Reproducible Builds in September 2023

← View all our monthly reports


Welcome to the September 2023 report from the Reproducible Builds project

In these reports, we outline the most important things that we have been up to over the past month. As a quick recap, whilst anyone may inspect the source code of free software for malicious flaws, almost all software is distributed to end users as pre-compiled binaries.


Andreas Herrmann gave a talk at All Systems Go 2023 titled “Fast, correct, reproducible builds with Nix and Bazel”. Quoting from the talk description:

You will be introduced to Google’s open source build system Bazel, and will learn how it provides fast builds, how correctness and reproducibility is relevant, and how Bazel tries to ensure correctness. But, we will also see where Bazel falls short in ensuring correctness and reproducibility. You will [also] learn about the purely functional package manager Nix and how it approaches correctness and build isolation. And we will see where Bazel has an advantage over Nix when it comes to providing fast feedback during development.

Andreas also shows how you can get the best of both worlds and combine Nix and Bazel, too. A video of the talk is available.


diffoscope is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb fixed compatibility with file(1) version 5.45 […] and updated some documentation […]. In addition, Vagrant Cascadian extended support for GNU Guix […][…] and updated the version in that distribution as well. […].


Yet another reminder that our upcoming Reproducible Builds Summit is set to take place from October 31st — November 2nd 2023 in Hamburg, Germany.

If you haven’t been before, our summits are a unique gathering that brings together attendees from diverse projects, united by a shared vision of advancing the Reproducible Builds effort. During this enriching event, participants will have the opportunity to engage in discussions, establish connections and exchange ideas to drive progress in this vital field.

If you’re interested in joining us this year, please make sure to read the event page, the news item, or the invitation email that Mattia Rizzolo sent out recently, all of which have more details about the event and location.

We are also still looking for sponsors to support the event, so please reach out to the organising team if you are able to help. Also note that PackagingCon 2023 is taking place in Berlin just before our summit.


On the Reproducible Builds website, Greg Chabala updated the JVM-related documentation to update a link to the BUILDSPEC.md file. […] And Fay Stegerman fixed the builds failing because of a YAML syntax error.


Distribution work

In Debian, this month:

September saw F-Droid add ten new reproducible apps, and one existing app switched to reproducible builds. In addition, two reproducible apps were archived and one was disabled for a current total of 199 apps published with Reproducible Builds and using the upstream developer’s signature. […] In addition, an extensive blog post was posted on f-droid.org titled “Reproducible builds, signing keys, and binary repos”.


Upstream patches

The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where appropriate. This month, we wrote a large number of such patches, including:


Testing framework

The Reproducible Builds project operates a comprehensive testing framework (available at tests.reproducible-builds.org) in order to check packages and other artifacts for reproducibility. In September, a number of changes were made by Holger Levsen:

  • Disable armhf and i386 builds due to Debian bug #1052257. […][…][…][…]
  • Run diffoscope with a lower ionice priority. […]
  • Log every build in a simple text file […] and create persistent stamp files when running diffoscope to ease debugging […].
  • Run schedulers one hour after dinstall again. […]
  • Temporarily use diffoscope from the host, and not from a schroot running the tested suite. […][…]
  • Fail the diffoscope distribution test if the diffoscope version cannot be determined. […]
  • Fix a spelling error in the ‘email to IRC’ gateway. […]
  • Force (and document) the reconfiguration of all jobs, due to the recent rise of zombies. […][…][…][…]
  • Deal with a rare condition when killing processes which should not be there. […]
  • Install the Debian backports kernel in an attempt to address Debian bug #1052257. […][…]

In addition, Mattia Rizzolo fixed a call to diffoscope --version (as suggested by Fay Stegerman on our mailing list) […], worked on an openQA credential issue […] and also made some changes to the machine-readable reproducible metadata, reproducible-tracker.json […]. Lastly, Roland Clobus added instructions for manual configuration of the openQA secrets […].


If you are interested in contributing to the Reproducible Builds project, please visit our Contribute page on our website. However, you can get in touch with us via:



← View all our monthly reports

Follow us on Twitter @ReproBuilds, Mastodon @reproducible_builds@fosstodon.org & Reddit and please consider making a donation. • Content licensed under CC BY-SA 4.0, style licensed under MIT. Templates and styles based on the Tor Styleguide. Logos and trademarks belong to their respective owners. • Patches for this website welcome via our Git repository (instructions) or via our mailing list. • Full contact info