Veganism Social

Stefano ZacchiroliCongrats to <a href="https://chaos.social/@luj" class="u-url mention" rel="nofollow noopener" target="_blank">@luj</a> and <a href="https://fediscience.org/@Zimm_i48" class="u-url mention" rel="nofollow noopener" target="_blank">@Zimm_i48</a>, for the ACM SIGSOFT Distinguished Paper award at <a href="https://mastodon.xyz/tags/MSR2025" class="mention hashtag" rel="nofollow noopener" target="_blank">#MSR2025</a>, for our joint paper «Does Functional Package Management Enable <a href="https://mastodon.xyz/tags/ReproducibleBuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#ReproducibleBuilds</a> at Scale? Yes.»Details, including link to an <a href="https://mastodon.xyz/tags/openaccess" class="mention hashtag" rel="nofollow noopener" target="_blank">#openaccess</a> preprint, at: <a href="https://2025.msrconf.org/details/msr-2025-technical-papers/32/Does-Functional-Package-Management-Enable-Reproducible-Builds-at-Scale-Yes-" rel="nofollow noopener" translate="no" target="_blank">https://2025.msrconf.org/details/msr-2025-technical-papers/32/Does-Functional-Package-Management-Enable-Reproducible-Builds-at-Scale-Yes-</a>The paper is going to be presented this afternoon at the conf here in Ottawa.<a href="https://mastodon.xyz/tags/Nix" class="mention hashtag" rel="nofollow noopener" target="_blank">#Nix</a> cc: <a href="https://fosstodon.org/@reproducible_builds" class="u-url mention" rel="nofollow noopener" target="_blank">@reproducible_builds</a>

IzzyOnDroid ✅Welcome to the RB family, LinkGuardian 🥳<a href="https://apt.izzysoft.de/packages/dev.elbullazul.linkguardian" rel="nofollow noopener" translate="no" target="_blank">https://apt.izzysoft.de/packages/dev.elbullazul.linkguardian</a>LinkGuardian is an Android client for Linkwarden, helping you to manage your link collection. Thanks to joint efforts with its developer, <a href="https://pub.elbullazul.com/@elbullazul" class="u-url mention" rel="nofollow noopener" target="_blank">@elbullazul</a>, the app is now RB :awesome: <a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#reproducibleBuilds</a> <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener" target="_blank">#IzzyOnDroid</a>

Ludovic CourtèsMeanwhile, Gilmore makes an analogy between “reproducible builds” and “pure functions”: <a href="https://lists.reproducible-builds.org/pipermail/rb-general/2025-April/003736.html" rel="nofollow noopener" translate="no" target="_blank">https://lists.reproducible-builds.org/pipermail/rb-general/2025-April/003736.html</a>It sure feels like a déjà vu to the Nix and Guix folks but it’s good to see it brought up from a different perspective.<a href="https://toot.aquilenet.fr/tags/ReproducibleBuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#ReproducibleBuilds</a>

Vagrant CascadianImpatient to get a <a href="https://floss.social/tags/Backport" class="mention hashtag" rel="nofollow noopener" target="_blank">#Backport</a> of <a href="https://floss.social/tags/Dino" class="mention hashtag" rel="nofollow noopener" target="_blank">#Dino</a> 0.5 for <a href="https://floss.social/tags/Debian" class="mention hashtag" rel="nofollow noopener" target="_blank">#Debian</a> <a href="https://floss.social/tags/Bookworm" class="mention hashtag" rel="nofollow noopener" target="_blank">#Bookworm</a> ... but the build logs were already published, including the hashes of all the binaries, I went ahead and performed a <a href="https://floss.social/tags/ReproducibleBuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#ReproducibleBuilds</a> check of locally built packages for amd64, arm64 and the "all" architecture... and came up with bit-for-bit identical results!<a href="https://people.debian.org/~vagrant/dino-im-reproduced/" rel="nofollow noopener" translate="no" target="_blank">https://people.debian.org/~vagrant/dino-im-reproduced/</a>By the time you read this, identical binaries may already land on the Debian archive. I have a newer dino installed now! Try for yourself!

IzzyOnDroid ✅<a href="https://pouet.chapril.org/@jerome_herbinet" class="u-url mention" rel="nofollow noopener" target="_blank">@jerome_herbinet</a> Thanks for giving us a boost 🤗 And as you use the 🛡️ symbol: <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener" target="_blank">#IzzyOnDroid</a> also supports <a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#reproducibleBuilds</a> (yes, we can also build from source – but we ALWAYS ship the APKs provided by their resp. developers), see <a href="https://android.izzysoft.de/articles/named/iod-rbs-mirrors-clients" rel="nofollow noopener" translate="no" target="_blank">https://android.izzysoft.de/articles/named/iod-rbs-mirrors-clients</a> :awesome:(our toots use the 🛡️ to indicate RB. Our repo browser indicates RBs by shields, too, for the apps covered by one of our builders)

IzzyOnDroid ✅Welcome to the RB family, MSM 🥳<a href="https://apt.izzysoft.de/packages/com.prinzpiuz.msm" rel="nofollow noopener" translate="no" target="_blank">https://apt.izzysoft.de/packages/com.prinzpiuz.msm</a>MSM works as wrapper around your Media server (emby, jellyfin, kodi, plex) and helps you to manage your media files.Thanks to the help from its developer, starting with v1.9.0 the app is now reproducible :awesome:<a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#reproducibleBuilds</a> <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener" target="_blank">#IzzyOnDroid</a>

Robin CandauA lot of global improvements and achievements during this past month regarding reproducible builds 🎉 I also got a few upstream patches merged again 🥳<a href="https://reproducible-builds.org/reports/2025-03/" rel="nofollow noopener" translate="no" target="_blank">https://reproducible-builds.org/reports/2025-03/</a><a href="https://fosstodon.org/tags/reproduciblebuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#reproduciblebuilds</a>

Ian Brown 👨🏻‍💻In fact, governments probably should only EVER deploy executables they have built themselves, using their own compilers (see the classic computer science paper Reflections on Trusting Trust). You’d also need chip <a href="https://eupolicy.social/tags/microcode" class="mention hashtag" rel="nofollow noopener" target="_blank">#microcode</a> auditing and verification for security-critical systems. And some level of chip assurance. And 🇬🇧 Cell-like audits… Details to be determined 😉<a href="https://eupolicy.social/tags/ReproducibleBuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#ReproducibleBuilds</a> <a href="https://eupolicy.social/tags/StrategicAutonomy" class="mention hashtag" rel="nofollow noopener" target="_blank">#StrategicAutonomy</a> <a href="https://eupolicy.social/tags/audit" class="mention hashtag" rel="nofollow noopener" target="_blank">#audit</a> <a href="https://eupolicy.social/tags/escrow" class="mention hashtag" rel="nofollow noopener" target="_blank">#escrow</a>

cobratbq - cranky-by-designI'm going to put this out there, even though I have no stake in this, just because I think this isn't widely known: I have read/heard several comments concerning new <a href="https://mastodon.social/tags/Android" class="mention hashtag" rel="nofollow noopener" target="_blank">#Android</a> app stores popping up because F-Droid <a href="https://mastodon.social/tags/fdroid" class="mention hashtag" rel="nofollow noopener" target="_blank">#fdroid</a> supposedly "signs releases with its own signature".If you go into a bit more depth of how F-Droid works, you'll see that when builds are reproducible <a href="https://mastodon.social/tags/reproduciblebuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#reproduciblebuilds</a> , developers can also sign their apps with their own keys. That way, you have the best of both worlds: ..

IzzyOnDroid ✅You're interested in Reproducible Builds for Android apps? We've just updated our Wiki on those:<a href="https://gitlab.com/IzzyOnDroid/repo/-/wikis/Reproducible-Builds/" rel="nofollow noopener" translate="no" target="_blank">https://gitlab.com/IzzyOnDroid/repo/-/wikis/Reproducible-Builds/</a>There are new pages for setting up build recipes, and debugging/fixing RBs – which should help you when running your own builder. Which you btw can set up on your Linux machine within 5 minutes using the scripts provided at <a href="https://codeberg.org/IzzyOnDroid/rbuilder_setup" rel="nofollow noopener" translate="no" target="_blank">https://codeberg.org/IzzyOnDroid/rbuilder_setup</a> :awesome:Developers also find pages there on making/keeping their apps RB.<a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#reproducibleBuilds</a> <a href="https://floss.social/tags/Android" class="mention hashtag" rel="nofollow noopener" target="_blank">#Android</a> <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener" target="_blank">#IzzyOnDroid</a>

IzzyOnDroid ✅Welcome to the RB family, Farhan 🥳<a href="https://apt.izzysoft.de/packages/ly.com.tahaben.farhan" rel="nofollow noopener" translate="no" target="_blank">https://apt.izzysoft.de/packages/ly.com.tahaben.farhan</a>Farhan empowers you to take control of your digital experience. Say goodbye to manipulative strategies used by other apps and get ready to focus on what matters to you.Thanks to the work of Taha Ben Ashur, its developer, the app is now RB :awesome:<a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#reproducibleBuilds</a> <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener" target="_blank">#IzzyOnDroid</a>

IzzyOnDroid ✅Welcome to the RB family, WalkersGuide 🥳<a href="https://apt.izzysoft.de/packages/org.walkersguide.android" rel="nofollow noopener" translate="no" target="_blank">https://apt.izzysoft.de/packages/org.walkersguide.android</a>WalkersGuide is a navigational aid primarily intended for blind and visual impaired pedestrians. It calculates routes and shows nearby points of interest.Thanks to the help by its developer, the app is RB now :awesome:<a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#reproducibleBuilds</a> <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener" target="_blank">#IzzyOnDroid</a>

IzzyOnDroid ✅Welcome to the RB family, Rattlegram 🥳<a href="https://apt.izzysoft.de/packages/com.aicodix.rattlegram" rel="nofollow noopener" translate="no" target="_blank">https://apt.izzysoft.de/packages/com.aicodix.rattlegram</a>Rattlegram lets you transmit short text messages over COFDMTV encoded audio signals.Thanks to joined efforts with its developer, Rattlegram (along with its 2 sister-apps) is now RB :awesome:<a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#reproducibleBuilds</a> <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener" target="_blank">#IzzyOnDroid</a>

IzzyOnDroid ✅Welcome to the RB family, Inure 🥳<a href="https://github.com/Hamza417/Inure" rel="nofollow noopener" translate="no" target="_blank">https://github.com/Hamza417/Inure</a>Inure is a powerful open source applications manager and analyzer with a good-looking & easy to use interface.Joint efforts from 3 parties at work here. Most work was done by the developer (thank you, Hamza!) F-Droid devs joined in, and IzzyOnDroid's new builder tools finally brought in the victory on the developer's side. With the next sync, Inure will be available at IoD and F-Droid as RB :awesome:<a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#reproducibleBuilds</a> <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener" target="_blank">#IzzyOnDroid</a>

IzzyOnDroid ✅Cheers 🥂555 apps (43.1%)<a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#reproducibleBuilds</a> <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener" target="_blank">#IzzyOnDroid</a>

Kevin Karhan :verified:<a href="https://kolektiva.social/@licho" class="u-url mention" rel="nofollow noopener" target="_blank">@licho</a> <a href="https://hachyderm.io/@osman" class="u-url mention" rel="nofollow noopener" target="_blank">@osman</a> provide evidence the code <a href="https://mastodon.world/@signalapp" class="u-url mention" rel="nofollow noopener" target="_blank">@signalapp</a> released is actually being deployed.<ul><li>Whereas <a href="https://monocles.social/@monocles" class="u-url mention" rel="nofollow noopener" target="_blank">@monocles</a> has <a href="https://infosec.space/tags/ReproducibleBuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#ReproducibleBuilds</a> to the point that <a href="https://floss.social/@fdroidorg" class="u-url mention" rel="nofollow noopener" target="_blank">@fdroidorg</a> literally pulls their <code>git</code> and builds it from source.</li></ul>Not to mention pushing a <a href="https://infosec.space/tags/Shitcoin" class="mention hashtag" rel="nofollow noopener" target="_blank">#Shitcoin</a>-<a href="https://infosec.space/tags/Scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#Scam</a> (<a href="https://infosec.space/tags/MobileCoin" class="mention hashtag" rel="nofollow noopener" target="_blank">#MobileCoin</a>) disqualifies <a href="https://infosec.space/tags/Signal" class="mention hashtag" rel="nofollow noopener" target="_blank">#Signal</a> per very design! <a href="https://www.youtube.com/watch?v=tJoO2uWrX1M" rel="nofollow noopener" translate="no" target="_blank">https://www.youtube.com/watch?v=tJoO2uWrX1M</a><ul><li>Given the collection of <a href="https://infosec.space/tags/PII" class="mention hashtag" rel="nofollow noopener" target="_blank">#PII</a> like <a href="https://infosec.space/tags/PhoneNumbers" class="mention hashtag" rel="nofollow noopener" target="_blank">#PhoneNumbers</a>, the ability to restrict functionality based off those and the fact that <a href="https://infosec.space/tags/Signal" class="mention hashtag" rel="nofollow noopener" target="_blank">#Signal</a> is subject to <a href="https://infosec.space/tags/CloudAct" class="mention hashtag" rel="nofollow noopener" target="_blank">#CloudAct</a> make it inherently not trustworthy.</li></ul>And don't even get me started on the fact.it's not sustainable to run it as a <a href="https://infosec.space/tags/VCmoneyBurningParty" class="mention hashtag" rel="nofollow noopener" target="_blank">#VCmoneyBurningParty</a>!<ul><li>As soon as Signal becomes a problem, it will be taken offline, and due to the fact that it is <a href="https://infosec.space/tags/centralized" class="mention hashtag" rel="nofollow noopener" target="_blank">#centralized</a>, <a href="https://infosec.space/tags/proprietary" class="mention hashtag" rel="nofollow noopener" target="_blank">#proprietary</a>, <a href="https://infosec.space/tags/SingleVendor" class="mention hashtag" rel="nofollow noopener" target="_blank">#SingleVendor</a> & <a href="https://infosec.space/tags/SingleProvider" class="mention hashtag" rel="nofollow noopener" target="_blank">#SingleProvider</a> that's trivial for authorities.</li></ul>Same as identifying users: They already got a <a href="https://infosec.space/tags/PhoneNumber" class="mention hashtag" rel="nofollow noopener" target="_blank">#PhoneNumber</a> which in many juristictions one can't even obtain without <a href="https://infosec.space/tags/ID" class="mention hashtag" rel="nofollow noopener" target="_blank">#ID</a> legally, thus making it super easy to i.e. find and locate a user. Even tze cheapest LEAs can force their local M(V)NOs to <a href="https://infosec.space/tags/SS7" class="mention hashtag" rel="nofollow noopener" target="_blank">#SS7</a> a specific number...<ul><li>All these are unnecessary risks, that could've been avoided, but explicitly don't even get remediated retroactively!</li></ul>Again: Signal has a <a href="https://infosec.space/tags/Honeypot" class="mention hashtag" rel="nofollow noopener" target="_blank">#Honeypot</a> stench, and you better learn proper <a href="https://infosec.space/tags/E2EE" class="mention hashtag" rel="nofollow noopener" target="_blank">#E2EE</a>, <a href="https://infosec.space/tags/SelfCustody" class="mention hashtag" rel="nofollow noopener" target="_blank">#SelfCustody</a> and <a href="https://infosec.space/tags/TechLiteracy" class="mention hashtag" rel="nofollow noopener" target="_blank">#TechLiteracy</a> because <a href="https://web.archive.org/web/20210606070919/twitter.com/thegrugq/status/1085614812581715968" rel="nofollow noopener" target="_blank">corporations can't pull the 5th [Amendment] on your behalf!</a>

jbz"Over the last few releases, we changed our build infrastructure to make package builds reproducible. This is enough to reach 90%. The remaining issues need to be fixed in individual packages. After this Change, package builds are expected to be reproducible. Bugs will be filed against packages when an irreproducibility is detected. The goal is to have no fewer than 99% of package builds reproducible."<a href="https://www.phoronix.com/news/Fedora-43-Expect-Reproducible" rel="nofollow noopener" translate="no" target="_blank">https://www.phoronix.com/news/Fedora-43-Expect-Reproducible</a><a href="https://indieweb.social/tags/fedora" class="mention hashtag" rel="nofollow noopener" target="_blank">#fedora</a> <a href="https://indieweb.social/tags/reproduciblebuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#reproduciblebuilds</a> <a href="https://indieweb.social/tags/linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#linux</a> <a href="https://indieweb.social/tags/opensource" class="mention hashtag" rel="nofollow noopener" target="_blank">#opensource</a>

IzzyOnDroid ✅Oh, and the Readme of the rbuilder_setup repo needed a few updates as well 🙈 Done now: <a href="https://codeberg.org/IzzyOnDroid/rbuilder_setup" rel="nofollow noopener" translate="no" target="_blank">https://codeberg.org/IzzyOnDroid/rbuilder_setup</a>If you've set up a builder, we'd love to hear from your experiences – concerning the setup (was it easy enough and straight-forward?) as well as from operation :awesome:<a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#reproducibleBuilds</a> <a href="https://floss.social/tags/Android" class="mention hashtag" rel="nofollow noopener" target="_blank">#Android</a>

IzzyOnDroid ✅With our rbuilder_setup scripts now ready, the wiki page on Verification Builders has been updated, too:<a href="https://gitlab.com/IzzyOnDroid/repo/-/wikis/Reproducible-Builds/Verification-Builder" rel="nofollow noopener" translate="no" target="_blank">https://gitlab.com/IzzyOnDroid/repo/-/wikis/Reproducible-Builds/Verification-Builder</a><a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#reproducibleBuilds</a> <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener" target="_blank">#IzzyOnDroid</a>

IzzyOnDroid ✅Wanted to run your own builder for <a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener" target="_blank">#reproducibleBuilds</a> and were disappointed our RBuilder Setup was only available for Debian-based systems? Then we have good news for you: a few min ago, 2 PRs have been merged. The setup scripts now also support RPM & Arch based systems 🥳RPM/Arch lack packages for apksigner & dexdiff (which are needed for debugging). We're on it, those will follow hopefully soon™.Thanks to <a href="https://mastodon.social/@Iamlooker" class="u-url mention" rel="nofollow noopener" target="_blank">@Iamlooker</a> and Patrick (from FlorisBoard) for your help!<a href="https://codeberg.org/IzzyOnDroid/rbuilder_setup" rel="nofollow noopener" translate="no" target="_blank">https://codeberg.org/IzzyOnDroid/rbuilder_setup</a>

Recent searches

Search options

Administered by:

Server stats:

#reproduciblebuilds