li&gt;
  1231. &lt;/ul&gt;
  1232.  
  1233. &lt;hr /&gt;
  1234.  
  1235. &lt;h3 id=&quot;testing-framework&quot;&gt;Testing framework&lt;/h3&gt;
  1236.  
  1237. &lt;p&gt;&lt;a href=&quot;https://tests.reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-12/testframework.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1238.  
  1239. &lt;p&gt;The Reproducible Builds project operates a comprehensive testing framework at &lt;a href=&quot;https://tests.reproducible-builds.org&quot;&gt;tests.reproducible-builds.org&lt;/a&gt; in order to check packages and other artifacts for reproducibility. In October, the following changes were made by Holger Levsen:&lt;/p&gt;
  1240.  
  1241. &lt;ul&gt;
  1242.  &lt;li&gt;The &lt;code&gt;osuosl167&lt;/code&gt; machine is no longer a &lt;code&gt;openqa-worker&lt;/code&gt; node anymore. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/3aaabdbd&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/64841ce1&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1243.  &lt;li&gt;Detect problems with APT repository signatures [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/b800b755&quot;&gt;…&lt;/a&gt;] and update a repository signing key [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/fbe0179c&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  1244.  &lt;li&gt;reproducible Debian builtin-pho: improve job output. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/0e71f347&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1245.  &lt;li&gt;Only install the &lt;code&gt;foot-terminfo&lt;/code&gt; package on Debian systems. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/10319000&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1246. &lt;/ul&gt;
  1247.  
  1248. &lt;p&gt;In addition, Mattia Rizzolo added support for the version of &lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;em&gt;diffoscope&lt;/em&gt;&lt;/a&gt; in Debian &lt;em&gt;stretch&lt;/em&gt; which doesn’t support the &lt;code&gt;--timeout&lt;/code&gt; flag. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/988c1e94&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/1f5ae3b7&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  1249.  
  1250. &lt;hr /&gt;
  1251.  
  1252. &lt;h3 id=&quot;diffoscope&quot;&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;diffoscope&lt;/a&gt;&lt;/h3&gt;
  1253.  
  1254. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;img src=&quot;/images/reports/2022-12/diffoscope.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1255.  
  1256. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;em&gt;diffoscope&lt;/em&gt;&lt;/a&gt; is our in-depth and content-aware diff utility. Not only can it locate and diagnose reproducibility issues, it can provide human-readable diffs from many kinds of binary formats. This month, Chris Lamb made the following changes to &lt;a href=&quot;https://diffoscope.org&quot;&gt;diffoscope&lt;/a&gt;, including preparing and uploading versions &lt;code&gt;228&lt;/code&gt;, &lt;code&gt;229&lt;/code&gt; and &lt;code&gt;230&lt;/code&gt; to Debian:&lt;/p&gt;
  1257.  
  1258. &lt;ul&gt;
  1259.  &lt;li&gt;Fix compatibility with &lt;a href=&quot;https://darwinsys.com/file/&quot;&gt;&lt;code&gt;file(1)&lt;/code&gt;&lt;/a&gt; version 5.43, with thanks to Christoph Biedl. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/44ebd188&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1260.  &lt;li&gt;Skip the &lt;code&gt;test_html.py::test_diff&lt;/code&gt; test if &lt;code&gt;html2text&lt;/code&gt; is not installed. (&lt;a href=&quot;https://bugs.debian.org/1026034&quot;&gt;#1026034&lt;/a&gt;)&lt;/li&gt;
  1261.  &lt;li&gt;Update copyright years. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/9ac43af7&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1262. &lt;/ul&gt;
  1263.  
  1264. &lt;p&gt;In addition, Jelle van der Waa added support for &lt;a href=&quot;https://en.wikipedia.org/wiki/Berkeley_DB&quot;&gt;Berkeley DB&lt;/a&gt; version 6. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/ab87ab6a&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  1265.  
  1266. &lt;p&gt;Orthogonal to this, Holger Levsen bumped the Debian &lt;a href=&quot;https://www.debian.org/doc/debian-policy/ch-controlfields.html#s-f-standards-version&quot;&gt;&lt;code&gt;Standards-Version&lt;/code&gt;&lt;/a&gt; on all of our packages, including &lt;em&gt;diffoscope&lt;/em&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/e980ce7c&quot;&gt;…&lt;/a&gt;], &lt;em&gt;strip-nondeterminism&lt;/em&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/strip-nondeterminism/commit/4380d64&quot;&gt;…&lt;/a&gt;], &lt;em&gt;disorderfs&lt;/em&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/disorderfs/commit/878de25&quot;&gt;…&lt;/a&gt;] and &lt;em&gt;reprotest&lt;/em&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reprotest/commit/18e4f65&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  1267.  
  1268. &lt;hr /&gt;
  1269.  
  1270. &lt;p&gt;If you are interested in contributing to the Reproducible Builds project, please visit our &lt;a href=&quot;https://reproducible-builds.org/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page on our website. You can get in touch with us via:&lt;/p&gt;
  1271.  
  1272. &lt;ul&gt;
  1273.  &lt;li&gt;
  1274.    &lt;p&gt;IRC: &lt;code&gt;#reproducible-builds&lt;/code&gt; on &lt;code&gt;irc.oftc.net&lt;/code&gt;.&lt;/p&gt;
  1275.  &lt;/li&gt;
  1276.  &lt;li&gt;
  1277.    &lt;p&gt;Twitter: &lt;a href=&quot;https://twitter.com/ReproBuilds&quot;&gt;@ReproBuilds&lt;/a&gt;&lt;/p&gt;
  1278.  &lt;/li&gt;
  1279.  &lt;li&gt;
  1280.    &lt;p&gt;Mailing list: &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general&quot;&gt;&lt;code&gt;rb-general@lists.reproducible-builds.org&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;
  1281.  &lt;/li&gt;
  1282. &lt;/ul&gt;
  1283. </description>
  1284.      </item>
  1285.    
  1286.      <item>
  1287.        <title>Supporter spotlight: David A. Wheeler on supply chain security</title>
  1288.        <pubDate>Thu, 15 Dec 2022 12:00:00 +0000</pubDate>
  1289.        <link>https://reproducible-builds.org/news/2022/12/15/supporter-spotlight-davidawheeler-supply-chain-security/</link>
  1290.        <guid isPermaLink="true">https://reproducible-builds.org/news/2022/12/15/supporter-spotlight-davidawheeler-supply-chain-security/</guid>
  1291.        <description>&lt;p&gt;&lt;big&gt;The Reproducible Builds project &lt;a href=&quot;/who/&quot;&gt;relies on several projects, supporters and sponsors&lt;/a&gt; for financial support, but they are also valued as ambassadors who spread the word about our project and the work that we do.&lt;/big&gt;&lt;/p&gt;
  1292.  
  1293. &lt;p&gt;This is the &lt;em&gt;sixth&lt;/em&gt; instalment in a series featuring the projects, companies and individuals who support the Reproducible Builds project. We started this series by &lt;a href=&quot;/news/2020/10/21/supporter-spotlight-cip-project/&quot;&gt;featuring the Civil Infrastructure Platform&lt;/a&gt; project and followed this up with a &lt;a href=&quot;/news/2021/04/06/supporter-spotlight-ford-foundation/&quot;&gt;post about the Ford Foundation&lt;/a&gt; as well as a recent ones about &lt;a href=&quot;/news/2022/04/14/supporter-spotlight-ardc/&quot;&gt;ARDC&lt;/a&gt;, the &lt;a href=&quot;/news/2022/04/26/supporter-spotlight-google-open-source-security-team/&quot;&gt;Google Open Source Security Team (GOSST)&lt;/a&gt;, &lt;a href=&quot;/news/2022/05/18/jan-nieuwenhuizen-on-bootrappable-builds-gnu-mes-and-gnu-guix/&quot;&gt;Jan Nieuwenhuizen on Bootstrappable Builds, GNU Mes and GNU Guix&lt;/a&gt; and &lt;a href=&quot;/news/2022/06/24/supporter-spotlight-hans-christoph-steiner-f-droid-project/&quot;&gt;Hans-Christoph Steiner of the F-Droid project&lt;/a&gt;.&lt;/p&gt;
  1294.  
  1295. &lt;p&gt;Today, however, we will be talking with &lt;big&gt;&lt;strong&gt;David A. Wheeler&lt;/strong&gt;&lt;/big&gt;, the Director of Open Source Supply Chain Security at the &lt;a href=&quot;https://www.linuxfoundation.org/&quot;&gt;Linux Foundation&lt;/a&gt;.&lt;/p&gt;
  1296.  
  1297. &lt;p&gt;&lt;br /&gt;
  1298. &lt;br /&gt;&lt;/p&gt;
  1299.  
  1300. &lt;p&gt;&lt;img src=&quot;/images/news/supporter-spotlight-david-a-wheeler/dwheeler-2003c.jpg#right&quot; alt=&quot;&quot; /&gt;&lt;/p&gt;
  1301.  
  1302. &lt;p&gt;&lt;strong&gt;Holger Levsen: Welcome, David, thanks for taking the time to talk with us today. First, could you briefly tell me about yourself?&lt;/strong&gt;&lt;/p&gt;
  1303.  
  1304. &lt;p&gt;David: Sure! I’m David A. Wheeler and
  1305. I work for the &lt;a href=&quot;https://www.linuxfoundation.org/&quot;&gt;Linux Foundation&lt;/a&gt; as the Director of Open Source Supply Chain Security.
  1306. That just means that my job is to help open source software projects
  1307. improve their security, including its development, build, distribution,
  1308. and incorporation in larger works, all the way out to its eventual use by end-users.
  1309. In my copious free time I also teach at &lt;a href=&quot;https://www.gmu.edu/&quot;&gt;George Mason University&lt;/a&gt; (GMU); in particular,
  1310. I teach a graduate course on how to design and implement secure software.&lt;/p&gt;
  1311.  
  1312. &lt;p&gt;My background is technical. I have a Bachelor’s in Electronics Engineering,
  1313. a Master’s in Computer Science and a PhD in Information Technology.&lt;/p&gt;
  1314.  
  1315. &lt;p&gt;My PhD dissertation is connected to reproducible builds.
  1316. My PhD dissertation was on countering the ‘Trusting Trust’ attack, an attack
  1317. that subverts fundamental build system tools such as compilers.
  1318. The attack was discovered by Karger &amp;amp; Schell in the 1970s, and later
  1319. demonstrated &amp;amp; popularized by Ken Thompson.
  1320. In &lt;a href=&quot;https://dwheeler.com/trusting-trust&quot;&gt;my dissertation on ‘trusting trust’&lt;/a&gt; I showed that a process
  1321. called ‘Diverse Double-Compiling’ (DDC) could detect trusting trust attacks.
  1322. That process is a specialized kind of reproducible build specifically designed
  1323. to detect trusting trust style attacks. In addition, countering the trusting trust
  1324. attack primarily becomes more important only when reproducible builds become
  1325. more common. Reproducible builds enable detection of
  1326. build-time subversions.
  1327. Most attackers wouldn’t bother with a trusting trust attack if they could just
  1328. directly use a build-time subversion of the software they actually want to subvert.&lt;/p&gt;
  1329.  
  1330. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  1331.  
  1332. &lt;p&gt;&lt;strong&gt;Holger: Thanks for taking the time to introduce yourself to us. What do you think are the biggest challenges today in computing?&lt;/strong&gt;&lt;/p&gt;
  1333.  
  1334. &lt;p&gt;There are many big challenges in computing today. For example:&lt;/p&gt;
  1335.  
  1336. &lt;ul&gt;
  1337.  &lt;li&gt;Lack of resilience &amp;amp; capacity in chip fabrication. Fabs are extraordinarily expensive,
  1338. and at the high end continue to have technological advancement.
  1339. As a result, supply is failing to meet demand, and geopolitical issues raise further concerns.
  1340. We’ve seen cars, gaming consoles and many other devices
  1341. unable to be delivered due to chip shortages. More fabs are
  1342. being built, and some politicians are raising concerns, but it’s unclear
  1343. that current efforts will be enough.&lt;/li&gt;
  1344.  &lt;li&gt;Lack of enough developers able to develop the software that people &amp;amp; organizations need.
  1345. Computers are far faster, and open source software has made software reuse
  1346. incredibly easy. However, organizations still struggle to automate
  1347. many tasks. The bottleneck is the lack of enough talented developers able to convert
  1348. ideas into working software. ‘Low-code’ and ‘no-code’ approaches help in specialized areas,
  1349. just like all previous ‘automate the programmer’ efforts of the last 60 years, but
  1350. there’s no reason to believe they will help enough.&lt;/li&gt;
  1351.  &lt;li&gt;Large scale of software. Small systems are easier to develop &amp;amp; maintain, but today’s
  1352. systems increasingly get bigger to meet users’ needs &amp;amp; are much harder to manage.
  1353. Even small embedded systems are often supported by huge back-end systems.&lt;/li&gt;
  1354.  &lt;li&gt;Ending tail of Moore’s law &amp;amp; rise of smartphones. Historically people would just wait a few years for their
  1355. software to speed up, but Moore’s law is petering out, and smartphones are necessarily
  1356. limited by power &amp;amp; size limits. As a result, software developers
  1357. can’t wait for the hardware to save their slow systems; they must redesign.
  1358. Switching to faster languages, or using multiple processors, is much more difficult than
  1359. waiting for performance problems to disappear.&lt;/li&gt;
  1360.  &lt;li&gt;Continuous change in interfaces. Developers continuously find reasons to change
  1361. component interfaces: perhaps they’re too inflexible, too hard to use, and so on.
  1362. But now that developers are reusing hundreds, thousands, or tens of thousands of components,
  1363. managing the continuous change of the reused components is challenging.
  1364. Package managers make updating easy — but don’t automatically handle interface changes.
  1365. I think this is mostly a self-inflicted problem — most components &lt;em&gt;could&lt;/em&gt; support old interfaces
  1366. (like the Linux kernel does) — but because it’s often not acknowledged as a problem, it’s often not addressed.&lt;/li&gt;
  1367.  &lt;li&gt;Security &amp;amp; privacy. Decades ago there were fewer computers and most computers weren’t connected to a network.
  1368. Today things are different. Criminals have found many ways to attack computer systems to
  1369. make money, and nation-states have found many ways to attack computer systems for their own reasons.
  1370. Attackers now have very strong motivations to perform attacks.
  1371. Yet many developers aren’t told how to develop software that resists attacks, nor
  1372. how to protect their supply chains. Operations try to monitor and recover from
  1373. attacks, but their job is difficult due to inadequately secure software that doesn’t
  1374. support those monitoring &amp;amp; recovery efforts well either. The results are terrible security.&lt;/li&gt;
  1375. &lt;/ul&gt;
  1376.  
  1377. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  1378.  
  1379. &lt;p&gt;&lt;strong&gt;Holger: Do you think reproducible builds are an important part in secure computing today already?&lt;/strong&gt;&lt;/p&gt;
  1380.  
  1381. &lt;p&gt;David: Yes, but first let’s put things in context.&lt;/p&gt;
  1382.  
  1383. &lt;p&gt;Today, when attackers exploit software vulnerabilities, they’re primarily
  1384. exploiting unintentional vulnerabilities that were created by the software
  1385. developers. There are a lot of efforts to counter this:&lt;/p&gt;
  1386.  
  1387. &lt;ul&gt;
  1388.  &lt;li&gt;Train &amp;amp; education developers in how to develop secure software.
  1389. The OpenSSF provides a &lt;a href=&quot;https://openssf.org/training/courses/&quot;&gt;free course on how to do that&lt;/a&gt; (full disclosure: I’m the author).
  1390. Take that course or something like it!&lt;/li&gt;
  1391.  &lt;li&gt;Add tools to your CI pipeline to detect potential vulnerabilities. Yes, they have false
  1392. positives and false negatives, so you have to also use your brain… but that just means you
  1393. need to be smart about using tools, instead of not using them.&lt;/li&gt;
  1394.  &lt;li&gt;Get projects &amp;amp; organizations to update the components they use,
  1395. since often the vulnerabilities are well-known publicly
  1396. (e.g., &lt;a href=&quot;https://en.wikipedia.org/wiki/2017_Equifax_data_breach&quot;&gt;Equifax in 2017&lt;/a&gt;). Add some tools to your development process to warn you about
  1397. components with known vulnerabilities! GitHub &amp;amp; GitLab both provide tools to do this,
  1398. and there are many other tools.&lt;/li&gt;
  1399.  &lt;li&gt;When starting new projects, try to use memory-safe languages. On average 70% of the
  1400. vulnerabilities in Chrome and in Microsoft are from memory safety problems; using a memory-safe
  1401. language eliminates most of them.&lt;/li&gt;
  1402. &lt;/ul&gt;
  1403.  
  1404. &lt;p&gt;We’re just starting to get better at this, which is good. However, attackers always
  1405. try to attack the easiest target. As our deployed software has started to be hardened
  1406. against attack, attackers have dramatically increased their attacks
  1407. on the software supply chain (&lt;a href=&quot;https://www.sonatype.com/state-of-the-software-supply-chain/open-source-supply-demand-security&quot;&gt;Sonatype found in 2022 that there’s been a 742% increase year-over-year&lt;/a&gt;).&lt;/p&gt;
  1408.  
  1409. &lt;p&gt;The software supply chain hasn’t historically gotten much attention, making it the easy target.&lt;/p&gt;
  1410.  
  1411. &lt;p&gt;There are simple supply chain attacks with simple solutions:&lt;/p&gt;
  1412. &lt;ul&gt;
  1413.  &lt;li&gt;In almost every year the top attack has been typosquatting. In typo squatting,
  1414. an attacker creates packages with &lt;em&gt;almost&lt;/em&gt; the right name. This is an easy attack to
  1415. counter — developers just need to double-check the name of a package before adding it.
  1416. But we aren’t warning developers enough about it!
  1417. For more information, see papers such as the &lt;a href=&quot;https://dasfreak.github.io/Backstabbers-Knife-Collection/&quot;&gt;Backstabber’s Knife Collection&lt;/a&gt;.&lt;/li&gt;
  1418.  &lt;li&gt;Last year the top software supply chain attack was ‘dependency confusion’ — convincing
  1419. projects to use the wrong repo for a given package. There are simple solutions to this, such as
  1420. specifying the package source and/or requiring a cryptographic hash to match.&lt;/li&gt;
  1421.  &lt;li&gt;Some attacks involve takeovers of developer accounts. In almost all cases, these are
  1422. caused by stolen passwords. Using a multi-factor authentication (MFA) token eliminates
  1423. stolen password attacks, which is why several
  1424. repositories are starting to require MFA tokens in some cases.&lt;/li&gt;
  1425. &lt;/ul&gt;
  1426.  
  1427. &lt;p&gt;Unfortunately, attackers know there are other lines of attack.
  1428. One of the most dangerous is subverted build systems, as demonstrated by
  1429. the subversion of SolarWinds’ Orion system. In a subverted build system,
  1430. developers can review the software source code all day and see no problem,
  1431. because there &lt;em&gt;is&lt;/em&gt; no problem there. Instead, the process to convert source code
  1432. into the code people run, called the ‘build system’, is subverted by an attacker.&lt;/p&gt;
  1433.  
  1434. &lt;p&gt;One solution for countering subverted build systems is to make the build systems harder
  1435. to attack. That’s a good thing to do, but you can never be confident that it was ‘good enough’.
  1436. How can you be sure it’s not subverted, if there’s no way to know?&lt;/p&gt;
  1437.  
  1438. &lt;p&gt;A stronger defense against subverted build systems is the idea of verified reproducible builds.
  1439. A build is reproducible if given the same source code, build environment and build instructions,
  1440. any party can recreate bit-by-bit identical copies of all specified artifacts.
  1441. A build is &lt;em&gt;verified&lt;/em&gt; if multiple different parties verify that they get the same result for that situation.
  1442. When you have a verified reproducible build, either all the parties colluded
  1443. (and you could always double-check it yourself), or the build process isn’t subverted.&lt;/p&gt;
  1444.  
  1445. &lt;p&gt;There is one last turtle: What if the build system tools or machines are subverted themselves?
  1446. This is not a common attack today, but it’s important to know if we &lt;em&gt;can&lt;/em&gt; address them
  1447. when the time comes. The good news is that we &lt;em&gt;can&lt;/em&gt; address this.
  1448. For some situations reproducible builds can also counter such attacks.
  1449. If there’s a loop (that is, a compiler is used to generate itself), that’s called the ‘trusting trust’ attack,
  1450. and that is more challenging. Thankfully, the ‘trusting trust’ attack has been known about for
  1451. decades and there are known solutions. The ‘diverse double-compiling’ (DDC) process that
  1452. I explained in my PhD dissertation, as well as the ‘bootstrappable builds’ process, can
  1453. both counter trusting trust attacks in the software space. So there is no reason to lose hope:
  1454. there is a ‘bottom turtle’, as it were.&lt;/p&gt;
  1455.  
  1456. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  1457.  
  1458. &lt;p&gt;&lt;strong&gt;Holger: Thankfully, this has all slowly started to change and supply chain issues are now widely discussed, as evident by efforts like
  1459. &lt;a href=&quot;https://www.cisa.gov/uscert/sites/default/files/publications/ESF_SECURING_THE_SOFTWARE_SUPPLY_CHAIN_DEVELOPERS.PDF&quot;&gt;Securing the Software Supply Chain: Recommended Practices Guide for Developers&lt;/a&gt;
  1460. which you shared &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general&quot;&gt;on our mailing list&lt;/a&gt;. In there, Reproducible Builds are mentioned as recommended advanced practice, which is both pretty cool (we’ve come a long way!), but to me it also sounds like this will take another decade until it’s become standard normal procedure. Do you agree on that timeline?&lt;/strong&gt;&lt;/p&gt;
  1461.  
  1462. &lt;p&gt;David: I don’t think there will be any particular timeframe. Different projects and
  1463. ecosystems will move at different speeds. I wouldn’t be surprised if it
  1464. took a decade or so for them to become relatively common — there are
  1465. good reasons for that.&lt;/p&gt;
  1466.  
  1467. &lt;p&gt;Today the most common kinds of attacks based on software
  1468. vulnerabilities still involve unintentional vulnerabilities in operational systems.
  1469. Attackers are starting to apply supply chain attacks, but the top such attacks
  1470. today are typosquatting (creating packages with similar names) and
  1471. dependency confusion) (convincing projects to download packages from the wrong
  1472. repositories).&lt;/p&gt;
  1473.  
  1474. &lt;p&gt;Reproducible builds don’t counter those kinds of attacks, they
  1475. counter subverted builds. It’s important to eventually have verified
  1476. reproducible builds, but understandably other issues are currently getting
  1477. prioritized first.&lt;/p&gt;
  1478.  
  1479. &lt;p&gt;That said, reproducible builds are important long term.
  1480. Many people are working on countering unintentional vulnerabilities
  1481. and the most common kinds of supply chain attacks.
  1482. As these other threats are countered, attackers will increasingly target
  1483. build systems. Attackers always go for the weakest link.
  1484. We will eventually need verified reproducible builds in many situations, and
  1485. it’ll take a while to get build systems able to widely perform reproducible builds,
  1486. so we need to start that work now. That’s true for anything where you know
  1487. you’ll need it but it will take a long time to get ready — you need to start now.&lt;/p&gt;
  1488.  
  1489. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  1490.  
  1491. &lt;p&gt;&lt;strong&gt;Holger: What are your suggestions to accelerate adoption?&lt;/strong&gt;&lt;/p&gt;
  1492.  
  1493. &lt;p&gt;David: Reproducible builds need to be:&lt;/p&gt;
  1494.  
  1495. &lt;ul&gt;
  1496.  &lt;li&gt;Easy (ideally automatic). Tools need to be modified so that reproducible builds
  1497. are the default or at least easier to do.&lt;/li&gt;
  1498.  &lt;li&gt;Transparent to projects &amp;amp; potential users. Many projects have no idea that their results aren’t
  1499. reproducible, and many potential users of the project don’t know either.
  1500. That information needs to be obvious. I’ve proposed that the OpenSSF
  1501. Dashboard SIG try to reproduce builds, for at least some packages, to make it
  1502. more obvious to everyone when a project isn’t reproducible. I don’t know if that
  1503. will happen in that particular case, but the point is to help people learn that information
  1504. as soon as possible.&lt;/li&gt;
  1505.  &lt;li&gt;Deployed.
  1506. Experiments are great, but experiments showing that a project &lt;em&gt;could&lt;/em&gt; be reproducible
  1507. are inadequate. We need the projects that people &lt;em&gt;use&lt;/em&gt; to be reproducible.&lt;/li&gt;
  1508. &lt;/ul&gt;
  1509.  
  1510. &lt;p&gt;I think there’s a snowball effect. Once many projects’ packages are reproducible,
  1511. it will be easier to convince other projects to make their packages reproducible.&lt;/p&gt;
  1512.  
  1513. &lt;p&gt;I also think there should be some prioritization. If a package is in wide use
  1514. (e.g., part of minimum set of packages for a widely-used Linux distribution or
  1515. framework), its reproducibility should be a special focus. If a package is vital for
  1516. supporting some societally important critical infrastructure (e.g., running dams),
  1517. it should also be considered important. You can then work on the
  1518. ones that are less important over time.&lt;/p&gt;
  1519.  
  1520. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  1521.  
  1522. &lt;p&gt;&lt;strong&gt;Holger: How is the &lt;a href=&quot;https://github.com/coreinfrastructure/best-practices-badge/&quot;&gt;Best Practices Badge&lt;/a&gt; going? How many projects are participating and how many are missing?&lt;/strong&gt;&lt;/p&gt;
  1523.  
  1524. &lt;p&gt;David: It’s going very well. You can &lt;a href=&quot;https://bestpractices.coreinfrastructure.org/project_stats&quot;&gt;see some automatically-generated statistics&lt;/a&gt;, showing we have over 5,000 projects, adding more than 1/day on average.
  1525. We have more than 900 projects that have earned at least the ‘passing’ badge level.&lt;/p&gt;
  1526.  
  1527. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  1528.  
  1529. &lt;p&gt;&lt;strong&gt;Holger: How many of the projects participating in the Best Practices badge engaging with reproducible builds?&lt;/strong&gt;&lt;/p&gt;
  1530.  
  1531. &lt;p&gt;David: As of this writing there are 168 projects that report meeting the reproducible builds criterion.
  1532. That’s a relatively small percentage of projects. However, note that this criterion (labelled &lt;em&gt;build_reproducible&lt;/em&gt;)
  1533. is only required for the ‘gold’ badge. It’s not required for the passing or silver level badge.&lt;/p&gt;
  1534.  
  1535. &lt;p&gt;Currently we’ve been strategically focused on getting projects to at least earn a passing badge,
  1536. and less on earning silver or gold badges.
  1537. We would &lt;em&gt;love&lt;/em&gt; for all projects to get earn a silver or gold badge, of course, but
  1538. our theory is that projects that can’t even earn a passing badge present the most risk to their users.&lt;/p&gt;
  1539.  
  1540. &lt;p&gt;That said, there are some projects we especially want to see implementing higher badge levels.
  1541. Those include projects that are very widely used, so that
  1542. vulnerabilities in them can impact many systems.
  1543. Examples of such projects include the Linux kernel and curl.
  1544. In addition, some projects are used within
  1545. systems where it’s important to society that they not have serious security vulnerabilities.
  1546. Examples include projects used by
  1547. chemical manufacturers, financial systems and weapons.
  1548. We definitely encourage any of those kinds of projects to earn higher badge levels.&lt;/p&gt;
  1549.  
  1550. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  1551.  
  1552. &lt;p&gt;&lt;strong&gt;Holger: Many thanks for this interview, David, and for all of your work at the Linux Foundation and elsewhere!&lt;/strong&gt;&lt;/p&gt;
  1553.  
  1554. &lt;p&gt;&lt;br /&gt;
  1555. &lt;br /&gt;&lt;/p&gt;
  1556.  
  1557. &lt;p&gt;&lt;a href=&quot;https://www.linuxfoundation.org/&quot;&gt;&lt;img src=&quot;/images/news/supporter-spotlight-david-a-wheeler/lf-stacked-color.svg#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1558.  
  1559. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  1560.  
  1561. &lt;hr /&gt;
  1562.  
  1563. &lt;p&gt;&lt;br /&gt;
  1564. &lt;em&gt;For more information about the Reproducible Builds project, please see our website at
  1565. &lt;a href=&quot;/&quot;&gt;reproducible-builds.org&lt;/a&gt;. If you are interested in
  1566. ensuring the ongoing security of the software that underpins our civilisation
  1567. and wish to sponsor the Reproducible Builds project, please reach out to the
  1568. project by emailing
  1569. &lt;a href=&quot;mailto:contact@reproducible-builds.org&quot;&gt;contact@reproducible-builds.org&lt;/a&gt;.&lt;/em&gt;&lt;/p&gt;
  1570. </description>
  1571.      </item>
  1572.    
  1573.      <item>
  1574.        <title>Reproducible Builds in November 2022</title>
  1575.        <pubDate>Thu, 08 Dec 2022 17:45:11 +0000</pubDate>
  1576.        <link>https://reproducible-builds.org/reports/2022-11/</link>
  1577.        <guid isPermaLink="true">https://reproducible-builds.org/reports/2022-11/</guid>
  1578.        <description>&lt;p&gt;&lt;a href=&quot;https://reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-11/reproducible-builds.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1579.  
  1580. &lt;p&gt;Welcome to yet another report from the &lt;a href=&quot;https://reproducible-builds.org&quot;&gt;Reproducible Builds&lt;/a&gt; project, this time for &lt;em&gt;November 2022&lt;/em&gt;. In all of these reports (which we have been &lt;a href=&quot;/news/&quot;&gt;publishing regularly since May 2015&lt;/a&gt;) we attempt to outline the most important things that we have been up to over the past month. As always, if you interested in contributing to the project, please visit our &lt;a href=&quot;/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page on our website.&lt;/p&gt;
  1581.  
  1582. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  1583.  
  1584. &lt;h3 id=&quot;reproducible-builds-summit-2022&quot;&gt;Reproducible Builds Summit 2022&lt;/h3&gt;
  1585.  
  1586. &lt;p&gt;&lt;a href=&quot;/events/venice2022/&quot;&gt;&lt;img src=&quot;/images/reports/2022-11/summit_photo.jpg#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1587.  
  1588. &lt;p&gt;Following-up from &lt;a href=&quot;/reports/2022-10/&quot;&gt;last month’s report&lt;/a&gt; about our recent summit in Venice, Italy, a comprehensive report from the meeting has not been finalised yet — watch this space!&lt;/p&gt;
  1589.  
  1590. &lt;p&gt;As a very small preview, however, we can link to several issues that were filed about the website during the summit (&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/-/issues/38&quot;&gt;#38&lt;/a&gt;, &lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/-/issues/39&quot;&gt;#39&lt;/a&gt;, &lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/-/issues/40&quot;&gt;#40&lt;/a&gt;,  &lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/-/issues/41&quot;&gt;#41&lt;/a&gt;, &lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/-/issues/42&quot;&gt;#42&lt;/a&gt;, &lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/-/issues/43&quot;&gt;#43&lt;/a&gt;, etc.) and collectively learned about &lt;a href=&quot;https://en.wikipedia.org/wiki/Software_supply_chain#Usage&quot;&gt;Software Bill of Materials&lt;/a&gt; (SBOM)’s and how &lt;code&gt;.buildinfo&lt;/code&gt; files can be seen/used as SBOMs. And, no less importantly, the Reproducible Builds t-shirt design has been updated…&lt;/p&gt;
  1591.  
  1592. &lt;hr /&gt;
  1593.  
  1594. &lt;h3 id=&quot;reproducible-builds-at-european-cyber-week-2022&quot;&gt;Reproducible Builds at European Cyber Week 2022&lt;/h3&gt;
  1595.  
  1596. &lt;p&gt;&lt;a href=&quot;https://www.european-cyber-week.eu/?lang=en&quot;&gt;&lt;img src=&quot;/images/reports/2022-11/cyberweek.jpg#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1597.  
  1598. &lt;p&gt;During the &lt;a href=&quot;https://www.european-cyber-week.eu/?lang=en&quot;&gt;European Cyber Week 2022&lt;/a&gt;, a &lt;a href=&quot;https://en.wikipedia.org/wiki/Capture_the_flag_(cybersecurity)&quot;&gt;Capture The Flag&lt;/a&gt; (CTF) cybersecurity challenge was created by Frédéric Pierret on the subject of Reproducible Builds. The challenge consisted in a pedagogical sense based on how to make a software release reproducible. To progress through the challenge issues that affect the reproducibility of build (such as build path, timestamps, file ordering, etc.) were to be fixed in steps in order to get the final ‘flag’ in order to win the challenge.&lt;/p&gt;
  1599.  
  1600. &lt;p&gt;At the end of the competition, five people succeeded in solving the challenge, all of whom were awarded with a shirt. Frédéric Pierret intends to create similar challenge in the form of a “how to” in the &lt;a href=&quot;/docs/&quot;&gt;Reproducible Builds documentation&lt;/a&gt;, but two of the 2022 winners are shown here:&lt;/p&gt;
  1601.  
  1602. &lt;p&gt;&lt;a href=&quot;https://www.european-cyber-week.eu/?lang=en&quot;&gt;&lt;img src=&quot;/images/reports/2022-11/IMG_20221130_220704_288.jpg#center&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1603.  
  1604. &lt;hr /&gt;
  1605.  
  1606. &lt;h3 id=&quot;on-business-adoption-and-use-of-reproducible-builds&quot;&gt;‘&lt;em&gt;On business adoption and use of reproducible builds…&lt;/em&gt;’&lt;/h3&gt;
  1607.  
  1608. &lt;p&gt;&lt;a href=&quot;https://link.springer.com/article/10.1007/s11219-022-09607-z&quot;&gt;&lt;img src=&quot;/images/reports/2022-11/butler.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1609.  
  1610. &lt;p&gt;Simon Butler &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-November/002761.html&quot;&gt;announced on the &lt;em&gt;rb-general&lt;/em&gt; mailing list&lt;/a&gt; that the &lt;a href=&quot;https://www.springer.com/journal/11219&quot;&gt;Software Quality Journal&lt;/a&gt; published an article called &lt;a href=&quot;https://link.springer.com/article/10.1007/s11219-022-09607-z&quot;&gt;&lt;em&gt;On business adoption and use of reproducible builds for open and closed source software&lt;/em&gt;&lt;/a&gt;.&lt;/p&gt;
  1611.  
  1612. &lt;p&gt;This article is an interview-based study which focuses on the adoption and uses of Reproducible Builds in industry, with a focus on investigating the reasons why organisations might not have adopted them:&lt;/p&gt;
  1613.  
  1614. &lt;blockquote&gt;
  1615.  &lt;p&gt;[…] industry application of R-Bs appears limited, and we seek to understand whether awareness is low or if significant technical and business reasons prevent wider adoption.&lt;/p&gt;
  1616. &lt;/blockquote&gt;
  1617.  
  1618. &lt;p&gt;This is achieved through interviews with software practitioners and business managers, and touches on both the business and technical reasons supporting the adoption (or not) of Reproducible Builds. The article also begins with an excellent explanation and literature review, and even introduces a new helpful analogy for reproducible builds:&lt;/p&gt;
  1619.  
  1620. &lt;blockquote&gt;
  1621.  &lt;p&gt;[Users are] able to perform a bitwise comparison of the two binaries to verify that they are identical and that the distributed binary is indeed built from the source code in the way the provider claims. Applied in this manner, R-Bs &lt;strong&gt;function as a canary&lt;/strong&gt;, a mechanism that indicates when something might be wrong, and offer an improvement in security over running unverified binaries on computer systems.&lt;/p&gt;
  1622. &lt;/blockquote&gt;
  1623.  
  1624. &lt;p&gt;The &lt;a href=&quot;https://link.springer.com/article/10.1007/s11219-022-09607-z&quot;&gt;full paper&lt;/a&gt; is available to download on an ‘&lt;a href=&quot;https://en.wikipedia.org/wiki/Open_access&quot;&gt;open access&lt;/a&gt;’ basis.&lt;/p&gt;
  1625.  
  1626. &lt;p&gt;&lt;a href=&quot;https://arxiv.org/pdf/2211.06249.pdf&quot;&gt;&lt;img src=&quot;/images/reports/2022-11/integrity-paper.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1627.  
  1628. &lt;p&gt;Elsewhere in academia, Beatriz Michelson Reichert and Rafael R. Obelheiro have published a paper proposing a systematic threat model for a generic software development pipeline identifying possible mitigations for each threat (&lt;a href=&quot;https://arxiv.org/pdf/2211.06249.pdf&quot;&gt;PDF&lt;/a&gt;). Under the &lt;em&gt;Tampering&lt;/em&gt; rubric of their paper, various attacks against Continuous Integration (CI) processes:&lt;/p&gt;
  1629.  
  1630. &lt;blockquote&gt;
  1631.  &lt;p&gt;An attacker may insert a backdoor into a CI or build tool and thus introduce vulnerabilities into the software (resulting in an improper build). To avoid this threat, it is the developer’s responsibility to take due care when making use of third-party build tools. Tampered compilers can be mitigated using diversity, as in the diverse double compiling (DDC) technique. &lt;strong&gt;Reproducible builds, a recent research topic, can also provide mitigation for this problem.&lt;/strong&gt; (&lt;a href=&quot;https://arxiv.org/pdf/2211.06249.pdf&quot;&gt;PDF&lt;/a&gt;)&lt;/p&gt;
  1632. &lt;/blockquote&gt;
  1633.  
  1634. &lt;hr /&gt;
  1635.  
  1636. &lt;h3 id=&quot;misc-news&quot;&gt;Misc news&lt;/h3&gt;
  1637.  
  1638. &lt;p&gt;&lt;a href=&quot;https://go.dev/&quot;&gt;&lt;img src=&quot;/images/reports/2022-11/golang.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1639.  
  1640. &lt;ul&gt;
  1641.  &lt;li&gt;
  1642.    &lt;p&gt;A change was proposed for the &lt;a href=&quot;https://go.dev/&quot;&gt;Go programming language&lt;/a&gt; to &lt;a href=&quot;https://go-review.googlesource.com/c/go/+/413974&quot;&gt;enable reproducible builds when Link Time Optimisation (LTO) is enabled&lt;/a&gt;. As mentioned in the changelog, Morten Linderud’s patch fixes two issues when the linker used in conjunction with the &lt;code&gt;-flto&lt;/code&gt; option: the first involves solving an issue related to &lt;a href=&quot;https://en.wikipedia.org/wiki/Random_seed&quot;&gt;seeded random numbers&lt;/a&gt;; and the second involved the binary embedding the current working directory in compressed sections of the LTO object. Both of these issues made the build unreproducible.&lt;/p&gt;
  1643.  &lt;/li&gt;
  1644.  &lt;li&gt;
  1645.    &lt;p&gt;In the &lt;a href=&quot;https://en.wikipedia.org/wiki/.NET&quot;&gt;.NET framework ecosystem&lt;/a&gt;, a wiki page for the &lt;a href=&quot;https://learn.microsoft.com/en-gb/dotnet/csharp/roslyn-sdk/&quot;&gt;Roslyn .NET C# and Visual Basic compiler&lt;/a&gt; was uncovered this month that &lt;a href=&quot;https://github.com/dotnet/roslyn/blob/main/docs/compilers/Deterministic%20Inputs.md&quot;&gt;details its attempts to ensure end-to-end reproducible builds&lt;/a&gt; by focusing on the definition on what are ‘considered inputs to the compiler for the purpose of determinism’. This is a spiritual followup to a 2016 blog post by Microsoft developer &lt;a href=&quot;https://blog.paranoidcoding.com/&quot;&gt;Jared Parsons&lt;/a&gt; on ‘&lt;a href=&quot;https://blog.paranoidcoding.com/2016/04/05/deterministic-builds-in-roslyn.html&quot;&gt;Deterministic builds in Roslyn&lt;/a&gt;’ which starts: ‘It seems silly to celebrate features which should have been there from the start.’&lt;/p&gt;
  1646.  &lt;/li&gt;
  1647.  &lt;li&gt;
  1648.    &lt;p&gt;&lt;a href=&quot;https://gcc.gnu.org/pipermail/gcc-patches/2022-November/606205.html&quot;&gt;Ian Lance Taylor followed up an old post&lt;/a&gt; to report that Jakub Jelinek’s patch from September 2000 is incomplete.&lt;/p&gt;
  1649.  &lt;/li&gt;
  1650. &lt;/ul&gt;
  1651.  
  1652. &lt;p&gt;&lt;a href=&quot;https://f-droid.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-11/fdroid.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1653.  
  1654. &lt;ul&gt;
  1655.  &lt;li&gt;
  1656.    &lt;p&gt;In &lt;a href=&quot;https://f-droid.org/&quot;&gt;F-Droid&lt;/a&gt; this month, Reproducible Builds contributor FC Stegerman created a &lt;a href=&quot;https://github.com/obfusk/reproducible-apk-tools&quot;&gt;set of ‘reproducible APK tools’&lt;/a&gt; as a workaround for issues like &lt;a href=&quot;https://gitlab.com/fdroid/fdroiddata/-/issues/2816#note_1179533719&quot;&gt;the order of files in APKs built on macOS being non-deterministic&lt;/a&gt;. In addition, the new issue documenting &lt;a href=&quot;https://gitlab.com/fdroid/fdroiddata/-/issues/2844&quot;&gt;the overview of apps using reproducible builds&lt;/a&gt; shows that F-Droid added 11 new apps that use reproducible builds, and FC Stegerman released &lt;em&gt;apksigcopier&lt;/em&gt; version 1.1.0 which &lt;a href=&quot;https://github.com/obfusk/apksigcopier#what-about-apks-signed-by-gradlezipflingersignflinger-instead-of-apksigner&quot;&gt;adds support for APKs signed by ‘Signflinger’&lt;/a&gt;.&lt;/p&gt;
  1657.  &lt;/li&gt;
  1658.  &lt;li&gt;
  1659.    &lt;p&gt;&lt;em&gt;martinSusz&lt;/em&gt; has written up a &lt;a href=&quot;https://github.com/martinSusz/rkdeveloptool/wiki/Generating--quasi-reproducible-BootROM-firmware-for-Rock-Chips-SoC&quot;&gt;fascinating wiki page&lt;/a&gt; describing how to generate ‘quasi-reproducible’ firmware ROMs for &lt;a href=&quot;https://en.wikipedia.org/wiki/System_on_a_chip&quot;&gt;System-on-a-Chip&lt;/a&gt; (SoC) components fabricated by &lt;a href=&quot;https://en.wikipedia.org/wiki/Rockchip&quot;&gt;Rock Chip&lt;/a&gt;. These chips are used in popular low-cost laptops such as the &lt;a href=&quot;https://www.pine64.org/pinebook-pro/&quot;&gt;Pine64 PinebookPro&lt;/a&gt; and &lt;a href=&quot;https://www.asus.com/us/laptops/for-home/chromebook/asus-chromebook-c201/&quot;&gt;Asus C201&lt;/a&gt;. The link is worth viewing simply for the &lt;a href=&quot;https://user-images.githubusercontent.com/119517241/205492847-f2e03cd0-c7b4-43f2-b7f0-e970e531e805.png&quot;&gt;interesting diagram&lt;/a&gt;.&lt;/p&gt;
  1660.  &lt;/li&gt;
  1661.  &lt;li&gt;
  1662.    &lt;p&gt;Our monthly IRC meeting was &lt;a href=&quot;http://meetbot.debian.net/reproducible-builds/2022/reproducible-builds.2022-11-29-14.58.html&quot;&gt;held on November 29th 2022&lt;/a&gt;. Our next meeting will be on &lt;strong&gt;January 31st 2023&lt;/strong&gt;; we’ll skip the meeting in December due to the proximity to Christmas, etc.&lt;/p&gt;
  1663.  &lt;/li&gt;
  1664. &lt;/ul&gt;
  1665.  
  1666. &lt;hr /&gt;
  1667.  
  1668. &lt;p&gt;On &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general/&quot;&gt;our mailing list&lt;/a&gt; this month:&lt;/p&gt;
  1669.  
  1670. &lt;ul&gt;
  1671.  &lt;li&gt;
  1672.    &lt;p&gt;Adrian Diglio from Microsoft asked “&lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-November/002726.html&quot;&gt;How to Add a New Project within Reproducible Builds&lt;/a&gt;” which solicited a number of replies.&lt;/p&gt;
  1673.  &lt;/li&gt;
  1674.  &lt;li&gt;
  1675.    &lt;p&gt;Vagrant Cascadian posed an interesting question regarding the difference between “test builds” vs “rebuilds” (or “verification rebuilds”). As &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-November/002747.html&quot;&gt;Vagrant poses in their message&lt;/a&gt;, “they’re both useful for slightly different purposes, and it might be good to clarify the distinction […].”&lt;/p&gt;
  1676.  &lt;/li&gt;
  1677. &lt;/ul&gt;
  1678.  
  1679. &lt;hr /&gt;
  1680.  
  1681. &lt;h3 id=&quot;debian--other-linux-distributions&quot;&gt;Debian &amp;amp; other Linux distributions&lt;/h3&gt;
  1682.  
  1683. &lt;p&gt;&lt;a href=&quot;https://debian.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-11/debian.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1684.  
  1685. &lt;p&gt;Over 50 reviews of Debian packages were added this month, another 48 were updated and almost 30 were removed, all of which adds to &lt;a href=&quot;https://tests.reproducible-builds.org/debian/index_issues.html&quot;&gt;our knowledge about identified issues&lt;/a&gt;. Two new issue types were added as well. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/9c673bfa&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/bbe35ed0&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  1686.  
  1687. &lt;p&gt;Vagrant Cascadian announced on &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/&quot;&gt;our mailing list&lt;/a&gt; another online sprint to help ‘clear the huge backlog of reproducible builds patches submitted’ by performing NMUs (&lt;a href=&quot;https://wiki.debian.org/NonMaintainerUpload&quot;&gt;Non-Maintainer Uploads&lt;/a&gt;). The first such sprint took place on September 22nd, but others were held on October 6th and October 20th. There were two additional sprints that occurred in November, however, which resulted in the following progress:&lt;/p&gt;
  1688.  
  1689. &lt;ul&gt;
  1690.  &lt;li&gt;
  1691.    &lt;p&gt;Chris Lamb:&lt;/p&gt;
  1692.  
  1693.    &lt;ul&gt;
  1694.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/paxctl&quot;&gt;&lt;code&gt;paxctl&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/1020804&quot;&gt;#1020804&lt;/a&gt;)&lt;/li&gt;
  1695.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/png23d&quot;&gt;&lt;code&gt;png23d&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/1020805&quot;&gt;#1020805&lt;/a&gt;)&lt;/li&gt;
  1696.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/tuxcmd-modules&quot;&gt;&lt;code&gt;tuxcmd-modules&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/1011500&quot;&gt;#1011500&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/941296&quot;&gt;#941296&lt;/a&gt;)&lt;/li&gt;
  1697.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/waili&quot;&gt;&lt;code&gt;waili&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/1020751&quot;&gt;#1020751&lt;/a&gt;)&lt;/li&gt;
  1698.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/zephyr&quot;&gt;&lt;code&gt;zephyr&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/828867&quot;&gt;#828867&lt;/a&gt; &lt;a href=&quot;https://bugs.debian.org/1021374&quot;&gt;#1021374&lt;/a&gt;)&lt;/li&gt;
  1699.    &lt;/ul&gt;
  1700.  &lt;/li&gt;
  1701.  &lt;li&gt;
  1702.    &lt;p&gt;Vagrant Cascadian:&lt;/p&gt;
  1703.  
  1704.    &lt;ul&gt;
  1705.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/ddd&quot;&gt;&lt;code&gt;ddd&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/834016&quot;&gt;#834016&lt;/a&gt;)&lt;/li&gt;
  1706.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/libpam-ldap&quot;&gt;&lt;code&gt;libpam-ldap&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/834050&quot;&gt;#834050&lt;/a&gt;)&lt;/li&gt;
  1707.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/nsnake/&quot;&gt;&lt;code&gt;nsnake&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/833612&quot;&gt;#833612&lt;/a&gt;)&lt;/li&gt;
  1708.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/quvi&quot;&gt;&lt;code&gt;quvi&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/835259&quot;&gt;#835259&lt;/a&gt;)&lt;/li&gt;
  1709.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/stressapptest&quot;&gt;&lt;code&gt;stressapptest&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/831587&quot;&gt;#831587&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/986653&quot;&gt;#986653&lt;/a&gt;)&lt;/li&gt;
  1710.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/tcpreen&quot;&gt;&lt;code&gt;tcpreen&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/831585&quot;&gt;#831585&lt;/a&gt;)&lt;/li&gt;
  1711.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/boolector&quot;&gt;&lt;code&gt;boolector&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/1023886&quot;&gt;#1023886&lt;/a&gt;)&lt;/li&gt;
  1712.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/tsdecrypt&quot;&gt;&lt;code&gt;tsdecrypt&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/829713&quot;&gt;#829713&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/1022130&quot;&gt;#1022130&lt;/a&gt;)&lt;/li&gt;
  1713.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/wbxml2&quot;&gt;&lt;code&gt;wbxml2&lt;/code&gt;&lt;/a&gt; (QA upload fixed build path issues)&lt;/li&gt;
  1714.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/tercpp&quot;&gt;&lt;code&gt;tercpp&lt;/code&gt;&lt;/a&gt; (QA upload fixed build path issues)&lt;/li&gt;
  1715.    &lt;/ul&gt;
  1716.  &lt;/li&gt;
  1717. &lt;/ul&gt;
  1718.  
  1719. &lt;p&gt;Lastly, Roland Clobus posted his &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-November/002760.html&quot;&gt;latest update of the status of reproducible Debian ISO images&lt;/a&gt; on our mailing list. This reports that ‘all major desktops build reproducibly with &lt;em&gt;bullseye&lt;/em&gt;, &lt;em&gt;bookworm&lt;/em&gt; and &lt;em&gt;sid&lt;/em&gt;’ as well as that no custom patches needed to applied to Debian &lt;em&gt;unstable&lt;/em&gt; for this result to occur. During November, however, Roland &lt;a href=&quot;https://salsa.debian.org/images-team/live-setup/-/merge_requests/2&quot;&gt;proposed some modifications to &lt;em&gt;live-setup&lt;/em&gt;&lt;/a&gt; and the rebuild script has been adjusted to fix the failing Jenkins tests for Debian &lt;em&gt;bullseye&lt;/em&gt; [&lt;a href=&quot;https://salsa.debian.org/live-team/live-build/-/merge_requests/293&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/e237cab3ed87826b1c25b068b88fabcecf020d21&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  1720.  
  1721. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  1722.  
  1723. &lt;p&gt;In other news, &lt;a href=&quot;https://fedoraproject.org/wiki/User:Churchyard&quot;&gt;Miro Hrončok&lt;/a&gt; proposed a change to ‘clamp’ build modification times to the value of &lt;a href=&quot;/docs/source-date-epoch/&quot;&gt;&lt;code&gt;SOURCE_DATE_EPOCH&lt;/code&gt;&lt;/a&gt;. This was &lt;a href=&quot;https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/MWKWFO52KTOGVGOEUDZT7YBOON2G5A2K/&quot;&gt;initially suggested and discussed on a &lt;code&gt;devel@&lt;/code&gt; mailing list post&lt;/a&gt; but was later &lt;a href=&quot;https://fedoraproject.org/wiki/Changes/ReproducibleBuildsClampMtimes&quot;&gt;written up on the Fedora Wiki&lt;/a&gt; as well as being &lt;a href=&quot;https://pagure.io/fesco/issue/2899&quot;&gt;officially proposed to Fedora Engineering Steering Committee (FESCo)&lt;/a&gt;.&lt;/p&gt;
  1724.  
  1725. &lt;hr /&gt;
  1726.  
  1727. &lt;h3 id=&quot;upstream-patches&quot;&gt;Upstream patches&lt;/h3&gt;
  1728.  
  1729. &lt;p&gt;The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where appropriate. This month, we wrote a large number of such patches, including:&lt;/p&gt;
  1730.  
  1731. &lt;ul&gt;
  1732.  &lt;li&gt;
  1733.    &lt;p&gt;Bernhard M. Wiedemann:&lt;/p&gt;
  1734.  
  1735.    &lt;ul&gt;
  1736.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1036953&quot;&gt;&lt;code&gt;dwz&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://en.wikipedia.org/wiki/Profile-guided_optimization&quot;&gt;Profile-guided optimisation&lt;/a&gt; issue)&lt;/li&gt;
  1737.      &lt;li&gt;&lt;a href=&quot;https://gitlab.com/fbb-git/icmake/-/merge_requests/5&quot;&gt;&lt;code&gt;icmake&lt;/code&gt;&lt;/a&gt; (filesystem ordering issue)&lt;/li&gt;
  1738.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1037221&quot;&gt;&lt;code&gt;llmnrd&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;
  1739.      &lt;li&gt;&lt;a href=&quot;https://bugzilla.opensuse.org/show_bug.cgi?id=1205134&quot;&gt;&lt;code&gt;elixir&lt;/code&gt;&lt;/a&gt; (report a bug re. stuck build on single-core VMs)&lt;/li&gt;
  1740.      &lt;li&gt;&lt;a href=&quot;https://github.com/Warzone2100/warzone2100/issues/2991&quot;&gt;&lt;code&gt;warzone2100&lt;/code&gt;&lt;/a&gt; (report a bug re. parallelism-dependent output)&lt;/li&gt;
  1741.    &lt;/ul&gt;
  1742.  &lt;/li&gt;
  1743.  &lt;li&gt;
  1744.    &lt;p&gt;Chris Lamb:&lt;/p&gt;
  1745.  
  1746.    &lt;ul&gt;
  1747.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1023589&quot;&gt;#1023589&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/libnvme&quot;&gt;&lt;code&gt;libnvme&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1748.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024352&quot;&gt;#1024352&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/pykafka&quot;&gt;&lt;code&gt;pykafka&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1749.    &lt;/ul&gt;
  1750.  &lt;/li&gt;
  1751.  &lt;li&gt;
  1752.    &lt;p&gt;Vagrant Cascadian:&lt;/p&gt;
  1753.  
  1754.    &lt;ul&gt;
  1755.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1023886&quot;&gt;#1023886&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/boolector&quot;&gt;&lt;code&gt;boolector&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1756.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1023956&quot;&gt;#1023956&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/fl-cow&quot;&gt;&lt;code&gt;fl-cow&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1757.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1023957&quot;&gt;#1023957&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/gerstensaft&quot;&gt;&lt;code&gt;gerstensaft&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1758.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1023960&quot;&gt;#1023960&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/libcgicc&quot;&gt;&lt;code&gt;libcgicc&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1759.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024007&quot;&gt;#1024007&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/haskell98-report&quot;&gt;&lt;code&gt;haskell98-report&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1760.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024125&quot;&gt;#1024125&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/ucspi-proxy&quot;&gt;&lt;code&gt;ucspi-proxy&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1761.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024126&quot;&gt;#1024126&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/hunt&quot;&gt;&lt;code&gt;hunt&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1762.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024279&quot;&gt;#1024279&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/tolua++&quot;&gt;&lt;code&gt;tolua++&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1763.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024282&quot;&gt;#1024282&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/twoftpd&quot;&gt;&lt;code&gt;twoftpd&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1764.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024283&quot;&gt;#1024283&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/ipsvd&quot;&gt;&lt;code&gt;ipsvd&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1765.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024284&quot;&gt;#1024284&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/gentoo&quot;&gt;&lt;code&gt;gentoo&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1766.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024286&quot;&gt;#1024286&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/lcm&quot;&gt;&lt;code&gt;lcm&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1767.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024288&quot;&gt;#1024288&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/apcupsd&quot;&gt;&lt;code&gt;apcupsd&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1768.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024289&quot;&gt;#1024289&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/openfortivpn&quot;&gt;&lt;code&gt;openfortivpn&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1769.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024290&quot;&gt;#1024290&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/xtb&quot;&gt;&lt;code&gt;xtb&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1770.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024291&quot;&gt;#1024291&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/gnunet&quot;&gt;&lt;code&gt;gnunet&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1771.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024292&quot;&gt;#1024292&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/swift-im&quot;&gt;&lt;code&gt;swift-im&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1772.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024396&quot;&gt;#1024396&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/brewtarget&quot;&gt;&lt;code&gt;brewtarget&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1773.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024399&quot;&gt;#1024399&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/xrprof&quot;&gt;&lt;code&gt;xrprof&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1774.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024404&quot;&gt;#1024404&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/gitlint&quot;&gt;&lt;code&gt;gitlint&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1775.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024412&quot;&gt;#1024412&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/claws-mail&quot;&gt;&lt;code&gt;claws-mail&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1776.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024413&quot;&gt;#1024413&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/presage&quot;&gt;&lt;code&gt;presage&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1777.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024530&quot;&gt;#1024530&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/jh7100-bootloader-recovery&quot;&gt;&lt;code&gt;jh7100-bootloader-recovery&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1778.    &lt;/ul&gt;
  1779.  &lt;/li&gt;
  1780.  &lt;li&gt;
  1781.    &lt;p&gt;Victor Westerhuis:&lt;/p&gt;
  1782.  
  1783.    &lt;ul&gt;
  1784.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1024482&quot;&gt;#1024482&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/1024638&quot;&gt;#1024638&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/opencv&quot;&gt;&lt;code&gt;opencv&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  1785.    &lt;/ul&gt;
  1786.  &lt;/li&gt;
  1787.  &lt;li&gt;
  1788.    &lt;p&gt;John Neffenger:&lt;/p&gt;
  1789.  
  1790.    &lt;ul&gt;
  1791.      &lt;li&gt;&lt;a href=&quot;https://github.com/apache/tomcat/pull/566&quot;&gt;&lt;code&gt;tomcat&lt;/code&gt;&lt;/a&gt; (Fixed Apache bug &lt;a href=&quot;https://bz.apache.org/bugzilla/show_bug.cgi?id=66346&quot;&gt;#66346&lt;/a&gt;)&lt;/li&gt;
  1792.    &lt;/ul&gt;
  1793.  &lt;/li&gt;
  1794. &lt;/ul&gt;
  1795.  
  1796. &lt;hr /&gt;
  1797.  
  1798. &lt;h3 id=&quot;diffoscope&quot;&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;diffoscope&lt;/a&gt;&lt;/h3&gt;
  1799.  
  1800. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;img src=&quot;/images/reports/2022-11/diffoscope.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1801.  
  1802. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;em&gt;diffoscope&lt;/em&gt;&lt;/a&gt; is our in-depth and content-aware diff utility. Not only can it locate and diagnose reproducibility issues, it can provide human-readable diffs from many kinds of binary formats. This month, Chris Lamb prepared and uploaded versions &lt;code&gt;226&lt;/code&gt; and &lt;code&gt;227&lt;/code&gt; to Debian:&lt;/p&gt;
  1803.  
  1804. &lt;ul&gt;
  1805.  &lt;li&gt;Support both &lt;code&gt;python3-progressbar&lt;/code&gt; and &lt;code&gt;python3-progressbar2&lt;/code&gt;, two modules providing the &lt;code&gt;progressbar&lt;/code&gt; Python module. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/81903e0b&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1806.  &lt;li&gt;Don’t run Python decompiling tests on Python bytecode that &lt;code&gt;file(1)&lt;/code&gt; cannot detect yet and Python 3.11 cannot unmarshal. (&lt;a href=&quot;https://bugs.debian.org/1024335&quot;&gt;#1024335&lt;/a&gt;)&lt;/li&gt;
  1807.  &lt;li&gt;Don’t attempt to attach text-only differences notice if there are no differences to begin with. (&lt;a href=&quot;https://bugs.debian.org/1024171&quot;&gt;#1024171&lt;/a&gt;)&lt;/li&gt;
  1808.  &lt;li&gt;Make sure we recommend &lt;code&gt;apksigcopier&lt;/code&gt;. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/792115b9&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1809.  &lt;li&gt;Tidy generation of &lt;code&gt;os_list&lt;/code&gt;. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/f0be250e&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1810.  &lt;li&gt;Make the code clearer around generating the Debian ‘substvars’. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/58fd63c8&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1811.  &lt;li&gt;Use our &lt;code&gt;assert_diff&lt;/code&gt; helper in &lt;code&gt;test_lzip.py&lt;/code&gt;. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/6d3a2779&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1812.  &lt;li&gt;Drop other copyright notices from &lt;code&gt;lzip.py&lt;/code&gt; and &lt;code&gt;test_lzip.py&lt;/code&gt;. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/4a6f0811&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1813. &lt;/ul&gt;
  1814.  
  1815. &lt;p&gt;In addition to this, Christopher Baines added &lt;a href=&quot;https://www.nongnu.org/lzip/&quot;&gt;&lt;em&gt;lzip&lt;/em&gt;&lt;/a&gt; support [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/e1b947b8&quot;&gt;…&lt;/a&gt;], and FC Stegerman added an optimisation whereby we don’t run &lt;code&gt;apktool&lt;/code&gt; if no differences are detected before the signing block [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/1852890a&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  1816.  
  1817. &lt;hr /&gt;
  1818.  
  1819. &lt;p&gt;&lt;a href=&quot;https://reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-11/reproducible-builds.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1820.  
  1821. &lt;p&gt;A significant number of changes were made to the Reproducible Builds website and documentation this month, including Chris Lamb ensuring the &lt;a href=&quot;https://www.openeuler.org/en/&quot;&gt;openEuler&lt;/a&gt; logo is correctly visible with a white background [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/f0251baa&quot;&gt;…&lt;/a&gt;], FC Stegerman de-duplicated by email address to avoid listing some contributors twice [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/fed37547&quot;&gt;…&lt;/a&gt;], Hervé Boutemy added &lt;a href=&quot;https://maven.apache.org/&quot;&gt;Apache Maven&lt;/a&gt; to the &lt;a href=&quot;/who/projects/&quot;&gt;list of affiliated projects&lt;/a&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/5879bed0&quot;&gt;…&lt;/a&gt;] and &lt;em&gt;boyska&lt;/em&gt; updated our &lt;a href=&quot;/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page to remark that the &lt;a href=&quot;https://salsa.debian.org/reproducible-builds/&quot;&gt;Reproducible Builds presence on &lt;em&gt;salsa.debian.org&lt;/em&gt;&lt;/a&gt; is not just the Git repository but is also for creating issues [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/5471f8d8&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/9b4238ad&quot;&gt;…&lt;/a&gt;]. In addition to all this, however, Holger Levsen made the following changes:&lt;/p&gt;
  1822.  
  1823. &lt;ul&gt;
  1824.  &lt;li&gt;Add a number of existing publications [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/6a3972fa&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/82d4570c&quot;&gt;…&lt;/a&gt;] and update metadata for some existing publications as well [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/435e36ec&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  1825.  &lt;li&gt;Hide draft posts on the &lt;a href=&quot;/&quot;&gt;website homepage&lt;/a&gt;. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/684acdce&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1826.  &lt;li&gt;Add the Warpforge build tool as a participating project of the summit. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/6f076241&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1827.  &lt;li&gt;Clarify in the footer that we welcome patches to the website repository. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/7ffc9492&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1828. &lt;/ul&gt;
  1829.  
  1830. &lt;hr /&gt;
  1831.  
  1832. &lt;h3 id=&quot;testing-framework&quot;&gt;Testing framework&lt;/h3&gt;
  1833.  
  1834. &lt;p&gt;&lt;a href=&quot;https://tests.reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-11/testframework.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1835.  
  1836. &lt;p&gt;The Reproducible Builds project operates a comprehensive testing framework at &lt;a href=&quot;https://tests.reproducible-builds.org&quot;&gt;tests.reproducible-builds.org&lt;/a&gt; in order to check packages and other artifacts for reproducibility. In October, the following changes were made by Holger Levsen:&lt;/p&gt;
  1837.  
  1838. &lt;ul&gt;
  1839.  &lt;li&gt;Improve the generation of ‘meta’ package sets (used in grouping packages for reporting/statistical purposes) to treat Debian &lt;em&gt;bookworm&lt;/em&gt; as equivalent to Debian &lt;em&gt;unstable&lt;/em&gt; in this specific case [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/3d3ab211&quot;&gt;…&lt;/a&gt;]
  1840. and to parse the list of packages used in the Debian cloud images [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/7f65008c&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/a62656fa&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/5b079c49&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  1841.  &lt;li&gt;Temporarily allow Frederic to &lt;code&gt;ssh(1)&lt;/code&gt; into our snapshot server as the &lt;code&gt;jenkins&lt;/code&gt; user. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/9f407d14&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1842.  &lt;li&gt;Keep some reproducible jobs Jenkins logs much longer [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/65fd1455&quot;&gt;…&lt;/a&gt;] (&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/7101f5c9&quot;&gt;later reverted&lt;/a&gt;).&lt;/li&gt;
  1843.  &lt;li&gt;Improve the node health checks to detect failures to update the Debian cloud image package set [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/c4d670d2&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/7223af42&quot;&gt;…&lt;/a&gt;] and to improve prioritisation of some kernel warnings [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/2f1cf2e6&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  1844.  &lt;li&gt;Always echo any IRC output to Jenkins’ output as well. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/6589dc83&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1845.  &lt;li&gt;Deal gracefully with problems related to processing the cloud image package set. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/997b8184&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  1846. &lt;/ul&gt;
  1847.  
  1848. &lt;p&gt;Finally, Roland Clobus continued his work on testing Live Debian images, including adding support for specifying the origin of the Debian installer [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/e237cab3&quot;&gt;…&lt;/a&gt;] and to warn when the image has unmet dependencies in the package list (e.g. due to a transition) [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/a9a96757&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  1849.  
  1850. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  1851.  
  1852. &lt;p&gt;If you are interested in contributing to the Reproducible Builds project, please visit our &lt;a href=&quot;https://reproducible-builds.org/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page on our website. You can get in touch with us via:&lt;/p&gt;
  1853.  
  1854. &lt;ul&gt;
  1855.  &lt;li&gt;
  1856.    &lt;p&gt;IRC: &lt;code&gt;#reproducible-builds&lt;/code&gt; on &lt;code&gt;irc.oftc.net&lt;/code&gt;.&lt;/p&gt;
  1857.  &lt;/li&gt;
  1858.  &lt;li&gt;
  1859.    &lt;p&gt;Twitter: &lt;a href=&quot;https://twitter.com/ReproBuilds&quot;&gt;@ReproBuilds&lt;/a&gt;&lt;/p&gt;
  1860.  &lt;/li&gt;
  1861.  &lt;li&gt;
  1862.    &lt;p&gt;Mailing list: &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general&quot;&gt;&lt;code&gt;rb-general@lists.reproducible-builds.org&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;
  1863.  &lt;/li&gt;
  1864. &lt;/ul&gt;
  1865. </description>
  1866.      </item>
  1867.    
  1868.      <item>
  1869.        <title>Reproducible Builds in October 2022</title>
  1870.        <pubDate>Fri, 11 Nov 2022 15:56:14 +0000</pubDate>
  1871.        <link>https://reproducible-builds.org/reports/2022-10/</link>
  1872.        <guid isPermaLink="true">https://reproducible-builds.org/reports/2022-10/</guid>
  1873.        <description>&lt;p&gt;&lt;a href=&quot;https://reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-10/reproducible-builds.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1874.  
  1875. &lt;p&gt;&lt;em&gt;Welcome to the &lt;a href=&quot;https://reproducible-builds.org&quot;&gt;Reproducible Builds&lt;/a&gt; report for October 2022!&lt;/em&gt; In these reports we attempt to outline the most important things that we have been up to over the past month.&lt;/p&gt;
  1876.  
  1877. &lt;p&gt;As ever, if you are interested in contributing to the project, please visit our &lt;a href=&quot;/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page on our website.&lt;/p&gt;
  1878.  
  1879. &lt;hr /&gt;
  1880.  
  1881. &lt;p&gt;&lt;a href=&quot;/events/venice2022/&quot;&gt;&lt;img src=&quot;/images/reports/2022-10/summit_photo.jpg#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1882.  
  1883. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  1884.  
  1885. &lt;p&gt;Our &lt;a href=&quot;/events/venice2022/&quot;&gt;in-person summit this year&lt;/a&gt; was held in the past few days in Venice, Italy. Activity and news from the summit will therefore be covered in next month’s report!&lt;/p&gt;
  1886.  
  1887. &lt;hr /&gt;
  1888.  
  1889. &lt;p&gt;&lt;a href=&quot;https://www.computer.org/csdl/proceedings-article/sp/2023/933600a167/1He7XSTyRKE&quot;&gt;&lt;img src=&quot;/images/reports/2022-10/paper.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1890.  
  1891. &lt;p&gt;A new article related to reproducible builds was recently published in the &lt;a href=&quot;https://www.computer.org/csdl/proceedings/sp/2023/1He7WWuJExG&quot;&gt;2023 IEEE Symposium on Security and Privacy&lt;/a&gt;. Titled &lt;a href=&quot;https://www.computer.org/csdl/proceedings-article/sp/2023/933600a167/1He7XSTyRKE&quot;&gt;&lt;em&gt;Taxonomy of Attacks on Open-Source Software Supply Chains&lt;/em&gt;&lt;/a&gt; and authored by Piergiorgio Ladisa, Henrik Plate, Matias Martinez and Olivier Barais, their paper:&lt;/p&gt;
  1892.  
  1893. &lt;blockquote&gt;
  1894.  &lt;p&gt;[…] proposes a general taxonomy for attacks on opensource supply chains, independent of specific programming languages or ecosystems, and covering all supply chain stages from code contributions to package distribution.&lt;/p&gt;
  1895. &lt;/blockquote&gt;
  1896.  
  1897. &lt;p&gt;Taking the form of an &lt;a href=&quot;https://en.wikipedia.org/wiki/Attack_tree&quot;&gt;attack tree&lt;/a&gt;, the paper covers 107 unique vectors linked to 94 real world supply-chain incidents which is then mapped to 33 mitigating safeguards including, of course, reproducible builds:&lt;/p&gt;
  1898.  
  1899. &lt;blockquote&gt;
  1900.  &lt;p&gt;&lt;em&gt;Reproducible Builds&lt;/em&gt; received a very high utility rating (5) from 10 participants (58.8%), but also a high-cost rating (4 or 5) from 12 (70.6%). One expert commented that a ”reproducible build like used by Solarwinds now, is a good measure against tampering with a single build system” and another claimed this ”is going to be the single, biggest barrier”.&lt;/p&gt;
  1901. &lt;/blockquote&gt;
  1902.  
  1903. &lt;hr /&gt;
  1904.  
  1905. &lt;p&gt;It was noticed this month that Solarwinds &lt;a href=&quot;https://www.solarwinds.com/resources/whitepaper/setting-the-new-standard-in-secure-software-development-the-solarwinds-next-generation-build-system&quot;&gt;published a whitepaper back in December 2021&lt;/a&gt; in order to:&lt;/p&gt;
  1906.  
  1907. &lt;blockquote&gt;
  1908.  &lt;p&gt;[…] illustrate a concerning new reality for the software industry and illuminates the increasingly sophisticated threats made by outside nation-states to the supply chains and infrastructure on which we all rely.&lt;/p&gt;
  1909. &lt;/blockquote&gt;
  1910.  
  1911. &lt;p&gt;The 12-month anniversary of the 2020 “&lt;a href=&quot;https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach&quot;&gt;Solarwinds attack&lt;/a&gt;” (which SolarWinds Worldwide LLC itself calls the “SUNBURST” attack) was, of course, the likely impetus for publication.&lt;/p&gt;
  1912.  
  1913. &lt;hr /&gt;
  1914.  
  1915. &lt;p&gt;Whilst collaborating on &lt;a href=&quot;https://github.com/cyrusimap/cyrus-imapd/issues/3893&quot;&gt;making the Cyrus IMAP server reproducible&lt;/a&gt;, &lt;a href=&quot;https://github.com/elliefm&quot;&gt;Ellie Timoney&lt;/a&gt; asked why the Reproducible Builds testing framework uses two remarkably distinctive build paths when attempting to flush out builds that vary on the absolute system path in which they were built. In the case of the &lt;a href=&quot;https://www.cyrusimap.org/&quot;&gt;Cyrus IMAP server&lt;/a&gt;, these happened to be:&lt;/p&gt;
  1916.  
  1917. &lt;ul&gt;
  1918.  &lt;li&gt;&lt;code&gt;/build/1st/cyrus-imapd-3.6.0~beta3/&lt;/code&gt;&lt;/li&gt;
  1919.  &lt;li&gt;&lt;code&gt;/build/2/cyrus-imapd-3.6.0~beta3/2nd/&lt;/code&gt;&lt;/li&gt;
  1920. &lt;/ul&gt;
  1921.  
  1922. &lt;p&gt;Asked why they vary in three different ways, &lt;a href=&quot;https://github.com/cyrusimap/cyrus-imapd/issues/3893#issuecomment-1279441131&quot;&gt;Chris Lamb listed in detail the motivation behind to each difference&lt;/a&gt;.&lt;/p&gt;
  1923.  
  1924. &lt;hr /&gt;
  1925.  
  1926. &lt;p&gt;On &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general/&quot;&gt;our mailing list&lt;/a&gt; this month:&lt;/p&gt;
  1927.  
  1928. &lt;ul&gt;
  1929.  &lt;li&gt;
  1930.    &lt;p&gt;Daniel Garcia from &lt;a href=&quot;https://walletscrutiny.com/&quot;&gt;WalletScrutiny.com&lt;/a&gt; started a thread asking for &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-October/002703.html&quot;&gt;input on buttons with the Reproducible Builds logo&lt;/a&gt;, requesting design suggestions or other feedback. [&lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-October/002703.html&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  1931.  &lt;/li&gt;
  1932.  &lt;li&gt;
  1933.    &lt;p&gt;&lt;a href=&quot;https://archlinux.org/&quot;&gt;Arch Linux&lt;/a&gt; contributor &lt;em&gt;kpcyrd&lt;/em&gt; wrote to our list this month with the news that “multiple people in Arch Linux noticed the output of our &lt;code&gt;git archive&lt;/code&gt; command doesn’t match the tarball served by &lt;a href=&quot;https://github.com/&quot;&gt;GitHub&lt;/a&gt; anymore. &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-October/002709.html&quot;&gt;In his post&lt;/a&gt;, &lt;em&gt;kpcyrd&lt;/em&gt; narrows the change to a &lt;a href=&quot;https://github.com/git/git/commit/4f4be00d302bc52d0d9d5a3d4738bb525066c710&quot;&gt;specific commit in Git&lt;/a&gt;. [&lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-October/002709.html&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  1934.  &lt;/li&gt;
  1935.  &lt;li&gt;
  1936.    &lt;p&gt;Akihiro Suda wrote to a share a new tool called &lt;a href=&quot;https://github.com/reproducible-containers/repro-get&quot;&gt;&lt;code&gt;repro-get&lt;/code&gt;&lt;/a&gt;. According to &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-October/002716.html&quot;&gt;Akihiro’s post&lt;/a&gt;, “repro-get is a tool to install a specific snapshot of apt/dnf/apk/pacman packages using SHA256SUMS files”. This is needed in order to install specific (or “pinned”) dependencies needed to validate a build.&lt;/p&gt;
  1937.  &lt;/li&gt;
  1938.  &lt;li&gt;
  1939.    &lt;p&gt;Finally, Janneke Nieuwenhuizen &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-October/002708.html&quot;&gt;announced the release of GNU Mes 0.24.1&lt;/a&gt;, which represents 23 commits over five months by four people. &lt;a href=&quot;https://www.gnu.org/software/mes/&quot;&gt;GNU Mes&lt;/a&gt; is a Scheme interpreter and C compiler for bootstrapping the GNU System. [&lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-October/002708.html&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  1940.  &lt;/li&gt;
  1941. &lt;/ul&gt;
  1942.  
  1943. &lt;hr /&gt;
  1944.  
  1945. &lt;p&gt;&lt;a href=&quot;https://www.openeuler.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-10/openEuler.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1946.  
  1947. &lt;p&gt;The Reproducible Builds project is delighted to welcome &lt;a href=&quot;https://www.openeuler.org/&quot;&gt;openEuler&lt;/a&gt; to the &lt;a href=&quot;/who/projects/&quot;&gt;&lt;em&gt;Involved projects&lt;/em&gt;&lt;/a&gt; page [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/bfc7b803&quot;&gt;…&lt;/a&gt;]. openEuler is Linux distribution developed by &lt;a href=&quot;https://www.huawei.com/&quot;&gt;Huawei&lt;/a&gt;, a counterpart to it’s more commercially-oriented &lt;a href=&quot;https://developer.huaweicloud.com/ict/en/site-euleros/euleros&quot;&gt;EulerOS&lt;/a&gt;.&lt;/p&gt;
  1948.  
  1949. &lt;hr /&gt;
  1950.  
  1951. &lt;h3 id=&quot;debian&quot;&gt;Debian&lt;/h3&gt;
  1952.  
  1953. &lt;p&gt;&lt;a href=&quot;https://debian.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-10/debian.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  1954.  
  1955. &lt;p&gt;&lt;a href=&quot;https://www.chiark.greenend.org.uk/~cjwatson/&quot;&gt;Colin Watson&lt;/a&gt; wrote about his experience towards making the databases generated by the &lt;code&gt;man-db&lt;/code&gt; UNIX manual page indexing tool:&lt;/p&gt;
  1956.  
  1957. &lt;blockquote&gt;
  1958.  &lt;p&gt;One of the people working on [reproducible builds] &lt;a href=&quot;https://bugs.debian.org/1010957&quot;&gt;noticed&lt;/a&gt; that man-db’s database files were an obstacle to [reproducibility]: in particular, the exact contents of the database seemed to depend on the order in which files were scanned when building it. The reporter proposed solving this by processing files in sorted order, but I wasn’t keen on that approach: firstly because it would mean we could no longer process files in an order that makes it more efficient to read them all from disk (still valuable on rotational disks), but mostly because the differences seemed to point to other bugs.&lt;/p&gt;
  1959. &lt;/blockquote&gt;
  1960.  
  1961. &lt;p&gt;Colin goes on to describe his approach to solving the problem, including fixing various fits of internal caching, and he ends his post with “None of this is particularly glamorous work, but it paid off”.&lt;/p&gt;
  1962.  
  1963. &lt;hr /&gt;
  1964.  
  1965. &lt;p&gt;Vagrant Cascadian announced on &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/&quot;&gt;our mailing list&lt;/a&gt; another online sprint to help “clear the huge backlog of reproducible builds patches submitted” by performing NMUs (&lt;a href=&quot;https://wiki.debian.org/NonMaintainerUpload&quot;&gt;Non-Maintainer Uploads&lt;/a&gt;). The first such sprint took place on September 22nd, but another was held on October 6th, and another small one on October 20th. This resulted in the following progress:&lt;/p&gt;
  1966.  
  1967. &lt;ul&gt;
  1968.  &lt;li&gt;
  1969.    &lt;p&gt;Chris Lamb:&lt;/p&gt;
  1970.  
  1971.    &lt;ul&gt;
  1972.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/ascii2binary&quot;&gt;&lt;code&gt;ascii2binary&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/1020812&quot;&gt;#1020812&lt;/a&gt;, &lt;a href=&quot;https://bugs.debian.org/998758&quot;&gt;#998758&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/1007421&quot;&gt;#1007421&lt;/a&gt;)&lt;/li&gt;
  1973.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/bibclean&quot;&gt;&lt;code&gt;bibclean&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/829754&quot;&gt;#829754&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/929036&quot;&gt;#929036&lt;/a&gt;)&lt;/li&gt;
  1974.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/dradio&quot;&gt;&lt;code&gt;dradio&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/1020814&quot;&gt;#1020814&lt;/a&gt;)&lt;/li&gt;
  1975.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/leave&quot;&gt;&lt;code&gt;leave&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/777403&quot;&gt;#777403&lt;/a&gt;, &lt;a href=&quot;https://bugs.debian.org/967002&quot;&gt;#967002&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/999259&quot;&gt;#999259&lt;/a&gt;)&lt;/li&gt;
  1976.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/libimage-imlib2-perl&quot;&gt;&lt;code&gt;libimage-imlib2-perl&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/1020665&quot;&gt;#1020665&lt;/a&gt;)&lt;/li&gt;
  1977.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/mailto&quot;&gt;&lt;code&gt;mailto&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/998978&quot;&gt;#998978&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/777413&quot;&gt;#777413&lt;/a&gt;)&lt;/li&gt;
  1978.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/remote-tty&quot;&gt;&lt;code&gt;remote-tty&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/829721&quot;&gt;#829721&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/977280&quot;&gt;#977280&lt;/a&gt;)&lt;/li&gt;
  1979.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/xcolmix&quot;&gt;&lt;code&gt;xcolmix&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/1020748&quot;&gt;#1020748&lt;/a&gt;, &lt;a href=&quot;https://bugs.debian.org/999219&quot;&gt;#999219&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/988018&quot;&gt;#988018&lt;/a&gt;)&lt;/li&gt;
  1980.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/z80asm&quot;&gt;&lt;code&gt;z80asm&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/939775&quot;&gt;#939775&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/1020875&quot;&gt;#1020875&lt;/a&gt;)&lt;/li&gt;
  1981.    &lt;/ul&gt;
  1982.  &lt;/li&gt;
  1983.  &lt;li&gt;
  1984.    &lt;p&gt;Holger Levsen:&lt;/p&gt;
  1985.  
  1986.    &lt;ul&gt;
  1987.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/libtheora&quot;&gt;&lt;code&gt;libtheora&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/990843&quot;&gt;#990843&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/990844&quot;&gt;#990844&lt;/a&gt;)&lt;/li&gt;
  1988.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/sgml-base&quot;&gt;&lt;code&gt;sgml-base&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/1006646&quot;&gt;#1006646&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/929706&quot;&gt;#929706&lt;/a&gt;)&lt;/li&gt;
  1989.    &lt;/ul&gt;
  1990.  &lt;/li&gt;
  1991.  &lt;li&gt;
  1992.    &lt;p&gt;Vagrant Cascadian:&lt;/p&gt;
  1993.  
  1994.    &lt;ul&gt;
  1995.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/ario&quot;&gt;&lt;code&gt;ario&lt;/code&gt;&lt;/a&gt; (Investigated &lt;a href=&quot;https://bugs.debian.org/828876&quot;&gt;#828876&lt;/a&gt;)&lt;/li&gt;
  1996.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/cloop&quot;&gt;&lt;code&gt;cloop&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/787996&quot;&gt;#787996&lt;/a&gt;)&lt;/li&gt;
  1997.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/elvis-tiny&quot;&gt;&lt;code&gt;elvis-tiny&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/829755&quot;&gt;#829755&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/901345&quot;&gt;#901345&lt;/a&gt;)&lt;/li&gt;
  1998.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/hannah&quot;&gt;&lt;code&gt;hannah&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/845782&quot;&gt;#845782&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/901260&quot;&gt;#901260&lt;/a&gt;)&lt;/li&gt;
  1999.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/mc&quot;&gt;&lt;code&gt;mc&lt;/code&gt;&lt;/a&gt; (Investigated &lt;a href=&quot;https://bugs.debian.org/828683&quot;&gt;#828683&lt;/a&gt;)&lt;/li&gt;
  2000.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/mod-dnssd&quot;&gt;&lt;code&gt;mod-dnssd&lt;/code&gt;&lt;/a&gt; (Submitted alternate fix for &lt;a href=&quot;https://bugs.debian.org/828752&quot;&gt;#828752&lt;/a&gt;)&lt;/li&gt;
  2001.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/snake4&quot;&gt;&lt;code&gt;snake4&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/829715&quot;&gt;#829715&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/913734&quot;&gt;#913734&lt;/a&gt;)&lt;/li&gt;
  2002.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/the&quot;&gt;&lt;code&gt;the&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/842550&quot;&gt;#842550&lt;/a&gt;)&lt;/li&gt;
  2003.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/zephyr&quot;&gt;&lt;code&gt;zephyr&lt;/code&gt;&lt;/a&gt; (Investigated &lt;a href=&quot;https://bugs.debian.org/828867&quot;&gt;#828867&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/1021374&quot;&gt;#1021374&lt;/a&gt;)&lt;/li&gt;
  2004.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/msp430mcu&quot;&gt;&lt;code&gt;msp430mcu&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/860275&quot;&gt;#860275&lt;/a&gt;)&lt;/li&gt;
  2005.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/checkpw&quot;&gt;&lt;code&gt;checkpw&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/777299&quot;&gt;#777299&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/1020887&quot;&gt;#1020887&lt;/a&gt;)&lt;/li&gt;
  2006.      &lt;li&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/madlib&quot;&gt;&lt;code&gt;madlib&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.debian.org/778946&quot;&gt;#778946&lt;/a&gt;)&lt;/li&gt;
  2007.    &lt;/ul&gt;
  2008.  &lt;/li&gt;
  2009. &lt;/ul&gt;
  2010.  
  2011. &lt;hr /&gt;
  2012.  
  2013. &lt;p&gt;41 reviews of Debian packages were added, 62 were updated and 12 were removed this month adding to &lt;a href=&quot;https://tests.reproducible-builds.org/debian/index_issues.html&quot;&gt;our knowledge about identified issues&lt;/a&gt;. A number of issue types were updated too. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/c3feb10e&quot;&gt;1&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/518f83f0&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  2014.  
  2015. &lt;hr /&gt;
  2016.  
  2017. &lt;p&gt;Lastly, Luca Boccassi &lt;a href=&quot;https://salsa.debian.org/debian/debhelper/-/merge_requests/93&quot;&gt;submitted a patch&lt;/a&gt; to &lt;code&gt;debhelper&lt;/code&gt;, a set of tools used in the packaging of the majority of Debian packages. The patch addressed an issue in the &lt;code&gt;dh_installsysusers&lt;/code&gt; utility so that the &lt;code&gt;postinst&lt;/code&gt; post-installation script that &lt;code&gt;debhelper&lt;/code&gt; generates the same data regardless of the underlying filesystem ordering.&lt;/p&gt;
  2018.  
  2019. &lt;hr /&gt;
  2020.  
  2021. &lt;h3 id=&quot;other-distributions&quot;&gt;Other distributions&lt;/h3&gt;
  2022.  
  2023. &lt;p&gt;&lt;a href=&quot;https://www.f-droid.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-10/fdroid.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2024.  
  2025. &lt;p&gt;&lt;a href=&quot;https://f-droid.org/&quot;&gt;F-Droid&lt;/a&gt; is a community-run app store that provides free software applications for Android phones. This month, F-Droid changed their documentation and guidance to now explicitly encourage RB for new apps [&lt;a href=&quot;https://gitlab.com/fdroid/fdroiddata/-/merge_requests/12002&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://gitlab.com/fdroid/fdroiddata/-/issues/2816&quot;&gt;…&lt;/a&gt;], and FC Stegerman created an &lt;a href=&quot;https://gitlab.com/fdroid/fdroidserver/-/issues/1056&quot;&gt;extremely in-depth issue on GitLab&lt;/a&gt; concerning the &lt;a href=&quot;https://source.android.com/docs/security/features/apksigning/v2&quot;&gt;APK signing block&lt;/a&gt;. You can read more about F-Droid’s approach to reproducibility in &lt;a href=&quot;/news/2022/06/24/supporter-spotlight-hans-christoph-steiner-f-droid-project/&quot;&gt;our July 2022 interview with Hans-Christoph Steiner of the F-Droid Project&lt;/a&gt;.&lt;/p&gt;
  2026.  
  2027. &lt;p&gt;In openSUSE, Bernhard M. Wiedemann published his usual &lt;a href=&quot;https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/GFJP5HGSAPHJ4S63D3PYQJ237EDCMBXQ/&quot;&gt;openSUSE monthly report&lt;/a&gt;.&lt;/p&gt;
  2028.  
  2029. &lt;hr /&gt;
  2030.  
  2031. &lt;h3 id=&quot;upstream-patches&quot;&gt;Upstream patches&lt;/h3&gt;
  2032.  
  2033. &lt;p&gt;The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where appropriate. This month, we wrote a large number of such patches, including:&lt;/p&gt;
  2034.  
  2035. &lt;ul&gt;
  2036.  &lt;li&gt;
  2037.    &lt;p&gt;Bernhard M. Wiedemann:&lt;/p&gt;
  2038.  
  2039.    &lt;ul&gt;
  2040.      &lt;li&gt;&lt;a href=&quot;https://github.com/vectorgraphics/asymptote/pull/351&quot;&gt;&lt;code&gt;asymptote&lt;/code&gt;&lt;/a&gt; (date-related issue)&lt;/li&gt;
  2041.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1010423&quot;&gt;&lt;code&gt;fastjet-contrib&lt;/code&gt;&lt;/a&gt; (sort nondeterminstic filesystem ordering)&lt;/li&gt;
  2042.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1009599&quot;&gt;&lt;code&gt;forge&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://www.sphinx-doc.org/&quot;&gt;Sphinx&lt;/a&gt; “doctree” issue)&lt;/li&gt;
  2043.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1009603&quot;&gt;&lt;code&gt;gau2grid&lt;/code&gt;&lt;/a&gt; (output varies with &lt;code&gt;march=native&lt;/code&gt;)&lt;/li&gt;
  2044.      &lt;li&gt;&lt;a href=&quot;https://github.com/securego/gosec/pull/887&quot;&gt;&lt;code&gt;gosec&lt;/code&gt;&lt;/a&gt; (date-related issue)&lt;/li&gt;
  2045.      &lt;li&gt;&lt;a href=&quot;https://github.com/helmfile/helmfile/pull/486&quot;&gt;&lt;code&gt;helmfile&lt;/code&gt;&lt;/a&gt; (date-related issue)&lt;/li&gt;
  2046.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1032570&quot;&gt;&lt;code&gt;libnvme&lt;/code&gt;&lt;/a&gt; (date-related issue)&lt;/li&gt;
  2047.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1008583&quot;&gt;&lt;code&gt;moab&lt;/code&gt;&lt;/a&gt; (CPU)&lt;/li&gt;
  2048.      &lt;li&gt;&lt;a href=&quot;https://bugzilla.opensuse.org/show_bug.cgi?id=1203982&quot;&gt;&lt;code&gt;tcl&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  2049.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1032506&quot;&gt;&lt;code&gt;vectorscan&lt;/code&gt;&lt;/a&gt; (output varies with &lt;code&gt;march=native&lt;/code&gt;)&lt;/li&gt;
  2050.      &lt;li&gt;&lt;a href=&quot;https://github.com/alexcrichton/xz2-rs/issues/100&quot;&gt;&lt;code&gt;xz2/lzma&lt;/code&gt;&lt;/a&gt; (Rust-related filesystem ordering)&lt;/li&gt;
  2051.    &lt;/ul&gt;
  2052.  &lt;/li&gt;
  2053.  &lt;li&gt;
  2054.    &lt;p&gt;Chris Lamb:&lt;/p&gt;
  2055.  
  2056.    &lt;ul&gt;
  2057.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/891263&quot;&gt;#891263&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/puppet&quot;&gt;&lt;code&gt;puppet&lt;/code&gt;&lt;/a&gt; back in early 2018 was &lt;a href=&quot;https://github.com/puppetlabs/puppet/pull/8916#issuecomment-1265615317&quot;&gt;finally merged into Puppet&lt;/a&gt; and was released in &lt;a href=&quot;https://puppet.com/docs/puppet/7/puppet_index.html&quot;&gt;Puppet 7.20.0&lt;/a&gt;.&lt;/li&gt;
  2058.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021198&quot;&gt;#1021198&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/puppet-agent&quot;&gt;&lt;code&gt;puppet-agent&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2059.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1022777&quot;&gt;#1022777&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/tpm2-pytss&quot;&gt;&lt;code&gt;tpm2-pytss&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://github.com/tpm2-software/tpm2-pytss/pull/376&quot;&gt;forwarded upstream&lt;/a&gt;).&lt;/li&gt;
  2060.    &lt;/ul&gt;
  2061.  &lt;/li&gt;
  2062.  &lt;li&gt;
  2063.    &lt;p&gt;Vagrant Cascadian:&lt;/p&gt;
  2064.  
  2065.    &lt;ul&gt;
  2066.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021331&quot;&gt;#1021331&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/cclive&quot;&gt;&lt;code&gt;cclive&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2067.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021373&quot;&gt;#1021373&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/librep&quot;&gt;&lt;code&gt;librep&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2068.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021374&quot;&gt;#1021374&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/zephyr&quot;&gt;&lt;code&gt;zephyr&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2069.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021452&quot;&gt;#1021452&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/libdv&quot;&gt;&lt;code&gt;libdv&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2070.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021454&quot;&gt;#1021454&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/dbview&quot;&gt;&lt;code&gt;dbview&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2071.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021456&quot;&gt;#1021456&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/bwbasic&quot;&gt;&lt;code&gt;bwbasic&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2072.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021457&quot;&gt;#1021457&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/olpc-powerd&quot;&gt;&lt;code&gt;olpc-powerd&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2073.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021458&quot;&gt;#1021458&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/o3dgc&quot;&gt;&lt;code&gt;o3dgc&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2074.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021461&quot;&gt;#1021461&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/icon&quot;&gt;&lt;code&gt;icon&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2075.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021463&quot;&gt;#1021463&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/rdist&quot;&gt;&lt;code&gt;rdist&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2076.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021464&quot;&gt;#1021464&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/stfl&quot;&gt;&lt;code&gt;stfl&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2077.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021466&quot;&gt;#1021466&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/pacman&quot;&gt;&lt;code&gt;pacman&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2078.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021469&quot;&gt;#1021469&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/lam&quot;&gt;&lt;code&gt;lam&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2079.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021470&quot;&gt;#1021470&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/xsok&quot;&gt;&lt;code&gt;xsok&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2080.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021471&quot;&gt;#1021471&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/python-djvulibre&quot;&gt;&lt;code&gt;python-djvulibre&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2081.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021472&quot;&gt;#1021472&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/xzoom&quot;&gt;&lt;code&gt;xzoom&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2082.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021473&quot;&gt;#1021473&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/nitpic&quot;&gt;&lt;code&gt;nitpic&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2083.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021498&quot;&gt;#1021498&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/tcm&quot;&gt;&lt;code&gt;tcm&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2084.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021509&quot;&gt;#1021509&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/xxkb&quot;&gt;&lt;code&gt;xxkb&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2085.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021512&quot;&gt;#1021512&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/yersinia&quot;&gt;&lt;code&gt;yersinia&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2086.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021513&quot;&gt;#1021513&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/centrifuge&quot;&gt;&lt;code&gt;centrifuge&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2087.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021514&quot;&gt;#1021514&lt;/a&gt; and &lt;a href=&quot;https://bugs.debian.org/1021516&quot;&gt;#1021516&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/ssocr&quot;&gt;&lt;code&gt;ssocr&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2088.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021518&quot;&gt;#1021518&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/jakarta-jmeter&quot;&gt;&lt;code&gt;jakarta-jmeter&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2089.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021520&quot;&gt;#1021520&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/guymager&quot;&gt;&lt;code&gt;guymager&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2090.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021521&quot;&gt;#1021521&lt;/a&gt; and &lt;a href=&quot;https://bugs.debian.org/1021522&quot;&gt;#1021522&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/crack&quot;&gt;&lt;code&gt;crack&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2091.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021751&quot;&gt;#1021751&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/dc3dd&quot;&gt;&lt;code&gt;dc3dd&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2092.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021789&quot;&gt;#1021789&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/dlt-viewer&quot;&gt;&lt;code&gt;dlt-viewer&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2093.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021792&quot;&gt;#1021792&lt;/a&gt; and &lt;a href=&quot;https://bugs.debian.org/1021793&quot;&gt;#1021793&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/vart&quot;&gt;&lt;code&gt;vart&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2094.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021799&quot;&gt;#1021799&lt;/a&gt; and &lt;a href=&quot;https://bugs.debian.org/1021800&quot;&gt;#1021800&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/pgrouting&quot;&gt;&lt;code&gt;pgrouting&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2095.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021860&quot;&gt;#1021860&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/libsx&quot;&gt;&lt;code&gt;libsx&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2096.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1021893&quot;&gt;#1021893&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/device-tree-compiler&quot;&gt;&lt;code&gt;device-tree-compiler&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2097.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1022130&quot;&gt;#1022130&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/tsdecrypt&quot;&gt;&lt;code&gt;tsdecrypt&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2098.    &lt;/ul&gt;
  2099.  &lt;/li&gt;
  2100.  &lt;li&gt;
  2101.    &lt;p&gt;John Neffenger:&lt;/p&gt;
  2102.  
  2103.    &lt;ul&gt;
  2104.      &lt;li&gt;&lt;a href=&quot;https://github.com/openjdk/jdk/pull/10070&quot;&gt;&lt;code&gt;openjdk&lt;/code&gt;&lt;/a&gt; (Fixed &lt;a href=&quot;https://bugs.openjdk.org/browse/JDK-8292892&quot;&gt;JDK-8292892&lt;/a&gt;)&lt;/li&gt;
  2105.    &lt;/ul&gt;
  2106.  &lt;/li&gt;
  2107. &lt;/ul&gt;
  2108.  
  2109. &lt;h3 id=&quot;diffoscope&quot;&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;diffoscope&lt;/a&gt;&lt;/h3&gt;
  2110.  
  2111. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;img src=&quot;/images/reports/2022-10/diffoscope.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2112.  
  2113. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;em&gt;diffoscope&lt;/em&gt;&lt;/a&gt; is our in-depth and content-aware diff utility. Not only can it locate and diagnose reproducibility issues, it can provide human-readable diffs from many kinds of binary formats. This month, Chris Lamb prepared and uploaded versions &lt;code&gt;224&lt;/code&gt; and &lt;code&gt;225&lt;/code&gt; to Debian:&lt;/p&gt;
  2114.  
  2115. &lt;ul&gt;
  2116.  &lt;li&gt;Add support for comparing the text content of HTML files using &lt;a href=&quot;https://alir3z4.github.io/html2text/&quot;&gt;&lt;code&gt;html2text&lt;/code&gt;&lt;/a&gt;. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/d647eb75&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2117.  &lt;li&gt;Add support for detecting ordering-only differences in XML files. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/dbf5350f&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2118.  &lt;li&gt;Fix an issue with detecting ordering differences. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/727b3c9e&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2119.  &lt;li&gt;Use the capitalised version of “Ordering” consistently everywhere in output. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/844e00c7&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2120.  &lt;li&gt;Add support for displaying font metadata using &lt;a href=&quot;https://fonttools.readthedocs.io/en/latest/ttx.html&quot;&gt;&lt;code&gt;ttx(1)&lt;/code&gt;&lt;/a&gt; from the &lt;a href=&quot;https://fonttools.readthedocs.io/en/latest/index.html&quot;&gt;&lt;em&gt;fonttools&lt;/em&gt;&lt;/a&gt; suite. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/fe8326a8&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2121.  &lt;li&gt;
  2122.    &lt;p&gt;Testsuite improvements:&lt;/p&gt;
  2123.  
  2124.    &lt;ul&gt;
  2125.      &lt;li&gt;Temporarily allow the &lt;code&gt;stable-po&lt;/code&gt; pipeline to fail in the CI. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/ac2eb11f&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2126.      &lt;li&gt;Rename the &lt;code&gt;order1.diff&lt;/code&gt; test fixture to &lt;code&gt;json_expected_ordering_diff&lt;/code&gt;. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/1bb51831&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2127.      &lt;li&gt;Tidy the JSON tests. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/7f0407a1&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2128.      &lt;li&gt;Use &lt;code&gt;assert_diff&lt;/code&gt; over &lt;code&gt;get_data&lt;/code&gt; and an manual assert within the XML tests. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/a6a0f90b&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2129.      &lt;li&gt;Drop the &lt;code&gt;ALLOWED_TEST_FILES&lt;/code&gt; test; it was mostly just annoying. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/7b7d28f0&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2130.      &lt;li&gt;Tidy the &lt;code&gt;tests/test_source.py&lt;/code&gt; file. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/06fd0c79&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2131.    &lt;/ul&gt;
  2132.  &lt;/li&gt;
  2133. &lt;/ul&gt;
  2134.  
  2135. &lt;p&gt;Chris Lamb also added a link to diffoscope’s &lt;a href=&quot;https://www.openbsd.org/&quot;&gt;OpenBSD&lt;/a&gt; packaging on the &lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;em&gt;diffoscope.org&lt;/em&gt;&lt;/a&gt; homepage [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope-website/commit/cb122aa&quot;&gt;…&lt;/a&gt;] and Mattia Rizzolo fix an test failure that was occurring under with &lt;a href=&quot;https://llvm.org/&quot;&gt;LLVM&lt;/a&gt; 15 [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/154ad453&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  2136.  
  2137. &lt;h3 id=&quot;testing-framework&quot;&gt;Testing framework&lt;/h3&gt;
  2138.  
  2139. &lt;p&gt;&lt;a href=&quot;https://tests.reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-10/testframework.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2140.  
  2141. &lt;p&gt;The Reproducible Builds project operates a comprehensive testing framework at &lt;a href=&quot;https://tests.reproducible-builds.org&quot;&gt;tests.reproducible-builds.org&lt;/a&gt; in order to check packages and other artifacts for reproducibility. In October, the following changes were made by Holger Levsen:&lt;/p&gt;
  2142.  
  2143. &lt;ul&gt;
  2144.  &lt;li&gt;Run the &lt;code&gt;logparse&lt;/code&gt; tool to analyse results on the &lt;a href=&quot;https://wiki.debian.org/DebianEdu/&quot;&gt;Debian Edu&lt;/a&gt; build logs. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/db3efa21&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2145.  &lt;li&gt;Install &lt;code&gt;btop(1)&lt;/code&gt; on all nodes running Debian. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/5e33a32a&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2146.  &lt;li&gt;Switch Arch Linux from using SHA1 to SHA256. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/470e8e8d&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2147.  &lt;li&gt;When checking Debian &lt;code&gt;debstrap&lt;/code&gt; jobs, correctly log the tool usage. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/5efaac25&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2148.  &lt;li&gt;Cleanup more task-related temporary directory names when testing Debian packages. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/53e3f678&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/7ed09046&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2149.  &lt;li&gt;Use the &lt;code&gt;cdebootstrap-static&lt;/code&gt; binary for the 2nd runs of the &lt;code&gt;cdebootstrap&lt;/code&gt; tests. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/b6cf19d5&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2150.  &lt;li&gt;Drop &lt;a href=&quot;https://bugs.debian.org/1020630&quot;&gt;a workaround&lt;/a&gt; when testing OpenWrt and coreboot as the issue in &lt;em&gt;diffoscope&lt;/em&gt; has now been fixed. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/b048e50b&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2151.  &lt;li&gt;Turn on an &lt;code&gt;rm(1)&lt;/code&gt; warning into an “info”-level message. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/8e2e8aa7&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2152.  &lt;li&gt;Special case the &lt;code&gt;osuosl168&lt;/code&gt; node for running Debian &lt;em&gt;bookworm&lt;/em&gt; already. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/5db24ae9&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/889afec3&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2153.  &lt;li&gt;Use the new &lt;code&gt;non-free-firmware&lt;/code&gt; suite on the &lt;code&gt;o168&lt;/code&gt; node. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/0d75fe0e&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2154. &lt;/ul&gt;
  2155.  
  2156. &lt;p&gt;In addition, Mattia Rizzolo made the following changes:&lt;/p&gt;
  2157.  
  2158. &lt;ul&gt;
  2159.  &lt;li&gt;Ensure that 2nd build has a merged &lt;code&gt;/usr&lt;/code&gt;. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/1bd43360&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2160.  &lt;li&gt;Only reconfigure the &lt;code&gt;usrmerge&lt;/code&gt; package on Debian &lt;em&gt;bookworm&lt;/em&gt; and above. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/474a47c3&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2161.  &lt;li&gt;Fix &lt;code&gt;bc(1)&lt;/code&gt; syntax in the computation of the percentage of unreproducible packages in the dashboard. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/b410b49e&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/25691e9e&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/b153a66d&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2162.  &lt;li&gt;In the &lt;code&gt;index_suite_&lt;/code&gt; pages, order the package status to be the same order of the menu. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/fbcab7bf&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2163.  &lt;li&gt;Pass the &lt;code&gt;--distribution&lt;/code&gt; parameter to the &lt;code&gt;pbuilder&lt;/code&gt; utility. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/dc5a5284&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2164. &lt;/ul&gt;
  2165.  
  2166. &lt;p&gt;Finally, Roland Clobus continued his work on testing Live Debian images. In particular, he extended the maintenance script to warn when workspace directories cannot be deleted. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/299812ee&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  2167.  
  2168. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  2169.  
  2170. &lt;p&gt;If you are interested in contributing to the Reproducible Builds project, please visit our &lt;a href=&quot;https://reproducible-builds.org/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page on our website. However, you can get in touch with us via:&lt;/p&gt;
  2171.  
  2172. &lt;ul&gt;
  2173.  &lt;li&gt;
  2174.    &lt;p&gt;IRC: &lt;code&gt;#reproducible-builds&lt;/code&gt; on &lt;code&gt;irc.oftc.net&lt;/code&gt;.&lt;/p&gt;
  2175.  &lt;/li&gt;
  2176.  &lt;li&gt;
  2177.    &lt;p&gt;Twitter: &lt;a href=&quot;https://twitter.com/ReproBuilds&quot;&gt;@ReproBuilds&lt;/a&gt;&lt;/p&gt;
  2178.  &lt;/li&gt;
  2179.  &lt;li&gt;
  2180.    &lt;p&gt;Mailing list: &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general&quot;&gt;&lt;code&gt;rb-general@lists.reproducible-builds.org&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;
  2181.  &lt;/li&gt;
  2182. &lt;/ul&gt;
  2183. </description>
  2184.      </item>
  2185.    
  2186.      <item>
  2187.        <title>Reproducible Builds in September 2022</title>
  2188.        <pubDate>Fri, 07 Oct 2022 21:25:12 +0000</pubDate>
  2189.        <link>https://reproducible-builds.org/reports/2022-09/</link>
  2190.        <guid isPermaLink="true">https://reproducible-builds.org/reports/2022-09/</guid>
  2191.        <description>&lt;p&gt;&lt;a href=&quot;https://reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-09/reproducible-builds.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2192.  
  2193. &lt;p&gt;Welcome to the September 2022 report from the &lt;a href=&quot;/&quot;&gt;Reproducible Builds&lt;/a&gt; project! In our reports we try to outline the most important things that we have been up to over the past month. As a quick recap, whilst anyone may inspect the source code of free software for malicious flaws, almost all software is distributed to end users as pre-compiled binaries. If you are interested in contributing to the project, please visit our &lt;a href=&quot;/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page on our website.&lt;/p&gt;
  2194.  
  2195. &lt;hr /&gt;
  2196.  
  2197. &lt;p&gt;&lt;a href=&quot;https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3146465/nsa-cisa-odni-release-software-supply-chain-guidance-for-developers/&quot;&gt;&lt;img src=&quot;/images/reports/2022-09/nsa.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2198.  
  2199. &lt;p&gt;David A. Wheeler reported to us that the US National Security Agency (&lt;a href=&quot;https://en.wikipedia.org/wiki/National_Security_Agency&quot;&gt;NSA&lt;/a&gt;), Cybersecurity and Infrastructure Security Agency (&lt;a href=&quot;https://en.wikipedia.org/wiki/Cybersecurity_and_Infrastructure_Security_Agency&quot;&gt;CISA&lt;/a&gt;) and the Office of the Director of National Intelligence (&lt;a href=&quot;https://en.wikipedia.org/wiki/Director_of_National_Intelligence&quot;&gt;ODNI&lt;/a&gt;) have released a document called &lt;a href=&quot;https://media.defense.gov/2022/Sep/01/2003068942/-1/-1/0/ESF_SECURING_THE_SOFTWARE_SUPPLY_CHAIN_DEVELOPERS.PDF&quot;&gt;&lt;em&gt;Securing the Software Supply Chain: Recommended Practices Guide for Developers&lt;/em&gt;&lt;/a&gt; (PDF).&lt;/p&gt;
  2200.  
  2201. &lt;p&gt;As David &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-September/002684.html&quot;&gt;remarked in his post to our mailing list&lt;/a&gt;, it “&lt;em&gt;expressly&lt;/em&gt; recommends having reproducible builds as part of ‘advanced’ recommended mitigations”. The publication of this document has been accompanied &lt;a href=&quot;https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3146465/nsa-cisa-odni-release-software-supply-chain-guidance-for-developers/&quot;&gt;by a press release&lt;/a&gt;.&lt;/p&gt;
  2202.  
  2203. &lt;hr /&gt;
  2204.  
  2205. &lt;p&gt;Holger Levsen was made aware of a small Microsoft project called &lt;em&gt;oss-reproducible&lt;/em&gt;. Part of, &lt;a href=&quot;https://github.com/microsoft/OSSGadget&quot;&gt;&lt;em&gt;OSSGadget&lt;/em&gt;&lt;/a&gt;, a larger “collection of tools for analyzing open source packages”, the purpose of &lt;em&gt;oss-reproducible&lt;/em&gt; is to:&lt;/p&gt;
  2206.  
  2207. &lt;blockquote&gt;
  2208.  &lt;p&gt;analyze open source packages for reproducibility. We start with an existing package (for example, the NPM &lt;code&gt;left-pad&lt;/code&gt; package, version 1.3.0), and we try to answer the question, &lt;strong&gt;Do the package contents authentically reflect the purported source code?&lt;/strong&gt;&lt;/p&gt;
  2209. &lt;/blockquote&gt;
  2210.  
  2211. &lt;p&gt;More details can be found in the &lt;code&gt;README.md&lt;/code&gt; file &lt;a href=&quot;https://github.com/microsoft/OSSGadget/tree/main/src/oss-reproducible&quot;&gt;within the code repository&lt;/a&gt;.&lt;/p&gt;
  2212.  
  2213. &lt;hr /&gt;
  2214.  
  2215. &lt;p&gt;&lt;a href=&quot;https://bestpractices.coreinfrastructure.org/en&quot;&gt;&lt;img src=&quot;/images/reports/2022-09/bestpractice.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2216.  
  2217. &lt;p&gt;David A. Wheeler also pointed out that there are some potential upcoming changes to the &lt;a href=&quot;https://bestpractices.coreinfrastructure.org/en&quot;&gt;OpenSSF Best Practices&lt;/a&gt; badge for open source software in relation to reproducibility. Whilst the badge programme has &lt;a href=&quot;https://bestpractices.coreinfrastructure.org/en/criteria&quot;&gt;three certification levels&lt;/a&gt; (“passing”, “silver” and “gold”), the “gold” level includes the criterion that “The project MUST have a reproducible build”.&lt;/p&gt;
  2218.  
  2219. &lt;p&gt;&lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-September/002696.html&quot;&gt;David reported&lt;/a&gt; that some projects have argued that this reproducibility criterion should be slightly relaxed as outlined in an &lt;a href=&quot;https://github.com/coreinfrastructure/best-practices-badge/issues/1865&quot;&gt;issue on the &lt;code&gt;best-practices-badge&lt;/code&gt;&lt;/a&gt; GitHub project. Essentially, though, the claim is that the reproducibility requirement doesn’t make sense for projects that do not release built software, and that timestamp differences by &lt;em&gt;themselves&lt;/em&gt; don’t necessarily indicate malicious changes. Numerous pragmatic problems around excluding timestamps were raised in the discussion of the issue.&lt;/p&gt;
  2220.  
  2221. &lt;hr /&gt;
  2222.  
  2223. &lt;p&gt;&lt;a href=&quot;https://www.sonatype.com/press-releases/sonatype-finds-700-average-increase-in-open-source-supply-chain-attacks&quot;&gt;&lt;img src=&quot;/images/reports/2022-09/sonatype.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2224.  
  2225. &lt;p&gt;&lt;a href=&quot;https://www.sonatype.com/&quot;&gt;Sonatype&lt;/a&gt;, a “pioneer of software supply chain management”, issued a &lt;a href=&quot;https://www.sonatype.com/press-releases/sonatype-finds-700-average-increase-in-open-source-supply-chain-attacks&quot;&gt;press release&lt;/a&gt; month to report that they had found:&lt;/p&gt;
  2226.  
  2227. &lt;blockquote&gt;
  2228.  &lt;p&gt;[…] a massive year-over-year increase in cyberattacks aimed at open source project ecosystems. According to early data from Sonatype’s 8th annual State of the Software Supply Chain Report, which will be released in full this October, Sonatype has recorded an average 700% jump in repository attacks over the last three years.&lt;/p&gt;
  2229. &lt;/blockquote&gt;
  2230.  
  2231. &lt;p&gt;More information is available &lt;a href=&quot;https://www.sonatype.com/press-releases/sonatype-finds-700-average-increase-in-open-source-supply-chain-attacks&quot;&gt;in the press release&lt;/a&gt;.&lt;/p&gt;
  2232.  
  2233. &lt;hr /&gt;
  2234.  
  2235. &lt;p&gt;&lt;a href=&quot;https://reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-09/reproducible-builds.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2236.  
  2237. &lt;p&gt;A number of changes were made to the Reproducible Builds website and documentation this month, including Chris Lamb adding a redirect from &lt;a href=&quot;/projects/&quot;&gt;&lt;code&gt;/projects/&lt;/code&gt;&lt;/a&gt; to &lt;a href=&quot;/who/&quot;&gt;&lt;code&gt;/who/&lt;/code&gt;&lt;/a&gt; in order to keep old or archived links working [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/5926d0df&quot;&gt;…&lt;/a&gt;], Jelle van der Waa added a &lt;a href=&quot;https://www.rust-lang.org/&quot;&gt;Rust&lt;/a&gt; programming language &lt;a href=&quot;/docs/source-date-epoch/#rust&quot;&gt;example for &lt;code&gt;SOURCE_DATE_EPOCH&lt;/code&gt;&lt;/a&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/ea2f4306&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/561d91de&quot;&gt;…&lt;/a&gt;] and Mattia Rizzolo included &lt;a href=&quot;https://protocol.ai/&quot;&gt;Protocol Labs&lt;/a&gt; amongst our &lt;a href=&quot;/who/sponsors/&quot;&gt;project-level sponsors&lt;/a&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/e39c8a8e&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  2238.  
  2239. &lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  2240.  
  2241. &lt;h3 id=&quot;debian&quot;&gt;Debian&lt;/h3&gt;
  2242.  
  2243. &lt;p&gt;&lt;a href=&quot;https://debian.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-09/debian.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2244.  
  2245. &lt;p&gt;There was a large amount of reproducibility work taking place within &lt;a href=&quot;https://debian.org/&quot;&gt;Debian&lt;/a&gt; this month:&lt;/p&gt;
  2246.  
  2247. &lt;ul&gt;
  2248.  &lt;li&gt;
  2249.    &lt;p&gt;The &lt;code&gt;nfft&lt;/code&gt; source package was removed from the archive, and now &lt;em&gt;all&lt;/em&gt; packages in Debian &lt;em&gt;bookworm&lt;/em&gt; now have a corresponding &lt;code&gt;.buildinfo&lt;/code&gt; file. This can be confirmed and tracked on the &lt;a href=&quot;https://tests.reproducible-builds.org/debian/bookworm/amd64/index_no_buildinfos.html&quot;&gt;associated page on the&lt;/a&gt; &lt;em&gt;tests.reproducible-builds.org&lt;/em&gt; site.&lt;/p&gt;
  2250.  &lt;/li&gt;
  2251.  &lt;li&gt;
  2252.    &lt;p&gt;Vagrant Cascadian &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-September/002689.html&quot;&gt;announced on our mailing list&lt;/a&gt; an informal online sprint to help “clear the huge backlog of reproducible builds patches submitted” by performing NMU (&lt;a href=&quot;https://wiki.debian.org/NonMaintainerUpload&quot;&gt;Non-Maintainer Uploads&lt;/a&gt;). The first such sprint took place on September 22nd with the following results:&lt;/p&gt;
  2253.  
  2254.    &lt;ul&gt;
  2255.      &lt;li&gt;
  2256.        &lt;p&gt;Holger Levsen:&lt;/p&gt;
  2257.  
  2258.        &lt;ul&gt;
  2259.          &lt;li&gt;Mailed &lt;a href=&quot;https://bugs.debian.org/1010957&quot;&gt;#1010957&lt;/a&gt; in &lt;code&gt;man-db&lt;/code&gt; asking for an update and whether to remove the patch tag for now. This was subsequently removed and the maintainer started to address the issue.&lt;/li&gt;
  2260.          &lt;li&gt;Uploaded &lt;code&gt;gmp&lt;/code&gt; to &lt;code&gt;DELAYED/15&lt;/code&gt;, fixing &lt;a href=&quot;https://bugs.debian.org/1009931&quot;&gt;#1009931&lt;/a&gt;.&lt;/li&gt;
  2261.          &lt;li&gt;Emailed &lt;a href=&quot;https://bugs.debian.org/1017372&quot;&gt;#1017372&lt;/a&gt; in &lt;code&gt;plymouth&lt;/code&gt; and asked for the maintainer’s opinion on the patch. This resulted in the maintainer improving Vagrant’s original patch (and uploading it) as well as &lt;a href=&quot;https://gitlab.freedesktop.org/plymouth/plymouth/-/issues/188&quot;&gt;filing an issue upstream&lt;/a&gt;.&lt;/li&gt;
  2262.          &lt;li&gt;Uploaded &lt;code&gt;time&lt;/code&gt; to &lt;code&gt;DELAYED/15&lt;/code&gt;, fixing &lt;a href=&quot;https://bugs.debian.org/983202&quot;&gt;#983202&lt;/a&gt;.&lt;/li&gt;
  2263.        &lt;/ul&gt;
  2264.      &lt;/li&gt;
  2265.      &lt;li&gt;
  2266.        &lt;p&gt;Vagrant Cascadian:&lt;/p&gt;
  2267.  
  2268.        &lt;ul&gt;
  2269.          &lt;li&gt;Verify and updated patch for &lt;code&gt;mylvmbackup&lt;/code&gt; (&lt;a href=&quot;https://bugs.debian.org/782318&quot;&gt;#782318&lt;/a&gt;)&lt;/li&gt;
  2270.          &lt;li&gt;Verified/updated patches for &lt;code&gt;libranlip&lt;/code&gt;. (&lt;a href=&quot;https://bugs.debian.org/788000&quot;&gt;#788000&lt;/a&gt;, &lt;a href=&quot;https://bugs.debian.org/846975&quot;&gt;#846975&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/1007137&quot;&gt;#1007137&lt;/a&gt;)&lt;/li&gt;
  2271.          &lt;li&gt;Uploaded &lt;code&gt;libranlip&lt;/code&gt; to &lt;code&gt;DELAYED/10&lt;/code&gt;.&lt;/li&gt;
  2272.          &lt;li&gt;Verified patch for &lt;code&gt;cclive&lt;/code&gt;. (&lt;a href=&quot;https://bugs.debian.org/824501&quot;&gt;#824501&lt;/a&gt;)&lt;/li&gt;
  2273.          &lt;li&gt;Uploaded &lt;code&gt;cclive&lt;/code&gt; to &lt;code&gt;DELAYED/10&lt;/code&gt;.&lt;/li&gt;
  2274.          &lt;li&gt;Vagrant was unable to reproduce the underlying issue within &lt;a href=&quot;https://bugs.debian.org/791423&quot;&gt;#791423&lt;/a&gt; (&lt;code&gt;linuxtv-dvb-apps&lt;/code&gt;) and so the bug was marked as “done”.&lt;/li&gt;
  2275.          &lt;li&gt;Researched &lt;a href=&quot;https://bugs.debian.org/794398&quot;&gt;#794398&lt;/a&gt; (in &lt;code&gt;clhep&lt;/code&gt;).&lt;/li&gt;
  2276.        &lt;/ul&gt;
  2277.      &lt;/li&gt;
  2278.    &lt;/ul&gt;
  2279.  
  2280.    &lt;p&gt;The plan is to repeat these sprints every two weeks, with the next taking place on &lt;a href=&quot;https://time.is/compare/1600_06_Oct_2022_in_UTC&quot;&gt;&lt;strong&gt;Thursday October 6th at 16:00 UTC&lt;/strong&gt;&lt;/a&gt; on the &lt;code&gt;#debian-reproducible&lt;/code&gt; IRC channel.&lt;/p&gt;
  2281.  &lt;/li&gt;
  2282.  &lt;li&gt;
  2283.    &lt;p&gt;Roland Clobus posted his &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-September/002693.html&quot;&gt;13th update of the status of reproducible Debian ISO images&lt;/a&gt; on our mailing list. During the last month, Roland ensured that the live images are now automatically fed to &lt;a href=&quot;https://openqa.debian.net&quot;&gt;openQA&lt;/a&gt; for automated testing after they have been shown to be reproducible. Additionally Roland asked on the debian-devel mailing list about a way to determine the canonical timestamp of the Debian archive. [&lt;a href=&quot;https://lists.debian.org/debian-devel/2022/09/msg00199.html&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  2284.  &lt;/li&gt;
  2285.  &lt;li&gt;
  2286.    &lt;p&gt;Following up on &lt;a href=&quot;/reports/2022-08/&quot;&gt;last month’s work on reproducible bootstrapping&lt;/a&gt;, Holger Levsen filed two bugs against the &lt;em&gt;debootstrap&lt;/em&gt; and &lt;em&gt;cdebootstrap&lt;/em&gt; utilities. (&lt;a href=&quot;https://bugs.debian.org/1019697&quot;&gt;#1019697&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://bugs.debian.org/1019698&quot;&gt;#1019698&lt;/a&gt;)&lt;/p&gt;
  2287.  &lt;/li&gt;
  2288. &lt;/ul&gt;
  2289.  
  2290. &lt;p&gt;Lastly, 44 reviews of Debian packages were added, 91 were updated and 17 were removed this month adding to &lt;a href=&quot;https://tests.reproducible-builds.org/debian/index_issues.html&quot;&gt;our knowledge about identified issues&lt;/a&gt;. A number of issue types have been updated too, including the descriptions of &lt;code&gt;cmake_rpath_contains_build_path&lt;/code&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/6c4d7438&quot;&gt;…&lt;/a&gt;], &lt;code&gt;nondeterministic_version_generated_by_python_param&lt;/code&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/d6d81ff0&quot;&gt;…&lt;/a&gt;] and &lt;code&gt;timestamps_in_documentation_generated_by_org_mode&lt;/code&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/fcb9f175&quot;&gt;…&lt;/a&gt;]. Furthermore, two new issue types were created: &lt;code&gt;build_path_used_to_determine_version_or_package_name&lt;/code&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/4259239c&quot;&gt;…&lt;/a&gt;] and &lt;code&gt;captures_build_path_via_cmake_variables&lt;/code&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/a687dc93&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  2291.  
  2292. &lt;h3 id=&quot;other-distributions&quot;&gt;Other distributions&lt;/h3&gt;
  2293.  
  2294. &lt;p&gt;In openSUSE, Bernhard M. Wiedemann published his usual &lt;a href=&quot;https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/XQQ44R5MZ2HUKYXDZXUOEMTNLRFQVFBJ/&quot;&gt;openSUSE monthly report&lt;/a&gt;.&lt;/p&gt;
  2295.  
  2296. &lt;h3 id=&quot;diffoscope&quot;&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;diffoscope&lt;/a&gt;&lt;/h3&gt;
  2297.  
  2298. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;img src=&quot;/images/reports/2022-09/diffoscope.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2299.  
  2300. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;em&gt;diffoscope&lt;/em&gt;&lt;/a&gt; is our in-depth and content-aware diff utility. Not only can it locate and diagnose reproducibility issues, it can provide human-readable diffs from many kinds of binary formats. This month, Chris Lamb prepared and uploaded versions &lt;code&gt;222&lt;/code&gt; and &lt;code&gt;223&lt;/code&gt; to Debian, as well as made the following changes:&lt;/p&gt;
  2301.  
  2302. &lt;ul&gt;
  2303.  &lt;li&gt;
  2304.    &lt;p&gt;The &lt;code&gt;cbfstools&lt;/code&gt; utility is now provided in Debian via the &lt;code&gt;coreboot-utils&lt;/code&gt; package so we can enable that functionality within Debian. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/e21f4153&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  2305.  &lt;/li&gt;
  2306.  &lt;li&gt;
  2307.    &lt;p&gt;Looked into &lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/313&quot;&gt;Mach-O support&lt;/a&gt;.&lt;/p&gt;
  2308.  &lt;/li&gt;
  2309.  &lt;li&gt;
  2310.    &lt;p&gt;Fixed the &lt;a href=&quot;https://try.diffoscope.org/&quot;&gt;&lt;em&gt;try.diffoscope.org&lt;/em&gt;&lt;/a&gt; service by addressing a compatibility issue between &lt;code&gt;glibc&lt;/code&gt;/&lt;code&gt;seccomp&lt;/code&gt; that was preventing the Docker-contained &lt;em&gt;diffoscope&lt;/em&gt; instance from spawning any external processes whatsoever [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/try.diffoscope.org/commit/3fa5eb9&quot;&gt;…&lt;/a&gt;]. I also updated the &lt;code&gt;requirements.txt&lt;/code&gt; file, as some of the specified packages were no longer available [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/try.diffoscope.org/commit/4f3f3a7&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/try.diffoscope.org/commit/dec1878&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  2311.  &lt;/li&gt;
  2312. &lt;/ul&gt;
  2313.  
  2314. &lt;p&gt;In addition Jelle van der Waa added support for &lt;code&gt;file&lt;/code&gt; version 5.43 [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/88c08e7e&quot;&gt;…&lt;/a&gt;] and Mattia Rizzolo updated the packaging:&lt;/p&gt;
  2315.  
  2316. &lt;ul&gt;
  2317.  &lt;li&gt;Also include &lt;code&gt;coreboot-utils&lt;/code&gt; in the &lt;code&gt;Build-Depends&lt;/code&gt; and &lt;code&gt;Test-Depends&lt;/code&gt; fields so that it is available for tests. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/5ac8ede5&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2318.  &lt;li&gt;Use `pep517 and pip to load the requirements. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/2f2d803f&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2319.  &lt;li&gt;Remove packages in &lt;code&gt;Breaks&lt;/code&gt;/&lt;code&gt;Replaces&lt;/code&gt; that have been obsoleted since the release of Debian &lt;em&gt;bullseye&lt;/em&gt;. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/40cd80fc&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2320. &lt;/ul&gt;
  2321.  
  2322. &lt;h3 id=&quot;reprotest&quot;&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/reprotest&quot;&gt;&lt;em&gt;Reprotest&lt;/em&gt;&lt;/a&gt;&lt;/h3&gt;
  2323.  
  2324. &lt;p&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/reprotest&quot;&gt;&lt;em&gt;reprotest&lt;/em&gt;&lt;/a&gt; is our end-user tool to build the same source code twice in widely and deliberate different environments, and checking whether the binaries produced by the builds have any differences. This month, &lt;em&gt;reprotest&lt;/em&gt; version &lt;code&gt;0.7.22&lt;/code&gt; was &lt;a href=&quot;https://tracker.debian.org/news/1360152/accepted-reprotest-0722-source-into-unstable/&quot;&gt;uploaded to Debian unstable&lt;/a&gt; by Holger Levsen, which included the following changes by Philip Hands:&lt;/p&gt;
  2325.  
  2326. &lt;ul&gt;
  2327.  &lt;li&gt;Actually ensure that the &lt;code&gt;setarch(8)&lt;/code&gt; utility can actually execute before including an architecture to test. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reprotest/commit/aa9a790&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2328.  &lt;li&gt;Include all files matching &lt;code&gt;*.*deb&lt;/code&gt; in the default &lt;code&gt;artifact_pattern&lt;/code&gt; in order to archive all results of the build. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reprotest/commit/b2cfd30&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2329.  &lt;li&gt;Emit an error when building the Debian package if the Debian packaging version does not patch the “Python” version of &lt;em&gt;reprotest&lt;/em&gt;. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reprotest/commit/bfa0eca&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2330.  &lt;li&gt;Remove an unneeded invocation of the &lt;code&gt;head(1)&lt;/code&gt; utility. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reprotest/commit/48b9c11&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2331. &lt;/ul&gt;
  2332.  
  2333. &lt;h3 id=&quot;upstream-patches&quot;&gt;Upstream patches&lt;/h3&gt;
  2334.  
  2335. &lt;p&gt;The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where appropriate. This month, we wrote a large number of such patches, including:&lt;/p&gt;
  2336.  
  2337. &lt;ul&gt;
  2338.  &lt;li&gt;
  2339.    &lt;p&gt;Bernhard M. Wiedemann (18 bugs):&lt;/p&gt;
  2340.  
  2341.    &lt;ul&gt;
  2342.      &lt;li&gt;&lt;a href=&quot;https://github.com/zopefoundation/DateTime/issues/41&quot;&gt;&lt;code&gt;DateTime&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  2343.      &lt;li&gt;&lt;a href=&quot;https://github.com/FreeRCT/FreeRCT/pull/303&quot;&gt;&lt;code&gt;FreeRCT&lt;/code&gt;&lt;/a&gt; (date-related issue)&lt;/li&gt;
  2344.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1005798&quot;&gt;&lt;code&gt;clanlib1&lt;/code&gt;&lt;/a&gt; (filesystem ordering)&lt;/li&gt;
  2345.      &lt;li&gt;&lt;a href=&quot;https://github.com/cli/cli/issues/6259&quot;&gt;&lt;code&gt;cli&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  2346.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1002975&quot;&gt;&lt;code&gt;deepin-gettext-tools&lt;/code&gt;&lt;/a&gt; (patch+version update toolchain sort python glob)&lt;/li&gt;
  2347.      &lt;li&gt;&lt;a href=&quot;https://bugzilla.opensuse.org/show_bug.cgi?id=1203310&quot;&gt;&lt;code&gt;mariadb&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  2348.      &lt;li&gt;&lt;a href=&quot;https://bugzilla.opensuse.org/show_bug.cgi?id=1203317&quot;&gt;&lt;code&gt;mercurial&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  2349.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1005891&quot;&gt;&lt;code&gt;mirrormagic&lt;/code&gt;&lt;/a&gt; (parallelism-related issue)&lt;/li&gt;
  2350.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1005916&quot;&gt;&lt;code&gt;ocaml-extlib&lt;/code&gt;&lt;/a&gt; (parallelism-related issue)&lt;/li&gt;
  2351.      &lt;li&gt;&lt;a href=&quot;https://bugzilla.opensuse.org/show_bug.cgi?id=1203311&quot;&gt;&lt;code&gt;python-xmlrpc/python-softlayer&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  2352.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1003076&quot;&gt;&lt;code&gt;python&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  2353.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1005783&quot;&gt;&lt;code&gt;q3rally&lt;/code&gt;&lt;/a&gt; (zip-related issue)&lt;/li&gt;
  2354.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1005890&quot;&gt;&lt;code&gt;rnd_jue&lt;/code&gt;&lt;/a&gt; (parallelism-related issue)&lt;/li&gt;
  2355.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1002273&quot;&gt;&lt;code&gt;rsync&lt;/code&gt;&lt;/a&gt; (workaround an issue in GCC 7.x)&lt;/li&gt;
  2356.      &lt;li&gt;&lt;a href=&quot;https://github.com/SCons/scons/pull/4239&quot;&gt;&lt;code&gt;scons&lt;/code&gt;&lt;/a&gt; (&lt;code&gt;SOURCE_DATE_EPOCH&lt;/code&gt;-related issue)&lt;/li&gt;
  2357.      &lt;li&gt;&lt;a href=&quot;https://github.com/Wargus/stratagus/pull/415&quot;&gt;&lt;code&gt;stratagus&lt;/code&gt;&lt;/a&gt; (date-related issue)&lt;/li&gt;
  2358.      &lt;li&gt;&lt;a href=&quot;https://github.com/vranki/triplane/pull/5&quot;&gt;&lt;code&gt;triplane&lt;/code&gt;&lt;/a&gt; (nondeterminism caused by uninitialised memory)&lt;/li&gt;
  2359.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1005912&quot;&gt;&lt;code&gt;tyrquake&lt;/code&gt;&lt;/a&gt; (date-related issue)&lt;/li&gt;
  2360.    &lt;/ul&gt;
  2361.  &lt;/li&gt;
  2362.  &lt;li&gt;
  2363.    &lt;p&gt;Chris Lamb:&lt;/p&gt;
  2364.  
  2365.    &lt;ul&gt;
  2366.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1019382&quot;&gt;#1019382&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/gnome-online-accounts&quot;&gt;&lt;code&gt;gnome-online-accounts&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2367.      &lt;li&gt;There was renewed activity on a reproducibility-related bug in the &lt;a href=&quot;https://www.sphinx-doc.org/&quot;&gt;Sphinx&lt;/a&gt; documentation tool this month. Originally filed in October 2021 by Chris Lamb, the bug in question relates to &lt;a href=&quot;https://github.com/sphinx-doc/sphinx/issues/9778&quot;&gt;contents of the &lt;code&gt;LANGUAGE&lt;/code&gt; environment variable inconsistently affecting the output of &lt;code&gt;objects.inv&lt;/code&gt; files&lt;/a&gt;.&lt;/li&gt;
  2368.    &lt;/ul&gt;
  2369.  &lt;/li&gt;
  2370.  &lt;li&gt;
  2371.    &lt;p&gt;Jelle van der Waa:&lt;/p&gt;
  2372.  
  2373.    &lt;ul&gt;
  2374.      &lt;li&gt;&lt;a href=&quot;https://github.com/enzo1982/mp4v2/pull/17&quot;&gt;&lt;code&gt;mp4v2&lt;/code&gt;&lt;/a&gt; (date-related issue)&lt;/li&gt;
  2375.      &lt;li&gt;&lt;a href=&quot;https://gitlab.gnome.org/GNOME/mm-common/-/merge_requests/6&quot;&gt;&lt;code&gt;mm-common&lt;/code&gt;&lt;/a&gt; (uid/gid issue)&lt;/li&gt;
  2376.      &lt;li&gt;&lt;a href=&quot;https://github.com/containers/aardvark-dns/pull/229&quot;&gt;&lt;code&gt;aardvark-dns&lt;/code&gt;&lt;/a&gt; (date-related issue)&lt;/li&gt;
  2377.    &lt;/ul&gt;
  2378.  &lt;/li&gt;
  2379.  &lt;li&gt;
  2380.    &lt;p&gt;Vagrant Cascadian (70 bugs!):&lt;/p&gt;
  2381.  
  2382.    &lt;ul&gt;
  2383.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020648&quot;&gt;#1020648&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/extrepo-data&quot;&gt;&lt;code&gt;extrepo-data&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2384.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020650&quot;&gt;#1020650&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/tmpreaper&quot;&gt;&lt;code&gt;tmpreaper&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2385.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020651&quot;&gt;#1020651&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/xmlrpc-epi&quot;&gt;&lt;code&gt;xmlrpc-epi&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2386.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020653&quot;&gt;#1020653&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/pal&quot;&gt;&lt;code&gt;pal&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2387.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020656&quot;&gt;#1020656&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/nvram-wakeup&quot;&gt;&lt;code&gt;nvram-wakeup&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2388.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020657&quot;&gt;#1020657&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/netris&quot;&gt;&lt;code&gt;netris&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2389.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020658&quot;&gt;#1020658&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/netpbm-free&quot;&gt;&lt;code&gt;netpbm-free&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2390.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020659&quot;&gt;#1020659&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/lookup&quot;&gt;&lt;code&gt;lookup&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2391.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020660&quot;&gt;#1020660&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/logtools&quot;&gt;&lt;code&gt;logtools&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2392.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020661&quot;&gt;#1020661&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/libid3tag&quot;&gt;&lt;code&gt;libid3tag&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2393.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020662&quot;&gt;#1020662&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/log4cpp&quot;&gt;&lt;code&gt;log4cpp&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2394.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020665&quot;&gt;#1020665&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/libimage-imlib2-perl&quot;&gt;&lt;code&gt;libimage-imlib2-perl&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2395.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020668&quot;&gt;#1020668&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/jnettop&quot;&gt;&lt;code&gt;jnettop&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2396.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020670&quot;&gt;#1020670&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/gwaei&quot;&gt;&lt;code&gt;gwaei&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2397.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020671&quot;&gt;#1020671&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/ipfm&quot;&gt;&lt;code&gt;ipfm&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2398.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020672&quot;&gt;#1020672&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/tarlz&quot;&gt;&lt;code&gt;tarlz&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2399.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020673&quot;&gt;#1020673&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/w3cam&quot;&gt;&lt;code&gt;w3cam&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2400.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020674&quot;&gt;#1020674&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/ifstat&quot;&gt;&lt;code&gt;ifstat&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2401.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020715&quot;&gt;#1020715&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/xserver-xorg-input-joystick&quot;&gt;&lt;code&gt;xserver-xorg-input-joystick&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2402.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020719&quot;&gt;#1020719&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/chibicc&quot;&gt;&lt;code&gt;chibicc&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2403.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020723&quot;&gt;#1020723&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/python-omegaconf&quot;&gt;&lt;code&gt;python-omegaconf&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2404.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020724&quot;&gt;#1020724&lt;/a&gt; and &lt;a href=&quot;https://bugs.debian.org/1020725&quot;&gt;#1020725&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/snapper&quot;&gt;&lt;code&gt;snapper&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2405.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020736&quot;&gt;#1020736&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/libreswan&quot;&gt;&lt;code&gt;libreswan&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2406.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020743&quot;&gt;#1020743&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/pure-ftpd&quot;&gt;&lt;code&gt;pure-ftpd&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2407.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020748&quot;&gt;#1020748&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/xcolmix&quot;&gt;&lt;code&gt;xcolmix&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2408.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020749&quot;&gt;#1020749&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/gigalomania&quot;&gt;&lt;code&gt;gigalomania&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2409.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020750&quot;&gt;#1020750&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/xjump&quot;&gt;&lt;code&gt;xjump&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2410.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020751&quot;&gt;#1020751&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/waili&quot;&gt;&lt;code&gt;waili&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2411.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020752&quot;&gt;#1020752&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/sjeng&quot;&gt;&lt;code&gt;sjeng&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2412.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020753&quot;&gt;#1020753&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/seqtk&quot;&gt;&lt;code&gt;seqtk&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2413.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020754&quot;&gt;#1020754&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/shapetools&quot;&gt;&lt;code&gt;shapetools&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2414.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020755&quot;&gt;#1020755&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/rotter&quot;&gt;&lt;code&gt;rotter&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2415.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020756&quot;&gt;#1020756&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/rakarrack&quot;&gt;&lt;code&gt;rakarrack&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2416.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020757&quot;&gt;#1020757&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/rig&quot;&gt;&lt;code&gt;rig&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2417.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020759&quot;&gt;#1020759&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/postal&quot;&gt;&lt;code&gt;postal&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2418.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020798&quot;&gt;#1020798&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/netkit-rsh&quot;&gt;&lt;code&gt;netkit-rsh&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2419.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020800&quot;&gt;#1020800&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/libapache-mod-evasive&quot;&gt;&lt;code&gt;libapache-mod-evasive&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2420.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020804&quot;&gt;#1020804&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/paxctl&quot;&gt;&lt;code&gt;paxctl&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2421.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020805&quot;&gt;#1020805&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/png23d&quot;&gt;&lt;code&gt;png23d&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2422.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020806&quot;&gt;#1020806&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/perl-byacc&quot;&gt;&lt;code&gt;perl-byacc&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2423.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020807&quot;&gt;#1020807&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/poster&quot;&gt;&lt;code&gt;poster&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2424.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020808&quot;&gt;#1020808&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/powerdebug&quot;&gt;&lt;code&gt;powerdebug&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2425.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020809&quot;&gt;#1020809&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/aespipe&quot;&gt;&lt;code&gt;aespipe&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2426.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020810&quot;&gt;#1020810&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/aewm++-goodies&quot;&gt;&lt;code&gt;aewm++-goodies&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2427.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020811&quot;&gt;#1020811&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/apache-upload-progress-module&quot;&gt;&lt;code&gt;apache-upload-progress-module&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2428.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020812&quot;&gt;#1020812&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/ascii2binary&quot;&gt;&lt;code&gt;ascii2binary&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2429.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020813&quot;&gt;#1020813&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/bible-kjv&quot;&gt;&lt;code&gt;bible-kjv&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2430.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020814&quot;&gt;#1020814&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/dradio&quot;&gt;&lt;code&gt;dradio&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2431.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020815&quot;&gt;#1020815&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/libapache2-mod-python&quot;&gt;&lt;code&gt;libapache2-mod-python&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2432.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020816&quot;&gt;#1020816&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/tempest-for-eliza&quot;&gt;&lt;code&gt;tempest-for-eliza&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2433.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020817&quot;&gt;#1020817&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/aplus-fsf&quot;&gt;&lt;code&gt;aplus-fsf&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2434.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020866&quot;&gt;#1020866&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/wrapsrv&quot;&gt;&lt;code&gt;wrapsrv&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2435.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020867&quot;&gt;#1020867&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/uclibc&quot;&gt;&lt;code&gt;uclibc&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2436.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020870&quot;&gt;#1020870&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/xppaut&quot;&gt;&lt;code&gt;xppaut&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2437.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020872&quot;&gt;#1020872&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/xvier&quot;&gt;&lt;code&gt;xvier&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2438.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020873&quot;&gt;#1020873&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/xserver-xorg-video-glide&quot;&gt;&lt;code&gt;xserver-xorg-video-glide&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2439.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020875&quot;&gt;#1020875&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/z80asm&quot;&gt;&lt;code&gt;z80asm&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2440.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020876&quot;&gt;#1020876&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/yaskkserv&quot;&gt;&lt;code&gt;yaskkserv&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2441.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020877&quot;&gt;#1020877&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/edid-decode&quot;&gt;&lt;code&gt;edid-decode&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2442.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020878&quot;&gt;#1020878&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/dustmite&quot;&gt;&lt;code&gt;dustmite&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2443.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020879&quot;&gt;#1020879&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/dustmite&quot;&gt;&lt;code&gt;dustmite&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2444.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020880&quot;&gt;#1020880&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/libapache2-mod-authnz-pam&quot;&gt;&lt;code&gt;libapache2-mod-authnz-pam&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2445.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020881&quot;&gt;#1020881&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/kafs-client&quot;&gt;&lt;code&gt;kafs-client&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2446.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020882&quot;&gt;#1020882&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/yaku-ns&quot;&gt;&lt;code&gt;yaku-ns&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2447.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020884&quot;&gt;#1020884&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/bplay&quot;&gt;&lt;code&gt;bplay&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2448.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020886&quot;&gt;#1020886&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/chise-base&quot;&gt;&lt;code&gt;chise-base&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2449.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020887&quot;&gt;#1020887&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/checkpw&quot;&gt;&lt;code&gt;checkpw&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2450.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020888&quot;&gt;#1020888&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/clamz&quot;&gt;&lt;code&gt;clamz&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2451.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1020889&quot;&gt;#1020889&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/libapache2-mod-auth-pgsql&quot;&gt;&lt;code&gt;libapache2-mod-auth-pgsql&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2452.    &lt;/ul&gt;
  2453.  &lt;/li&gt;
  2454. &lt;/ul&gt;
  2455.  
  2456. &lt;h3 id=&quot;testing-framework&quot;&gt;Testing framework&lt;/h3&gt;
  2457.  
  2458. &lt;p&gt;&lt;a href=&quot;https://tests.reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-09/testframework.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2459.  
  2460. &lt;p&gt;The Reproducible Builds project runs a significant testing framework at &lt;a href=&quot;https://tests.reproducible-builds.org&quot;&gt;tests.reproducible-builds.org&lt;/a&gt; in order to check packages and other artifacts for reproducibility. This month, however, the following changes were made:&lt;/p&gt;
  2461.  
  2462. &lt;ul&gt;
  2463.  &lt;li&gt;
  2464.    &lt;p&gt;Holger Levsen:&lt;/p&gt;
  2465.  
  2466.    &lt;ul&gt;
  2467.      &lt;li&gt;Add a job to build &lt;em&gt;reprotest&lt;/em&gt; from Git [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/cae18bea&quot;&gt;…&lt;/a&gt;] and use the correct Git branch when building it [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/012fb28e&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  2468.    &lt;/ul&gt;
  2469.  &lt;/li&gt;
  2470.  &lt;li&gt;
  2471.    &lt;p&gt;Mattia Rizzolo:&lt;/p&gt;
  2472.  
  2473.    &lt;ul&gt;
  2474.      &lt;li&gt;Enable syncing of results from building live Debian ISO images. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/9e3d80df&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2475.      &lt;li&gt;Use &lt;code&gt;scp -p&lt;/code&gt; in order to preserve modification times when syncing live ISO images. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/43d61a2f&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2476.      &lt;li&gt;Apply the &lt;a href=&quot;https://www.shellcheck.net/&quot;&gt;shellcheck&lt;/a&gt; shell script analysis tool. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/17547cc6&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2477.      &lt;li&gt;In a build node wrapper script, remove some debugging code which was messing up calling &lt;code&gt;scp(1)&lt;/code&gt; correctly [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/41fd4fd9&quot;&gt;…&lt;/a&gt;] and consquently add support to use both &lt;code&gt;scp -p&lt;/code&gt; and regular &lt;code&gt;scp&lt;/code&gt; [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/ee995b43&quot;&gt;…&lt;/a&gt;].&lt;/li&gt;
  2478.    &lt;/ul&gt;
  2479.  &lt;/li&gt;
  2480.  &lt;li&gt;
  2481.    &lt;p&gt;Roland Clobus:&lt;/p&gt;
  2482.  
  2483.    &lt;ul&gt;
  2484.      &lt;li&gt;Track and handle the case where the Debian archive gets updated between two live image builds. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/ff1efeec&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2485.      &lt;li&gt;Remove a call to &lt;code&gt;sudo(1)&lt;/code&gt; as it is not (or no longer) required to delete old &lt;em&gt;live-build&lt;/em&gt; results. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/commit/e79f4ae4&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2486.    &lt;/ul&gt;
  2487.  &lt;/li&gt;
  2488. &lt;/ul&gt;
  2489.  
  2490. &lt;h3 id=&quot;contact&quot;&gt;Contact&lt;/h3&gt;
  2491.  
  2492. &lt;p&gt;As ever, if you are interested in contributing to the Reproducible Builds project, please visit our &lt;a href=&quot;https://reproducible-builds.org/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page on our website. However, you can get in touch with us via:&lt;/p&gt;
  2493.  
  2494. &lt;ul&gt;
  2495.  &lt;li&gt;
  2496.    &lt;p&gt;IRC: &lt;code&gt;#reproducible-builds&lt;/code&gt; on &lt;code&gt;irc.oftc.net&lt;/code&gt;.&lt;/p&gt;
  2497.  &lt;/li&gt;
  2498.  &lt;li&gt;
  2499.    &lt;p&gt;Twitter: &lt;a href=&quot;https://twitter.com/ReproBuilds&quot;&gt;@ReproBuilds&lt;/a&gt;&lt;/p&gt;
  2500.  &lt;/li&gt;
  2501.  &lt;li&gt;
  2502.    &lt;p&gt;Mailing list: &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general&quot;&gt;&lt;code&gt;rb-general@lists.reproducible-builds.org&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;
  2503.  &lt;/li&gt;
  2504. &lt;/ul&gt;
  2505. </description>
  2506.      </item>
  2507.    
  2508.      <item>
  2509.        <title>Reproducible Builds in August 2022</title>
  2510.        <pubDate>Fri, 09 Sep 2022 12:53:24 +0000</pubDate>
  2511.        <link>https://reproducible-builds.org/reports/2022-08/</link>
  2512.        <guid isPermaLink="true">https://reproducible-builds.org/reports/2022-08/</guid>
  2513.        <description>&lt;p&gt;&lt;a href=&quot;https://reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-08/reproducible-builds.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2514.  
  2515. &lt;p&gt;&lt;strong&gt;Welcome to the August 2022 report from the &lt;a href=&quot;https://reproducible-builds.org&quot;&gt;Reproducible Builds&lt;/a&gt; project!&lt;/strong&gt; In these reports we outline the most important things that we have been up to over the past month. As a quick recap, whilst anyone may inspect the source code of free software for malicious flaws, almost all software is distributed to end users as pre-compiled binaries. The motivation behind the reproducible builds effort is to ensure no flaws have been introduced during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised.&lt;/p&gt;
  2516.  
  2517. &lt;p&gt;As ever, if you are interested in contributing to the project, please visit our &lt;a href=&quot;/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page on our website.&lt;/p&gt;
  2518.  
  2519. &lt;h4 id=&quot;community-news&quot;&gt;Community news&lt;/h4&gt;
  2520.  
  2521. &lt;p&gt;As announced last month, registration is currently &lt;strong&gt;open&lt;/strong&gt; for our &lt;a href=&quot;/events/venice2022/&quot;&gt;in-person summit this year&lt;/a&gt; which is due to be held between &lt;strong&gt;November 1st → November 3rd&lt;/strong&gt;. The event will take place in &lt;strong&gt;Venice (Italy)&lt;/strong&gt;. Very soon we intend to pick a venue reachable via the train station and an international airport. However, the precise venue will depend on the number of attendees. Please see the &lt;a href=&quot;https://lists.reproducible-builds.org/pipermail/rb-general/2022-July/002666.html&quot;&gt;announcement email&lt;/a&gt; for information about how to register.&lt;/p&gt;
  2522.  
  2523. &lt;hr /&gt;
  2524.  
  2525. &lt;p&gt;&lt;a href=&quot;https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3146465/nsa-cisa-odni-release-software-supply-chain-guidance-for-developers/&quot;&gt;&lt;img src=&quot;/images/reports/2022-08/nsa.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2526.  
  2527. &lt;p&gt;The US &lt;a href=&quot;https://en.wikipedia.org/wiki/National_Security_Agency&quot;&gt;National Security Agency&lt;/a&gt; (NSA), &lt;a href=&quot;https://en.wikipedia.org/wiki/Cybersecurity_and_Infrastructure_Security_Agency&quot;&gt;Cybersecurity and Infrastructure Security Agency&lt;/a&gt; (CISA) and the &lt;a href=&quot;https://en.wikipedia.org/wiki/Director_of_National_Intelligence#Office_of_the_Director_of_National_Intelligence&quot;&gt;Office of the Director of National Intelligence&lt;/a&gt; (ODNI) have released a document called “&lt;em&gt;Securing the Software Supply Chain: Recommended Practices Guide for Developers&lt;/em&gt;” (&lt;a href=&quot;https://media.defense.gov/2022/Sep/01/2003068942/-1/-1/0/ESF_SECURING_THE_SOFTWARE_SUPPLY_CHAIN_DEVELOPERS.PDF&quot;&gt;PDF&lt;/a&gt;) as part of their Enduring Security Framework (ESF) work.&lt;/p&gt;
  2528.  
  2529. &lt;p&gt;The document expressly recommends having reproducible builds as part of “advanced” recommended mitigations, along with hermetic builds. Page 31 (page 35 in the &lt;a href=&quot;https://media.defense.gov/2022/Sep/01/2003068942/-1/-1/0/ESF_SECURING_THE_SOFTWARE_SUPPLY_CHAIN_DEVELOPERS.PDF&quot;&gt;PDF&lt;/a&gt;) says:&lt;/p&gt;
  2530.  
  2531. &lt;blockquote&gt;
  2532.  &lt;p&gt;Reproducible builds provide additional protection and validation against attempts to compromise build systems. They ensure the binary products of each build system match: i.e., they are built from the same source, regardless of variable metadata such as the order of input files, timestamps, locales, and paths. Reproducible builds are those where re-running the build steps with identical input artifacts results in bit-for-bit identical output. Builds that cannot meet this must provide a justification why the build cannot be made reproducible.&lt;/p&gt;
  2533. &lt;/blockquote&gt;
  2534.  
  2535. &lt;p&gt;The &lt;a href=&quot;https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3146465/nsa-cisa-odni-release-software-supply-chain-guidance-for-developers/&quot;&gt;full press release&lt;/a&gt; is available online.&lt;/p&gt;
  2536.  
  2537. &lt;hr /&gt;
  2538.  
  2539. &lt;p&gt;&lt;a href=&quot;https://appfair.net/&quot;&gt;&lt;img src=&quot;/images/reports/2022-08/appfair.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2540.  
  2541. &lt;p&gt;On &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general/&quot;&gt;our mailing list&lt;/a&gt; this month, Marc Prud’hommeaux posted a feature request for &lt;em&gt;diffoscope&lt;/em&gt; which additionally outlines a project called &lt;a href=&quot;https://appfair.net/&quot;&gt;The App Fair&lt;/a&gt;,  an autonomous distribution network of free and open-source macOS and iOS applications, where “validated apps are then signed and submitted for publication”.&lt;/p&gt;
  2542.  
  2543. &lt;hr /&gt;
  2544.  
  2545. &lt;p&gt;Author/blogger &lt;a href=&quot;https://craphound.com/bio/&quot;&gt;Cory Doctorow&lt;/a&gt; posted published a provocative blog post this month titled “&lt;a href=&quot;https://pluralistic.net/2022/07/28/descartes-was-an-optimist/#uh-oh&quot;&gt;Your computer is tormented by a wicked god&lt;/a&gt;”. Touching on Ken Thompson’s famous talk, “&lt;a href=&quot;https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf&quot;&gt;Reflections on Trusting Trust&lt;/a&gt;”, the early goals of “Secure Computing” and UEFI firmware interfaces:&lt;/p&gt;
  2546.  
  2547. &lt;blockquote&gt;
  2548.  &lt;p&gt;This is the core of a two-decade-old debate among security people, and it’s one that the “benevolent God” faction has consistently had the upper hand in. They’re the “curated computing” advocates who insist that preventing you from choosing an alternative app store or side-loading a program is for your own good – because if it’s possible for you to override the manufacturer’s wishes, then malicious software may impersonate you to do so, or you might be tricked into doing so. [..] This benevolent dictatorship model only works so long as the dictator is both perfectly benevolent and perfectly competent. We know the dictators aren’t always benevolent. […] But even if you trust a dictator’s benevolence, you can’t trust in their perfection. Everyone makes mistakes. Benevolent dictator computing works well, but fails badly. Designing a computer that intentionally can’t be fully controlled by its owner is a nightmare, because that is a computer that, once compromised, can attack its owner with impunity.&lt;/p&gt;
  2549. &lt;/blockquote&gt;
  2550.  
  2551. &lt;hr /&gt;
  2552.  
  2553. &lt;p&gt;Lastly, Chengyu HAN updated the &lt;a href=&quot;/&quot;&gt;Reproducible Builds website&lt;/a&gt; to correct an incorrect Git command. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-website/commit/fc235bb9&quot;&gt;…&lt;/a&gt;]&lt;/p&gt;
  2554.  
  2555. &lt;h4 id=&quot;debian&quot;&gt;Debian&lt;/h4&gt;
  2556.  
  2557. &lt;p&gt;&lt;a href=&quot;https://debian.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-08/debian.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2558.  
  2559. &lt;p&gt;In &lt;a href=&quot;https://debian.org/&quot;&gt;Debian&lt;/a&gt; this month, the &lt;code&gt;essential&lt;/code&gt; and &lt;code&gt;required&lt;/code&gt; package sets became 100% reproducible in Debian &lt;em&gt;bookworm&lt;/em&gt; on the &lt;code&gt;amd64&lt;/code&gt; and &lt;code&gt;arm64&lt;/code&gt; architectures. These two subsets of the full Debian archive refer to Debian package “priority” levels as described in the &lt;a href=&quot;https://www.debian.org/doc/debian-policy/ch-archive.html#s-priorities&quot;&gt;§2.5 Priorities&lt;/a&gt; section of the &lt;a href=&quot;https://www.debian.org/doc/debian-policy/&quot;&gt;Debian Policy&lt;/a&gt; — there is no canonical “minimal installation” package set in Debian due to its diverse methods of installation.&lt;/p&gt;
  2560.  
  2561. &lt;p&gt;As it happens, these package sets are &lt;em&gt;not&lt;/em&gt; reproducible on the &lt;code&gt;i386&lt;/code&gt; architecture because the &lt;code&gt;ncurses&lt;/code&gt; package on that architecture is not yet reproducible, and the &lt;code&gt;sed&lt;/code&gt; package currently fails to build from source on &lt;code&gt;armhf&lt;/code&gt; too. The full list of reproducible packages within these package sets can be viewed within our QA system, such as on the page of &lt;a href=&quot;https://tests.reproducible-builds.org/debian/bookworm/amd64/pkg_set_required.html&quot;&gt;&lt;code&gt;required&lt;/code&gt; packages in &lt;code&gt;amd64&lt;/code&gt;&lt;/a&gt; and the list of &lt;a href=&quot;https://tests.reproducible-builds.org/debian/bookworm/arm64/pkg_set_essential.html&quot;&gt;&lt;code&gt;essential&lt;/code&gt; packages on &lt;code&gt;arm64&lt;/code&gt;&lt;/a&gt;, both for Debian &lt;em&gt;bullseye&lt;/em&gt;.&lt;/p&gt;
  2562.  
  2563. &lt;hr /&gt;
  2564.  
  2565. &lt;p&gt;It recently has become very easy to install reproducible Debian Docker containers using &lt;code&gt;podman&lt;/code&gt; on Debian bullseye:&lt;/p&gt;
  2566.  
  2567. &lt;pre&gt;&lt;code&gt;$ sudo apt install podman
  2568. $ podman run --rm -it debian:bullseye bash
  2569. &lt;/code&gt;&lt;/pre&gt;
  2570.  
  2571. &lt;p&gt;The (pre-built) image used is itself built using &lt;a href=&quot;https://github.com/debuerreotype/debuerreotype&quot;&gt;&lt;em&gt;debuerrotype&lt;/em&gt;&lt;/a&gt;, as explained on &lt;a href=&quot;https://docker.debian.net/&quot;&gt;&lt;em&gt;docker.debian.net&lt;/em&gt;&lt;/a&gt;. This page also details how to build the image yourself and what checksums are expected if you do so.&lt;/p&gt;
  2572.  
  2573. &lt;hr /&gt;
  2574.  
  2575. &lt;p&gt;Related to this, it has also become straightforward to reproducibly bootstrap Debian using &lt;a href=&quot;https://gitlab.mister-muffin.de/josch/mmdebstrap&quot;&gt;&lt;em&gt;mmdebstrap&lt;/em&gt;&lt;/a&gt;, a replacement for the usual &lt;em&gt;debootstrap&lt;/em&gt; tool to create Debian root filesystems:&lt;/p&gt;
  2576.  
  2577. &lt;pre&gt;&lt;code&gt;$ SOURCE_DATE_EPOCH=$(date --utc --date=2022-08-29 +%s) mmdebstrap unstable &amp;gt; unstable.tar
  2578. &lt;/code&gt;&lt;/pre&gt;
  2579.  
  2580. &lt;p&gt;This works for (at least) Debian &lt;em&gt;unstable&lt;/em&gt;, &lt;em&gt;bullseye&lt;/em&gt; and &lt;em&gt;bookworm&lt;/em&gt;, and is tested automatically by a number of QA jobs set up by Holger Levsen (&lt;a href=&quot;https://jenkins.debian.net/job/reproducible_mmdebstrap_unstable/&quot;&gt;&lt;em&gt;unstable&lt;/em&gt;&lt;/a&gt;, &lt;a href=&quot;https://jenkins.debian.net/job/reproducible_mmdebstrap_bookworm/&quot;&gt;&lt;em&gt;bookworm&lt;/em&gt;&lt;/a&gt; and &lt;a href=&quot;https://jenkins.debian.net/job/reproducible_mmdebstrap_bullseye/&quot;&gt;&lt;em&gt;bullseye&lt;/em&gt;&lt;/a&gt;)&lt;/p&gt;
  2581.  
  2582. &lt;hr /&gt;
  2583.  
  2584. &lt;p&gt;Work has also taken place to ensure that the canonical &lt;em&gt;debootstrap&lt;/em&gt; and &lt;em&gt;cdebootstrap&lt;/em&gt; tools are &lt;em&gt;also&lt;/em&gt; capable of bootstrapping Debian reproducibly, although it currently requires a few extra steps:&lt;/p&gt;
  2585.  
  2586. &lt;ol&gt;
  2587.  &lt;li&gt;
  2588.    &lt;p&gt;“Clamping” the modification time of files that are newer than &lt;code&gt;$SOURCE_DATE_EPOCH&lt;/code&gt; to be not greater than &lt;code&gt;SOURCE_DATE_EPOCH&lt;/code&gt;.&lt;/p&gt;
  2589.  &lt;/li&gt;
  2590.  &lt;li&gt;
  2591.    &lt;p&gt;Deleting a few files. For &lt;em&gt;debootstrap&lt;/em&gt;, this requires the deletion of &lt;code&gt;/etc/machine-id&lt;/code&gt;, &lt;code&gt;/var/cache/ldconfig/aux-cache&lt;/code&gt;, &lt;code&gt;/var/log/dpkg.log&lt;/code&gt;, &lt;code&gt;/var/log/alternatives.log&lt;/code&gt; and &lt;code&gt;/var/log/bootstrap.log&lt;/code&gt;, and for &lt;em&gt;cdebootstrap&lt;/em&gt; we also need to delete the &lt;code&gt;/var/log/apt/history.log&lt;/code&gt; and &lt;code&gt;/var/log/apt/term.log&lt;/code&gt; files as well.&lt;/p&gt;
  2592.  &lt;/li&gt;
  2593. &lt;/ol&gt;
  2594.  
  2595. &lt;p&gt;This process works at least for &lt;em&gt;unstable&lt;/em&gt;, &lt;em&gt;bullseye&lt;/em&gt; and &lt;em&gt;bookworm&lt;/em&gt; and is now being tested automatically by a number of QA jobs setup by Holger Levsen [&lt;a href=&quot;https://jenkins.debian.net/job/reproducible_debootstrap_bullseye/&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://jenkins.debian.net/job/reproducible_debootstrap_bookworm/&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://jenkins.debian.net/job/reproducible_debootstrap_unstable/&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://jenkins.debian.net/job/reproducible_cdebootstrap_bullseye/&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://jenkins.debian.net/job/reproducible_cdebootstrap_bookworm/&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://jenkins.debian.net/job/reproducible_cdebootstrap_unstable/&quot;&gt;…&lt;/a&gt;]. As part of this work, Holger filed two bugs to request a better initialisation of the &lt;code&gt;/etc/machine-id&lt;/code&gt; file in both &lt;em&gt;debootstrap&lt;/em&gt; [&lt;a href=&quot;https://bugs.debian.org/1018740&quot;&gt;…&lt;/a&gt;] and &lt;em&gt;cdebootstrap&lt;/em&gt; [&lt;a href=&quot;https://bugs.debian.org/1018741&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  2596.  
  2597. &lt;hr /&gt;
  2598.  
  2599. &lt;p&gt;Elsewhere in Debian, 131 reviews of Debian packages were added, 20 were updated and 27 were removed this month, adding to &lt;a href=&quot;https://tests.reproducible-builds.org/debian/index_issues.html&quot;&gt;our extensive knowledge about identified issues&lt;/a&gt;. Chris Lamb added a number of issue types, including: &lt;code&gt;randomness_in_browserify_output&lt;/code&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/b2d75f42&quot;&gt;…&lt;/a&gt;],  &lt;code&gt;haskell_abi_hash_differences&lt;/code&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/732f0fc1&quot;&gt;…&lt;/a&gt;], &lt;code&gt;nondeterministic_ids_in_html_output_generated_by_python_sphinx_panels&lt;/code&gt; [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/3c9fbbcb&quot;&gt;…&lt;/a&gt;]. Lastly, Mattia Rizzolo removed the &lt;code&gt;deterministic&lt;/code&gt; flag from the &lt;code&gt;captures_kernel_variant&lt;/code&gt; flag [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/83ea690e&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  2600.  
  2601. &lt;h4 id=&quot;other-distributions&quot;&gt;Other distributions&lt;/h4&gt;
  2602.  
  2603. &lt;p&gt;&lt;a href=&quot;https://guix.gnu.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-08/guix.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2604.  
  2605. &lt;p&gt;Vagrant Cascadian posted an &lt;a href=&quot;https://lists.gnu.org/archive/html/guix-devel/2022-08/msg00161.html&quot;&gt;update of the status of Reproducible Builds in GNU Guix&lt;/a&gt;, writing that:&lt;/p&gt;
  2606.  
  2607. &lt;blockquote&gt;
  2608.  &lt;p&gt;&lt;code&gt;Ignoring the pesky unknown packages, it is more like ~93% reproducible&lt;/code&gt;
  2609. &lt;code&gt;and ~7% unreproducible... that feels a bit better to me!&lt;/code&gt;&lt;/p&gt;
  2610.  
  2611.  &lt;p&gt;&lt;code&gt;These numbers wander around over time, mostly due to packages moving&lt;/code&gt;
  2612. &lt;code&gt;back into an &quot;unknown&quot; state while the build farms catch up with each&lt;/code&gt;
  2613. &lt;code&gt;other... although the above numbers seem to have been pretty consistent&lt;/code&gt;
  2614. &lt;code&gt;over the last few days.&lt;/code&gt;&lt;/p&gt;
  2615. &lt;/blockquote&gt;
  2616.  
  2617. &lt;p&gt;The &lt;a href=&quot;https://lists.gnu.org/archive/html/guix-devel/2022-08/msg00161.html&quot;&gt;post itself&lt;/a&gt; contains a lot more details, including a brief discussion of tooling.&lt;/p&gt;
  2618.  
  2619. &lt;p&gt;Elsewhere in GNU Guix, however, Vagrant updated a number of packages such as &lt;code&gt;itpp&lt;/code&gt; [&lt;a href=&quot;https://git.savannah.gnu.org/cgit/guix.git/commit/?id=b30614b28cdc4eb893eeea4523109769f913499e&quot;&gt;…&lt;/a&gt;], &lt;code&gt;perl-class-methodmaker&lt;/code&gt; [&lt;a href=&quot;https://git.savannah.gnu.org/cgit/guix.git/commit/?id=f31e55d0819064557b9a2af687f05b131f5c4f26&quot;&gt;…&lt;/a&gt;], &lt;code&gt;libnet&lt;/code&gt; [&lt;a href=&quot;https://git.savannah.gnu.org/cgit/guix.git/commit/?id=d2b85f8906489fb95d8be41d6ba9fd520a5967d0&quot;&gt;…&lt;/a&gt;], &lt;code&gt;directfb&lt;/code&gt; [&lt;a href=&quot;https://git.savannah.gnu.org/cgit/guix.git/commit/?id=397b103bef313c84eb662051fbcd28e223806bd3&quot;&gt;…&lt;/a&gt;] and &lt;code&gt;mm-common&lt;/code&gt; [&lt;a href=&quot;https://issues.guix.gnu.org/57304&quot;&gt;…&lt;/a&gt;], as well as updated the version of &lt;em&gt;reprotest&lt;/em&gt; to 0.7.21 [&lt;a href=&quot;https://git.savannah.gnu.org/cgit/guix.git/commit/?id=f030ae422b6d13a7a21158d9a37c9760597d1573&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  2620.  
  2621. &lt;p&gt;&lt;a href=&quot;https://www.opensuse.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-08/opensuse.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2622.  
  2623. &lt;p&gt;In openSUSE, Bernhard M. Wiedemann published his usual &lt;a href=&quot;https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/KXF3OGYAJMGB5LU2QJJZSOCIAL22JUBU/&quot;&gt;openSUSE monthly report&lt;/a&gt;.&lt;/p&gt;
  2624.  
  2625. &lt;h4 id=&quot;diffoscope&quot;&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;diffoscope&lt;/a&gt;&lt;/h4&gt;
  2626.  
  2627. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;img src=&quot;/images/reports/2022-08/diffoscope.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2628.  
  2629. &lt;p&gt;&lt;a href=&quot;https://diffoscope.org&quot;&gt;&lt;em&gt;diffoscope&lt;/em&gt;&lt;/a&gt; is our in-depth and content-aware diff utility. Not only can it locate and diagnose reproducibility issues, it can provide human-readable diffs from many kinds of binary formats. This month, Chris Lamb prepared and uploaded versions &lt;code&gt;220&lt;/code&gt; and &lt;code&gt;221&lt;/code&gt; to Debian, as well as made the following changes:&lt;/p&gt;
  2630.  
  2631. &lt;ul&gt;
  2632.  &lt;li&gt;Update &lt;code&gt;external_tools.py&lt;/code&gt; to reflect changes to &lt;code&gt;xxd&lt;/code&gt; and the &lt;code&gt;vim-common&lt;/code&gt; package. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/c6432ec7&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2633.  &lt;li&gt;Depend on the dedicated &lt;code&gt;xxd&lt;/code&gt; package now, not the &lt;code&gt;vim-common&lt;/code&gt; package. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/8a823c69&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2634.  &lt;li&gt;Don’t crash if we can &lt;em&gt;open&lt;/em&gt; a PDF file using the &lt;a href=&quot;ihttps://pybrary.net/pyPdf/&quot;&gt;PyPDF&lt;/a&gt; library, but cannot subsequently parse the annotations within. [&lt;a href=&quot;https://salsa.debian.org/reproducible-builds/diffoscope/commit/dbeab9e3&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2635. &lt;/ul&gt;
  2636.  
  2637. &lt;p&gt;In addition, Vagrant Cascadian updated &lt;em&gt;diffoscope&lt;/em&gt; in &lt;a href=&quot;https://www.gnu.org/software/guix/&quot;&gt;GNU Guix&lt;/a&gt;, first to to version 220 [&lt;a href=&quot;https://git.savannah.gnu.org/cgit/guix.git/commit/?id=04ef952a4928a427fa3d778e23d4e99299c9fa5a&quot;&gt;…&lt;/a&gt;] and later to 221 [&lt;a href=&quot;https://git.savannah.gnu.org/cgit/guix.git/commit/?id=ec6122250de7c83a7e77054584a34767b11337db&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  2638.  
  2639. &lt;h4 id=&quot;community-news-1&quot;&gt;Community news&lt;/h4&gt;
  2640.  
  2641. &lt;p&gt;The Reproducible Builds project aims to fix as many currently-unreproducible packages as possible as well as to send all of our patches upstream wherever appropriate. This month we created a number of patches, including:&lt;/p&gt;
  2642.  
  2643. &lt;ul&gt;
  2644.  &lt;li&gt;
  2645.    &lt;p&gt;Bernhard M. Wiedemann:&lt;/p&gt;
  2646.  
  2647.    &lt;ul&gt;
  2648.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1000142&quot;&gt;&lt;code&gt;at-spi-sharp&lt;/code&gt;&lt;/a&gt; (build failure when build on a multiprocessor machine).&lt;/li&gt;
  2649.      &lt;li&gt;&lt;a href=&quot;https://github.com/borgbackup/borg/issues/6996&quot;&gt;&lt;code&gt;borgbackup&lt;/code&gt;&lt;/a&gt; (fails to build in 2038, &lt;a href=&quot;https://build.opensuse.org/request/show/999784&quot;&gt;fix&lt;/a&gt;)&lt;/li&gt;
  2650.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/1000483&quot;&gt;&lt;code&gt;buzztrax&lt;/code&gt;&lt;/a&gt; (parallelism-related issue)&lt;/li&gt;
  2651.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/993689&quot;&gt;&lt;code&gt;chart-testing&lt;/code&gt;&lt;/a&gt; (date-related issue)&lt;/li&gt;
  2652.      &lt;li&gt;&lt;a href=&quot;https://github.com/memcached/memcached/pull/927&quot;&gt;&lt;code&gt;memcached&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  2653.      &lt;li&gt;&lt;a href=&quot;https://github.com/nim-lang/Nim/issues/20285&quot;&gt;&lt;code&gt;nim&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  2654.      &lt;li&gt;&lt;a href=&quot;https://github.com/chansen/p5-time-moment/pull/48&quot;&gt;&lt;code&gt;perl-Time-Moment&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  2655.      &lt;li&gt;&lt;a href=&quot;https://github.com/py-bson/bson/pull/117&quot;&gt;&lt;code&gt;python-bson&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  2656.      &lt;li&gt;&lt;a href=&quot;https://review.opendev.org/c/openstack/python-heatclient/+/855083&quot;&gt;&lt;code&gt;python-heatclient&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  2657.      &lt;li&gt;&lt;a href=&quot;https://bugzilla.opensuse.org/show_bug.cgi?id=1202666&quot;&gt;&lt;code&gt;python3.8&lt;/code&gt;&lt;/a&gt; (fails to build in 2038)&lt;/li&gt;
  2658.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/992182&quot;&gt;&lt;code&gt;reproducible-faketools&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;
  2659.      &lt;li&gt;&lt;a href=&quot;https://github.com/s3fs-fuse/s3fs-fuse/pull/2026&quot;&gt;&lt;code&gt;s3fs&lt;/code&gt;&lt;/a&gt; (date-related issue)&lt;/li&gt;
  2660.      &lt;li&gt;&lt;a href=&quot;https://build.opensuse.org/request/show/994525&quot;&gt;&lt;code&gt;systemd&lt;/code&gt;&lt;/a&gt; (date-related issue)&lt;/li&gt;
  2661.    &lt;/ul&gt;
  2662.  &lt;/li&gt;
  2663.  &lt;li&gt;
  2664.    &lt;p&gt;Chris Lamb:&lt;/p&gt;
  2665.  
  2666.    &lt;ul&gt;
  2667.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1016486&quot;&gt;#1016486&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/wayfire&quot;&gt;&lt;code&gt;wayfire&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2668.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1016583&quot;&gt;#1016583&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/multipath-tools&quot;&gt;&lt;code&gt;multipath-tools&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2669.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1016584&quot;&gt;#1016584&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/node-canvas-confetti&quot;&gt;&lt;code&gt;node-canvas-confetti&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2670.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1017473&quot;&gt;#1017473&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/psi&quot;&gt;&lt;code&gt;psi&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://github.com/psi-im/psi/pull/699&quot;&gt;forwarded upstream&lt;/a&gt;).&lt;/li&gt;
  2671.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1017475&quot;&gt;#1017475&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/sphinx-panels&quot;&gt;&lt;code&gt;sphinx-panels&lt;/code&gt;&lt;/a&gt; (&lt;a href=&quot;https://github.com/executablebooks/sphinx-panels/pull/82&quot;&gt;forwarded upstream&lt;/a&gt;).&lt;/li&gt;
  2672.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1017920&quot;&gt;#1017920&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/sysfsutils&quot;&gt;&lt;code&gt;sysfsutils&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2673.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1017945&quot;&gt;#1017945&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/geeqie&quot;&gt;&lt;code&gt;geeqie&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2674.    &lt;/ul&gt;
  2675.  &lt;/li&gt;
  2676.  &lt;li&gt;
  2677.    &lt;p&gt;Vagrant Cascadian:&lt;/p&gt;
  2678.  
  2679.    &lt;ul&gt;
  2680.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1017073&quot;&gt;#1017073&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/python-suntime&quot;&gt;&lt;code&gt;python-suntime&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2681.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1017372&quot;&gt;#1017372&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/plymouth&quot;&gt;&lt;code&gt;plymouth&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2682.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1017373&quot;&gt;#1017373&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/tiemu&quot;&gt;&lt;code&gt;tiemu&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2683.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1017421&quot;&gt;#1017421&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/fltk1.3&quot;&gt;&lt;code&gt;fltk1.3&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2684.      &lt;li&gt;&lt;a href=&quot;https://bugs.debian.org/1018802&quot;&gt;#1018802&lt;/a&gt; filed against &lt;a href=&quot;https://tracker.debian.org/pkg/localechooser&quot;&gt;&lt;code&gt;localechooser&lt;/code&gt;&lt;/a&gt;.&lt;/li&gt;
  2685.      &lt;li&gt;&lt;a href=&quot;https://lists.denx.de/pipermail/u-boot/2022-August/492156.html&quot;&gt;&lt;code&gt;uboot&lt;/code&gt;&lt;/a&gt; (Rasmus Villemoes proposed fixing gcc instead [&lt;a href=&quot;https://gcc.gnu.org/pipermail/gcc-patches/2022-August/600491.html&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93371&quot;&gt;…&lt;/a&gt;])&lt;/li&gt;
  2686.    &lt;/ul&gt;
  2687.  &lt;/li&gt;
  2688. &lt;/ul&gt;
  2689.  
  2690. &lt;h4 id=&quot;testing-framework&quot;&gt;Testing framework&lt;/h4&gt;
  2691.  
  2692. &lt;p&gt;&lt;a href=&quot;https://tests.reproducible-builds.org/&quot;&gt;&lt;img src=&quot;/images/reports/2022-08/testframework.png#right&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;
  2693.  
  2694. &lt;p&gt;The Reproducible Builds project runs a significant testing framework at &lt;a href=&quot;https://tests.reproducible-builds.org&quot;&gt;tests.reproducible-builds.org&lt;/a&gt;, to check packages and other artifacts for reproducibility. This month, Holger Levsen made the following changes:&lt;/p&gt;
  2695.  
  2696. &lt;ul&gt;
  2697.  &lt;li&gt;
  2698.    &lt;p&gt;Debian-related changes:&lt;/p&gt;
  2699.  
  2700.    &lt;ul&gt;
  2701.      &lt;li&gt;Temporarily add Debian &lt;em&gt;unstable&lt;/em&gt; &lt;code&gt;deb-src&lt;/code&gt; lines to enable test builds a &lt;a href=&quot;https://wiki.debian.org/NonMaintainerUpload&quot;&gt;Non-maintainer Upload&lt;/a&gt; (NMU) campaign targeting 708 sources without &lt;code&gt;.buildinfo&lt;/code&gt; files found in Debian &lt;em&gt;unstable&lt;/em&gt;, including 475 in bookworm. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/87cf75b0&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/2ddfa8e1&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2702.      &lt;li&gt;Correctly deal with the &lt;a href=&quot;https://wiki.debian.org/DebianEdu/&quot;&gt;Debian Edu&lt;/a&gt; packages not being installable. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/c6503196&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2703.      &lt;li&gt;Finally, stop scheduling &lt;em&gt;stretch&lt;/em&gt;. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/40c48f0b&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2704.      &lt;li&gt;Make sure all Ubuntu nodes have the &lt;code&gt;linux-image-generic&lt;/code&gt; kernel package installed. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/61f1c057&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2705.    &lt;/ul&gt;
  2706.  &lt;/li&gt;
  2707.  &lt;li&gt;
  2708.    &lt;p&gt;Health checks &amp;amp; view:&lt;/p&gt;
  2709.  
  2710.    &lt;ul&gt;
  2711.      &lt;li&gt;Detect &lt;a href=&quot;https://www.openssh.com/&quot;&gt;SSH&lt;/a&gt; login problems. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/6a98f816&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2712.      &lt;li&gt;Only report the first uninstallable package set. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/c69cb969&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2713.      &lt;li&gt;Show new bootstrap jobs. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/2d64b3ee&quot;&gt;…&lt;/a&gt;] and &lt;em&gt;debian-live&lt;/em&gt; jobs. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/73cc19d3&quot;&gt;…&lt;/a&gt;] in the job health view.&lt;/li&gt;
  2714.      &lt;li&gt;Fix regular expression to detect various zombie jobs. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/c42d00ff&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2715.    &lt;/ul&gt;
  2716.  &lt;/li&gt;
  2717.  &lt;li&gt;
  2718.    &lt;p&gt;New jobs:&lt;/p&gt;
  2719.  
  2720.    &lt;ul&gt;
  2721.      &lt;li&gt;Add a new job to test reproducibility of &lt;a href=&quot;https://gitlab.mister-muffin.de/josch/mmdebstrap&quot;&gt;&lt;em&gt;mmdebstrap&lt;/em&gt;&lt;/a&gt; bootstrapping tool. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/1a4bf7a5&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/2ecb9c31&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/79810a93&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/e2885c3e&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2722.      &lt;li&gt;Run our new &lt;em&gt;mmdebstrap&lt;/em&gt; job remotely [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/088d6d77&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/2f11e8cf&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2723.      &lt;li&gt;Improve the output of the &lt;em&gt;mmdebstrap&lt;/em&gt; job. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/b40cee9e&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/41612318&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/1333cb55&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2724.      &lt;li&gt;Adjust the &lt;em&gt;mmdebstrap&lt;/em&gt; script to additionally support &lt;em&gt;debootstrap&lt;/em&gt; as well. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/6294d6df&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/297b9827&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/bf292af4&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2725.      &lt;li&gt;Work around &lt;em&gt;mmdebstrap&lt;/em&gt; and &lt;em&gt;debootstrap&lt;/em&gt; keeping logfiles within their artifacts. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/955cc9ba&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/06f47311&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/4bdda15e&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2726.      &lt;li&gt;Add support for testing &lt;em&gt;cdebootstrap&lt;/em&gt; too and add such a job for unstable. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/c1bd3041&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/f71341bb&quot;&gt;…&lt;/a&gt;][&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/835bdc62&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2727.      &lt;li&gt;Use a reproducible value for &lt;code&gt;SOURCE_DATE_EPOCH&lt;/code&gt; for all our new bootstrap jobs. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/262045c5&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2728.    &lt;/ul&gt;
  2729.  &lt;/li&gt;
  2730.  &lt;li&gt;
  2731.    &lt;p&gt;Misc changes:&lt;/p&gt;
  2732.  
  2733.    &lt;ul&gt;
  2734.      &lt;li&gt;Send the &lt;code&gt;create_meta_pkg_sets&lt;/code&gt; notification to &lt;code&gt;#debian-reproducible-changes&lt;/code&gt; instead of &lt;code&gt;#debian-reproducible&lt;/code&gt;. [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/afbd1d10&quot;&gt;…&lt;/a&gt;]&lt;/li&gt;
  2735.    &lt;/ul&gt;
  2736.  &lt;/li&gt;
  2737. &lt;/ul&gt;
  2738.  
  2739. &lt;p&gt;In addition, Roland Clobus re-enabled the tests for &lt;em&gt;live-build&lt;/em&gt; images [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/e4d7f0b5&quot;&gt;…&lt;/a&gt;] and added a feature where the build would retry instead of give up when the archive was synced whilst building an ISO [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/7b28da62&quot;&gt;…&lt;/a&gt;], and Vagrant Cascadian added logging to report the current target of the &lt;code&gt;/bin/sh&lt;/code&gt; symlink [&lt;a href=&quot;https://salsa.debian.org/qa/jenkins.debian.net/-/commit/e4776858&quot;&gt;…&lt;/a&gt;].&lt;/p&gt;
  2740.  
  2741. &lt;h4 id=&quot;contact&quot;&gt;Contact&lt;/h4&gt;
  2742.  
  2743. &lt;p&gt;As ever, if you are interested in contributing to the Reproducible Builds project, please visit our &lt;a href=&quot;https://reproducible-builds.org/contribute/&quot;&gt;&lt;em&gt;Contribute&lt;/em&gt;&lt;/a&gt; page on our website. However, you can get in touch with us via:&lt;/p&gt;
  2744.  
  2745. &lt;ul&gt;
  2746.  &lt;li&gt;
  2747.    &lt;p&gt;IRC: &lt;code&gt;#reproducible-builds&lt;/code&gt; on &lt;code&gt;irc.oftc.net&lt;/code&gt;.&lt;/p&gt;
  2748.  &lt;/li&gt;
  2749.  &lt;li&gt;
  2750.    &lt;p&gt;Twitter: &lt;a href=&quot;https://twitter.com/ReproBuilds&quot;&gt;@ReproBuilds&lt;/a&gt;&lt;/p&gt;
  2751.  &lt;/li&gt;
  2752.  &lt;li&gt;
  2753.    &lt;p&gt;Mailing list: &lt;a href=&quot;https://lists.reproducible-builds.org/listinfo/rb-general&quot;&gt;&lt;code&gt;rb-general@lists.reproducible-builds.org&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;
  2754.  &lt;/li&gt;
  2755. &lt;/ul&gt;
  2756. </description>
  2757.      </item>
  2758.    
  2759.  </channel>
  2760. </rss>
  2761.