Gothenburg 2026 - Day 2 - Social aspects of Reproducible Builds

social

Android world: Users trust the developer more. Open source world: trust in developers is even greater because of the anti-large-corp sentiment.

Is this package really from the developer?

• Less people to put trust in.
• Fdroid’s perspective: F-droid checks that it’s actually safe/the same, but users don’t necessarily share that sentiment.

Have a builder available to verify it, hosted by other people? Analogy with Tor nodes hosted by universities, community, …

Old apps are signed by the developer, Google signs it on top before 2021. F-droid started with signing (breaks reproduciblity).

Key management would be simplified if it can be shown that the built APK is directly from the source code. “Smentically equivalent”? Can be viewed as integrity being broken.

.jar -> compare the .zip inside the file. Building on different distro’s changes the .zip structure.

Rebuilding something from 30 years ago, there’s mechanisms to show the changes are minimal. Maintenance vs security?

What do people care about?

• Security is attractive to us, to a specific group
• Caching
• Maintenance may be more attractive to the general public
• Supply chain autonomy / Software sovereignty

Security

• Establishing “trust”
  • Binary matches source
  • Makes developers less of a target
    • If people know something is reproducibly built, attackers need to compromise the source rather than the tooling.
    • Attackers need to affect more to successfully pull it off

Caching

Long term maintance

Why not do RB?

• “If it’s not 100% reproducible, it’s not worth it”
• “It’s hard”
  • Not a priority from the start, makes it more painful to do afterwards
  • Perception of “bit for bit” identical or nothing
• “What’s the value?”
• “Out of my control”
  • e.g. Tooling
  • A compiler that doesn’t support it
  • Availability (toolchain, …, whatever is needed to rebuild it)
• Low priority
• Long-term cost
  • Complexity
  • Time

How to help

• Education
• Documentation
• Soft gatekeeping, personal help
• Should we embrace AI?
• Regulation

Accademia

• Getting into “bit-for-bit” identicality is very far away for scientific research

Some submissions have different criteria:

1. It exists
2. It builds
3. It runs
4. It is reproducible

The incentive for submission of papers contrasts open source.

Case for “rebuilders”

• A 3-rd party check that shows it has been rebuilt and works.

Hosting a rebuilder as a 3rd-party

• Independently verify something can be rebuild
• Community
  • Allows for those who can’t run it to still verify the result
• Fix bugs or security issues
• Flag build environment discrepancies
• Help identify mallware