Reproducible Builds in October 2025 💠
Chris Lamb
chris at reproducible-builds.org
Wed Nov 5 21:19:55 GMT 2025
--------------------------------------------------------------------
o
⬋ ⬊ October 2025 in Reproducible Builds
o o
⬊ ⬋ https://reproducible-builds.org/reports/2025-10/
o
--------------------------------------------------------------------
Welcome to the very latest report from the Reproducible Builds
project. Our monthly reports outline what we've been up to over the
past month, and highlight items of news from elsewhere in the
increasingly-important area of software supply-chain security.
As ever, if you are interested in contributing to the Reproducible
Builds project, please see the Contribute [0] page on our website.
In this report:
* Farewell from the Reproducible Builds Summit 2025
* Google’s Play Store breaks reproducible builds for Signal
* Mailing list updates
* "The Original Sin of Computing… that no one can fix"
* Reproducible Builds at the Transparency.dev summit
* Supply Chain Security for Go
* Three new academic papers published
* Distribution work
* Upstream patches
* Website updates
* Tool development
[0] https://reproducible-builds.org/contribute/
§
Farewell from the Reproducible Builds Summit 2025
-------------------------------------------------
Thank you to everyone who joined us at the Reproducible Builds
Summit [3] in Vienna, Austria!
We were thrilled to host the eighth edition of this exciting event,
following the success of previous summits in various iconic
locations around the world, including Venice, Marrakesh, Paris,
Berlin, Hamburg and Athens. During this event, participants had the
opportunity to engage in discussions, establish connections and
exchange ideas to drive progress in this vital field. Our aim was to
create an inclusive space that fosters collaboration, innovation and
problem-solving.
The agenda of the three main days [4] is available online — however,
some working sessions may still lack notes at time of publication.
One tangible outcome of the summit is that Johannes Starosta [5]
finished their rebuilderd [6] tutorial, which is now available
online [7] and Johannes is actively seeking feedback.
[3] https://reproducible-builds.org/events/vienna2025/
[4] https://reproducible-builds.org/events/vienna2025/agenda
[5] https://github.com/johannesst
[6] https://github.com/kpcyrd/rebuilderd
[7] https://github.com/johannesst/rebuilderd-setup-tutorial?tab=readme-ov-file
§
Google's Play Store breaks reproducible builds for Signal
---------------------------------------------------------
On the issue tracker for the popular Signal [8] messenger app,
developer Greyson Parrelli reports that updates to the Google Play
store have, in effect, broken reproducible builds:
> The most recent issues have to do with changes to the APKs that
> are made by the Play Store. Specifically, they add some
> attributes to some .xml files around languages are resources,
> which is not unexpected because of how the whole bundle system
> works. This is trickier to resolve, because unlike current
> "expected differences" (like signing information), we can't just
> exclude a whole file from the comparison. We have to take a more
> nuanced look at the diff. I've been hesitant to do that because
> it'll complicate our currently-very-readable comparison script,
> but I don't think there's any other reasonable option here.
The full thread with additional context [9] is available on GitHub.
[8] https://signal.org/
[9] https://github.com/signalapp/Signal-Android/issues/13565
§
Mailing list updates
--------------------
On our mailing list [10] this month:
* kpcyrd forwarded a fascinating tidbit regarding so-called "ninja"
and "samurai" build ordering [11], that uses data structures in
which the pointer values returned from malloc are used to
determine some order of execution.
[10] https://lists.reproducible-builds.org/listinfo/rb-general/
[11] https://lists.reproducible-builds.org/pipermail/rb-general/2025-October/003903.html
* Arnout Engelen, Justin Cappos, Ludovic Courtès and kpcyrd
continued a conversation started in September regarding the
"Minimum Elements for a Software Bill of Materials". (Full thread
[12])
[12] https://lists.reproducible-builds.org/pipermail/rb-general/2025-October/thread.html#3893
* Felix Moessbauer of Siemens [13] posted to the list reporting that
he had recently "stumbled upon a couple of Debian source
packages on the snapshot mirrors that are listed multiple times
(same name and version), but each time with a different checksum".
The thread, which Felix titled, "Debian: what precisely identifies
a source package" [14] is about precisely that — what can be
axiomatically relied upon by consumers of the Debian archives, as
well as indicating an issue where "we can't exactly say which
packages were used during build time (even when having the
.buildinfo files).
[13] https://www.siemens.com/
[14] https://lists.reproducible-builds.org/pipermail/rb-general/2025-October/003908.html
* Luca DiMaio posted to the list announcing the release of xfsprogs
[15] 6.17.0 which specifically includes a commit [16] that
"implements the functionality to populate a newly created XFS
filesystem directly from an existing directory structure" which
"makes it easier to create populated filesystems without having to
mount them [and thus is] particularly useful for reproducible
builds". Luca asked the list how they might contribute to the docs
of the "System images" [17] page.
[15] https://www.kernel.org/pub/linux/utils/fs/xfs/xfsprogs/
[16] https://git.kernel.org/pub/scm/fs/xfs/xfsprogs-dev.git/commit/?id=8a4ea72724930cfe262ccda03028264e1a81b145
[17] https://reproducible-builds.org/docs/system-images/
§
"The Original Sin of Computing...that no one can fix"
-----------------------------------------------------
Popular YouTuber @laurewired [18] published a video this month with
an engaging take on the "Trusting Trust" [19] problem. Titled "The
Original Sin of Computing...that no one can fix" [20], the video
touches on David A. Wheeler's Diverse Double-Compiling [21]
dissertation.
[18] https://www.youtube.com/@lauriewired
[19] https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf
[20] https://www.youtube.com/watch?v=Fu3laL5VYdM
[21] https://dwheeler.com/trusting-trust/
GNU developer Janneke Nieuwenhuizen followed-up with an email
(additionally sent to our mailing list [22]) as well, underscoring
that GNU Mes [23]'s "current solution [to this issue] uses ancient
softwares in its bootstrap path, such as gcc-2.95.3 and
glibc-2.2.5". (According to Colby Russell [24], the GNU Mes
bootstrapping sequence is shown at 18m54s in the video.)
[22] https://lists.reproducible-builds.org/listinfo/rb-general/
[23] https://www.gnu.org/software/mes/
[24] https://lists.reproducible-builds.org/pipermail/rb-general/2025-October/003905.html
§
Reproducible Builds at the Transparency.dev summit
--------------------------------------------------
Holger Levsen gave a talk at this year's Transparency.dev [25]
summit in Gothenburg, Sweden, outlining the achievements of the
Reproducible Builds project in the last 12 years, covering both
upstream developments as well as some distribution-specific details.
As mentioned on the talk's page [26], Holger's presentation
concluded "with an outlook into the future and an invitation to
collaborate to bring transparency logs into Reproducible Builds
projects".
The slides [27] of the talk are available, although a video has yet
to be released. Nevertheless, as a result of the discussions at
Transparency.dev there is a new page on the Debian wiki [28] with
the aim of describing a potential transparency log setup for Debian.
[25] https://transparency.dev/summit2025/
[26] https://transparency.dev/summit2025/talks/reproducible-builds.html
[27] https://reproducible-builds.org/_lfs/presentations/2025-10-21-Reproducible-Builds-brief-summary-of-12-years-and-a-glimpse-into-the-future
[28] https://wiki.debian.org/ReproducibleBuilds/PackageTransparency
§
Supply Chain Security for Go
----------------------------
Andrew Ayer has setup a new service at sourcespotter.com [30] that
aims to monitor the supply chain security for Go releases. It
consists of four separate trackers:
1. A tool to verify that the Go Module Mirror and Checksum Database
is behaving honestly and has not presented inconsistent
information to clients.
2. A module monitor that records every module version served by the
Go Module Mirror and Checksum Database, allowing you to monitor
for unexpected versions of your modules.
3. A tool to verifies that the Go toolchains published in the Go
Module Mirror can be reproduced from source code, making it
difficult to hide backdoors in the binaries downloaded by the go
command.
4. A telemetry config tracker that tracks the names of telemetry
counters uploaded by the Go toolchain, to ensure that Go
telemetry is not violating users' privacy.
As the homepage of the service mentions, the trackers are free
software and do not rely on Google infrastructure.
[30] https://sourcespotter.com/
§
Three new academic papers published
-----------------------------------
Julien Malka of the Institut Polytechnique de Paris published an
exciting paper this month on "How NixOS could have detected the XZ
supply-chain attack for the benefit of all thanks to
reproducible-builds [32]. Julien outlines his paper as follows:
> In March 2024, a sophisticated backdoor was discovered in xz [33],
> a core compression library in Linux distributions, covertly
> inserted over three years by a malicious maintainer, Jia Tan. The
> attack, which enabled remote code execution via ssh, was only
> uncovered by chance when Andres Freund investigated a minor
> performance issue. This incident highlights the vulnerability of
> the open-source supply chain and the effort attackers are willing
> to invest in gaining trust and access. In this article, I analyze
> the backdoor’s mechanics and explore how bitwise build
> reproducibility could have helped detect it.
A PDF [34] of the paper is available online.
[32] https://hal.science/hal-05326226
[33] https://en.wikipedia.org/wiki/XZ_Utils_backdoor
[34] https://hal.science/hal-05326226/document
Iyán Méndez Veiga and Esther Hänggi (of the Lucerne University of
Applied Sciences and Arts [35] and ETH Zurich [36]) published a paper
this month on the topic of "Reproducible Builds for Quantum Computing"
[37]. The abstract of their paper mentions the following:
> Although quantum computing is a rapidly evolving field of
> research, it can already benefit from adopting reproducible
> builds. This paper aims to bridge the gap between the quantum
> computing and reproducible builds communities. We propose a
> generalization of the definition of reproducible builds in the
> quantum setting, motivated by two threat models: one targeting the
> confidentiality of end users’ data during circuit preparation and
> submission to a quantum computer, and another compromising the
> integrity of quantum computation results. This work presents three
> examples that show how classical information can be hidden in
> transpiled quantum circuits, and two cases illustrating how even
> minimal modifications to these circuits can lead to incorrect
> quantum computation results.
A full PDF [38] of their paper is available.
[35] https://www.hslu.ch/en/
[36] https://itp.phys.ethz.ch/
[37] https://arxiv.org/abs/2510.02251
[38] https://arxiv.org/pdf/2510.02251
Congratulations to Georg Kofler who submitted their Master's thesis
for the Johannes Kepler University [39] of Linz, Austria on the
topic of "Reproducible builds of E2EE-messengers for Android
using Nix hermetic builds":
> The thesis focuses on providing a reproducible build process for two
> open-source E2EE messaging applications: Signal and Wire. The motivation
> to ensure reproducibility—and thereby the integrity—of E2EE messaging
> applications stems from their central role as essential tools for modern
> digital privacy. These applications provide confidentiality for private
> and sensitive communications, and their compromise could undermine
> encryption mechanisms, potentially leaking sensitive data to
> third parties.
A full PDF [40] of their thesis is available online.
[39] https://www.jku.at/en
[40] https://epub.jku.at/obvulihs/content/titleinfo/12692481/full.pdf
Shawkot Hossain of Aalto University [41], Finland has also submitted
their Master's thesis on "The Role of SBOM in Modern Development*
[42] with a focus on the extant tooling:
> Currently, there are numerous solutions and techniques available
> in the market to tackle supply chain security, and all claim to be
> the best solution. This thesis delves deeper by implementing those
> solutions and evaluates them for better understanding. Some of the
> tools that this thesis implemented are Syft [43], Trivy [44],
> Grype, FOSSA, dependency- check, and Gemnasium. Software
> dependencies are generated in a Software Bill of Materials (SBOM)
> format by using these open-source tools, and the corresponding
> results have been analyzed. Among these tools, Syft and Trivy
> outperform others as they provide relevant and accurate
> information on software dependencies.
A PDF [45] of the thesis is also available.
[41] https://www.aalto.fi/en
[42] https://aaltodoc.aalto.fi/server/api/core/bitstreams/ba5d8e7a-dcde-427f-a056-02e19b51ce1b/content
[43] https://github.com/anchore/syft
[44] https://trivy.dev/latest/
[45] https://aaltodoc.aalto.fi/server/api/core/bitstreams/ba5d8e7a-dcde-427f-a056-02e19b51ce1b/content
§
Distribution work
-----------------
Michael Plura published an interesting article on Heise.de [46] on the
topic of "Trust is good, reproducibility is better" [47]:
> In the wake of growing supply chain attacks, the FreeBSD
> developers are relying on a transparent build concept in the form
> of Zero-Trust Builds [48]. The approach builds on the established
> Reproducible Builds, where binary files can be rebuilt bit-for-bit
> from the published source code. While reproducible builds
> primarily ensure verifiability, the zero-trust model goes a step
> further and removes trust from the build process itself. No single
> server, maintainer, or compiler can be considered more than
> potentially trustworthy.
The article [49] mentions that this "goal has now been achieved with a
slight delay and can be used in the current development branch for
FreeBSD 15".
[46] https://heise.de
[47] https://www.heise.de/en/news/FreeBSD-shortly-before-15-0-Trust-is-good-reproducibility-is-better-10965171.html
[48] https://freebsdfoundation.org/blog/zero-trust-builds-for-freebsd/
[49] https://www.heise.de/en/news/FreeBSD-shortly-before-15-0-Trust-is-good-reproducibility-is-better-10965171.html
In Debian this month, 7 reviews of Debian packages were added, 5 were
updated and 11 were removed this month adding to our knowledge about
identified issues [50].
[50] https://tests.reproducible-builds.org/debian/index_issues.html
Lastly, Bernhard M. Wiedemann posted another openSUSE [51] monthly
update [52] for their work there.
[51] https://www.opensuse.org/
[52] https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/HGMTV66UILWPYJ56ULYF3GOFV6A4KH5C/
§
Upstream patches
----------------
The Reproducible Builds project detects, dissects and attempts to fix as
many currently-unreproducible packages as possible. We endeavour to send
all of our patches upstream where appropriate. This month, we wrote a
large number of such patches, including:
* Chris Lamb:
* #1117494 [53] filed against python-can [54].
* #1117614 [55] filed against rsbackup [56].
* #1117742 [57] filed against mobilitydb [58].
* #1118160 [59] filed against pyraf [60].
* #1118596 [61] filed against ne [62].
[53] https://bugs.debian.org/1117494
[54] https://tracker.debian.org/pkg/python-can
[55] https://bugs.debian.org/1117614
[56] https://tracker.debian.org/pkg/rsbackup
[57] https://bugs.debian.org/1117742
[58] https://tracker.debian.org/pkg/mobilitydb
[59] https://bugs.debian.org/1118160
[60] https://tracker.debian.org/pkg/pyraf
[61] https://bugs.debian.org/1118596
[62] https://tracker.debian.org/pkg/ne
* Bernhard M. Wiedemann:
* qt6-lottie [63], plasma6-print-manager [64], plasma6-nm [65]
(avoid race in qmlcachegen)
* xfishtank [66] (date, regression)
* gstreamer-plugins-rs [67]
* gpg2 [68] (FTBFS-2038)
* rocclr [69] (PID)
* kf6-breeze-icons [70] (parallelism)
* opencloud-server [71] (random tmp path)
* python-awscrt [72] (FTBFS-j1)
* glib-macros/contrast/fractal/Fragments/identity/mousai/loupe/gstr
eamer-plugins-rs [73] (rust HashMap)
* deno [74] (rust order)
[63] https://build.opensuse.org/request/show/1311380
[64] https://build.opensuse.org/request/show/1313805
[65] https://build.opensuse.org/request/show/1313806
[66] https://build.opensuse.org/request/show/1314682
[67] https://build.opensuse.org/request/show/1314943
[68] https://bugzilla.opensuse.org/show_bug.cgi?id=1251214
[69] https://src.opensuse.org/ROCmWork/rocclr/pulls/1
[70] https://bugzilla.opensuse.org/show_bug.cgi?id=1251980
[71] https://bugzilla.opensuse.org/show_bug.cgi?id=1252113
[72] https://bugzilla.opensuse.org/show_bug.cgi?id=1252257
[73] https://github.com/gtk-rs/gtk-rs-core/pull/1840
[74] https://bugzilla.opensuse.org/show_bug.cgi?id=1252955
* Robin Candau:
* treetop [75]
[75] https://github.com/cjheath/treetop/pull/60
§
Website updates
---------------
Once again, there were a number of improvements made to our website this
month including:
* Arnout Engelen added a note on using git archive to the "Archive
metadata" [76] page. [77]
[76] https://reproducible-builds.org/docs/archives/
[77] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/6e4ced17
* James Addison updated the user stories that feature on the homepage
[78][79][80][81][82] as well as a new "Reproducibility
Troubleshooting" [83] that functions as an excellent 'getting
started' guide [84][85].
[78] https://reproducible-builds.org/
[79] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/43d6bca6
[80] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/86c0972d
[81] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/6f46cf61
[82] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/994bdbf8
[83] https://reproducible-builds.org/docs/reproducibility-troubleshooting/
[84] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/f1c538ab
[85] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/28e4a9c3
* Zbigniew Jędrzejewski-Szmek added a link on the "Tools" [86] page for
"add-determinism" [87] and "linkdupes" [88] as well as added a link
to Fedora's reproducibility efforts [89] to the "Contribute" [90]
page [91].
[86] https://reproducible-builds.org/tools/
[87] https://github.com/keszybz/add-determinism
[88] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/b2c663f4
[89] https://docs.fedoraproject.org/en-US/reproducible-builds/
[90] https://reproducible-builds.org/contribute/
[91] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/21f1813d
* Bernhard Wiedemann and Zbigniew Jędrzejewski-Szmek extended
ismypackagereproducibleyet.org [92] with initial support for
Fedora [93].
[92] https://ismypackagereproducibleyet.org/
[93] https://github.com/bmwiedemann/ismypackagereproducibleyet/commit/5c9712ed52e57f81a65cbe0d18bdb1a6602f18c1
In addition, a number of contributors added a series of notes from our
recent summit [94] to the website, including Alexander Couzens [95],
Robin Candau [96][97][98][99][100][101][102][103][104] and kpcyrd [105].
[94] https://reproducible-builds.org/events/vienna2025/
[95] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/f82c1295
[96] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/016ae3f2
[97] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/4886ee08
[98] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/7b7cd546
[99] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/b95f8c71
[100] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/144b7cb5
[101] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/f9d459ef
[102] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/49df551c
[103] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/0d55af9b
[104] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/553702a3
[105] https://salsa.debian.org/reproducible-builds/reproducible-website/commit/b422164f
§
Tool development
----------------
diffoscope version 307 was uploaded to Debian unstable [106] by Chris
Lamb, who made a number of changes including fixing compatibility with
LLVM version 21 [107] [108], an attempt to automatically attempt to
deploy to PyPI [109] by liaising with the PyPI developers/maintainers
(with this experimental feature). [110] In addition, Vagrant Cascadian
updated diffoscope in GNU Guix to version 307 [111].
[106] https://tracker.debian.org/news/1685059/accepted-diffoscope-307-source-into-unstable/
[107] https://releases.llvm.org/21.1.0/docs/ReleaseNotes.html
[108] https://salsa.debian.org/reproducible-builds/diffoscope/commit/98886f43
[109] https://pypi.org/
[110] https://salsa.debian.org/reproducible-builds/diffoscope/commit/f74b61ff
[111] https://codeberg.org/guix/guix/commit/0a5e1e5bcf1d85acbcc027318d0b97263ccf7040
§
Finally, if you are interested in contributing to the Reproducible
Builds project, please visit our "Contribute" [112] page on our
website. However, you can get in touch with us via:
* IRC: #reproducible-builds on irc.oftc.net.
* Mastodon: @reproducible_builds at fosstodon.org [113]
* Mailing list: rb-general at lists.reproducible-builds.org [114]
[112] https://reproducible-builds.org/contribute/
[113] https://fosstodon.org/@reproducible_builds
[114] https://lists.reproducible-builds.org/listinfo/rb-general
--
o
⬋ ⬊
o o reproducible-builds.org 💠
⬊ ⬋
o
More information about the Reproducible-builds
mailing list