---
layout: report
year: "2021"
month: "10"
title: "Reproducible Builds in October 2021"
draft: false
date: 2021-11-06 15:50:25
---

[![]({{ "/images/reports/2021-10/reproducible-builds.png#right" | relative_url }})](https://reproducible-builds.org/)

**Welcome to the October 2021 report from the [Reproducible Builds](https://reproducible-builds.org) project!**
{: .lead}

<br>

This month Samanta Navarro posted to the `oss-security` security mailing on a novel category of exploit in the `.tar` archive format, where a [single `.tar` file contains *different contents depending on the tar utility being used*](https://www.openwall.com/lists/oss-security/2021/10/03/1). Naturally, this has consequences for reproducible builds as Samanta goes onto reply:

> Arch Linux uses libarchive (bsdtar) in its build environment. The default tar
> program installed is GNU tar. It is possible to create a source distribution
> which leads to different files seen by the build environment than compared to
> a careful reviewer and other Linux distributions.

Samanta notes that addressing the tar utilities themselves will not be a
sufficient fix:

> I have submitted bug reports and patches to some projects but eventually I
> had to conclude that the problem itself cannot be fixed by these
> implementations alone. The best choice for these tools would be to only allow
> archives which are fully compatible to standards but this in turn would
> render a lot of archives broken.

Reproducible builds, with its twin ideas of reaching consensus on the build outputs as well as precisely recording and describing the build environment, would help address this problem at a higher level.

<br>

[![]({{ "/images/reports/2021-10/codethink.png#right" | relative_url }})](https://www.codethink.co.uk/)

[Codethink](https://www.codethink.co.uk/) announced that they had [achieved ISO-26262 ASIL D Tool Certification](https://www.codethink.co.uk/articles/2021/codethink-safety-certificate-exida/), a way of determining specific safety standards for software. Codethink used open source tooling to achieve this, but they also leverage:

> Reproducibility, repeatability and traceability of builds, drawing heavily on best-practices championed by the Reproducible Builds project.

<br>

Elsewhere on the internet, [according to a comment on Hacker News](https://news.ycombinator.com/item?id=28966022), Microsoft are now comparing [NPM](https://www.npmjs.com/) Javascript packages with their original source repositories:

> I got a PR in my repository a few days ago leading back to a team trying to make it easier for packages to be reproducible from source.

<br>

Lastly, Martin Monperrus [started an interesting thread on our mailing list](https://lists.reproducible-builds.org/pipermail/rb-general/2021-October/002412.html) about Github, specifically that their "autogenerated release tarballs are not deterministic". The thread [generated a significant number of replies](https://lists.reproducible-builds.org/pipermail/rb-general/2021-October/thread.html#2412) that are worth reading.

### Events and presentations

[![]({{ "/images/reports/2021-10/packagingcon.png#right" | relative_url }})](https://packaging-con.org/)

* [PackagingCon](https://packaging-con.org/) is a conference for developers of package management software, their communities and other stakeholders. This virtual event, which will take place on the **9th and 10th November 2021**, has a "mission is to bring different ecosystems together". The [schedule for the event](https://pretalx.com/packagingcon-2021/schedule/) is now available to view online.

* The Linux Foundation's [OpenSSF](https://openssf.org/) group announced that the next [OpenSSF quarterly town hall](https://openssf.org/townhalls/) will [take place on **15th November 2021**](https://openssf.org/blog/2021/10/25/openssf-quarterly-town-hall-announcement/). Registration is now open.

[![]({{ "/images/reports/2021-10/cip.png#right" | relative_url }})](https://cip-project.org/)

* Last month, Wolfgang Mauerer gave a presentation at the [MiniDebConf 2021 Regensburg](https://wiki.debian.org/DebianEvents/de/2021/MiniDebConfRegensburg//) about the [Civil Infrastructure Platform](https://www.cip-project.org/) that covered many subjects including Reproducible Builds.&nbsp;[PDF slides](https://salsa.debian.org/debconf-team/public/mini/de2020/-/raw/master/talks/Civil-Infrastructure-Platform.pdf) of the talk are available, as is a [video recording](https://meetings-archive.debian.net/pub/debian-meetings/2021/MiniDebConf-Regensburg/civil-infrastructure-platform.webm).

* In addition, Trevor Rosen from [SolarWinds](https://www.solarwinds.com/) presented at the Linux Foundation's [Supply Chain Security Con](https://events.linuxfoundation.org/supplychainsecuritycon-north-america/) last month on incorporating [*in-toto*](https://in-toto.io/) into their build system. *in-toto* a framework to secure the integrity of software supply chains. Trevor also discusses building everything twice to validate the first build à la reproducible builds. ([PDF slides](https://static.sched.com/hosted_files/supplychainsecurityconna21/df/SupplyChainCon-TrevorRosen-Keynote.pdf))

* Lastly, Mattia Rizzolo posted an update on the [next Reproducible Builds in-person event](https://lists.reproducible-builds.org/pipermail/rb-general/2021-October/002404.html) to our mailing list: "currently we are thinking ahead to 2022".

### Community news

On our [mailing list](https://lists.reproducible-builds.org/listinfo/rb-general/) this month:

* Jeremiah [announced the release](https://lists.reproducible-builds.org/pipermail/rb-general/2021-October/002392.html) of version 1.4 of [`stage0-posix`](https://github.com/oriansj/stage0-posix), part of a broader effort to provide an ultra-minimal "bootstrap seed" to increase trust in our software stack.

* Chris Lamb mentioned that [Azure are offering free compute power for open source projects](https://opensource.microsoft.com/azure-credits) which "might be useful for one of the many rebuilder projects".

* *kpcyrd* announced the [release of *rebuilderd* v0.15.0](https://lists.reproducible-builds.org/pipermail/rb-general/2021-October/002401.html), but also linked to a [Twitter thread that contains intro on how *rebuilderd* works](https://twitter.com/kpcyrd/status/1450091461714776069) and a walk-through on how to write custom integrations.

* Fredrik Strömberg [offered an update](https://lists.reproducible-builds.org/pipermail/rb-general/2021-October/002400.html) on the [*Sigsum*](https://www.sigsum.org/) project and some specific milestones within transparency logging efforts: "after a year of design iterations we have not only designed a transparency log but also decided to turn it into a project of its own".

<br>

[![]({{ "/images/reports/2021-10/website.png#right" | relative_url }})](https://reproducible-builds.org/)

There were quite a few changes to the [Reproducible Builds website and documentation](https://reproducible-builds.org/) this month as well, including Feng Chai updating some links on our 'publications' page&nbsp;[[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/1a62a4e)] and *marco* updated our project metadata around the [Bitcoin Core building guide](https://github.com/bitcoin/bitcoin/blob/master/contrib/guix/README.md)&nbsp;[[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/0f6cacd)].

<br>

Lastly, we ran another productive meeting on IRC during October. A [full set of notes](http://meetbot.debian.net/reproducible-builds/2021/reproducible-builds.2021-10-26-14.59.html) from the meeting is available to view.

<br>

### Distribution work

[![]({{ "/images/reports/2021-10/qubes.png#right" | relative_url }})](https://lwn.net/Articles/873255/)

Qubes was [heavily featured in the latest edition of Linux Weekly News](https://lwn.net/Articles/873255/), and a significant section was dedicated to discussing reproducibility. For example, it was mentioned that the "Qubes project has been working on [incorporating](https://www.qubes-os.org/news/2021/02/28/improvements-in-testing-and-building/) reproducible builds into its continuous integration (CI) infrastructure". But the LWN article goes on to describe that:

> The [current goal](https://www.qubes-os.org/news/2021/10/08/reproducible-builds-for-debian-a-big-step-forward/) is to be able to build the Qubes OS Debian templates solely from packages that can be built reproducibly.&nbsp;[Templates](https://www.qubes-os.org/doc/templates/) in Qubes OS are VM images that can be used to start an application qube quickly based on the template. The qube will have read-only access to the root filesystem of the template, so that the same root filesystem can be shared with multiple application qubes. There are official templates for several variants of both Fedora and Debian, as well as community maintained templates for several other distributions.

You can [view the whole article on LWN](https://lwn.net/Articles/873255/), and Frédéric also published a [lengthy summary about their work on reproducible builds in Qubes](https://www.qubes-os.org/news/2021/10/08/reproducible-builds-for-debian-a-big-step-forward/) as well for those wishing to learn more.

<br>

[![]({{ "/images/reports/2021-10/debian.png#right" | relative_url }})](https://debian.org/)

In Debian this month, 133 reviews of Debian packages were added, 81 were updated and 24 were removed this month, adding to [Debian's ever-growing knowledge about identified issues](https://tests.reproducible-builds.org/debian/index_issues.html). A number of issues were categorised and added by Chris Lamb and Vagrant Cascadian too [[...](https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/cb37fe47)][[...](https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/d67824a0)][[...](https://salsa.debian.org/reproducible-builds/reproducible-notes/commit/58a76f9c)]. In addition, work on alternative snapshot service has made progress by Frédéric Pierret and Holger Levsen this month, including moving from the existing host (*snapshot.notset.fr*) to *snapshot.reproducible-builds.org* ([more info](https://lists.reproducible-builds.org/pipermail/rb-general/2021-October/002428.html)) — thanks to [OSUOSL](https://osuosl.org/) for the machine and hosting and Debian for the disks.

<br>

Finally, Bernhard M. Wiedemann posted his [monthly reproducible builds status report](https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/OEMW25GJTNDVFIHARTBEJLEMWEKUV56F/).

<br>

### [*diffoscope*](https://diffoscope.org)

[![]({{ "/images/reports/2021-10/diffoscope.svg#right" | relative_url }})](https://diffoscope.org)

[*diffoscope*](https://diffoscope.org) is our in-depth and content-aware diff utility. Not only can it locate and diagnose reproducibility issues, it can provide human-readable diffs from many kinds of binary formats. This month, Chris Lamb made the following changes, including preparing and uploading versions 186, 187, 188 and 189 to Debian


* New features:

    * Add support for Python Sphinx inventory files (usually named `objects.inv` on-disk).&nbsp;[[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/880e81ea)]
    * Add support for comparing `.pyc` files. Thanks to Sergei Trofimovich for the inspiration.&nbsp;[[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/83e7f903)]
    * Try some alternative suffixes (e.g. `.py`) to support distributions that strip or retain them.&nbsp;[[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/e2d3abe8)][[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/d2ac5465)]

* Bug fixes:

    * Fix Python decompilation tests under Python 3.10+ [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/e8d5f6a8)] and for Python 3.7 [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/ade8e628)].
    * Don't raise a traceback if we cannot unmarshal Python bytecode. This is in order to support Python 3.7 failing to load `.pyc` files generated with newer versions of Python.&nbsp;[[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/286d5131)]
    * Skip Python bytecode testing where we do not have an expected diff.&nbsp;[[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/ef878eca)]

* Codebase improvements:

    * Use our `file_version_is_lt` utility instead of accepting both versions of uImage expected diff.&nbsp;[[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/970d21a2)]
    * Split out a custom call to `assert_diff` for a `.startswith` equivalent.&nbsp;[[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/daf549e4)]
    * Use `skipif` instead of manual conditionals in some tests.&nbsp;[[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/34df4921)]

In addition, Jelle van der Waa added external tool references for Arch Linux for `ocamlobjinfo`, `openssl` and `ffmpeg` [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/ee2fb1e9)][[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/c0d178f5)][[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/52630c75)] and added Arch Linux as a Continuous Integration (CI) test target.&nbsp;[[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/da8e2a35)] and Vagrant Cascadian updated the testsuite to skip Python bytecode comparisons when `file(1)` is older than 5.39.&nbsp;[[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/4f7d531d)] as well as added external tool references for the Guix distribution for `dumppdf` and `ppudump`.&nbsp;[[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/34cde92c)][[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/744ab18b)]. Vagrant Cascadian also updated the *diffoscope* package in [GNU Guix](https://www.gnu.org/software/guix/)&nbsp;[[...](https://git.savannah.gnu.org/cgit/guix.git/commit/?id=af4ce7bd413c3a50733bfcc05370903a1e3808bc)][[...](https://git.savannah.gnu.org/cgit/guix.git/commit/?id=52ab88a5aae15f031ba5046a2997b04aabbf188a)].

Lastly, Guangyuan Yang updated the FreeBSD package name on the website&nbsp;[[...](https://salsa.debian.org/reproducible-builds/diffoscope-website/commit/962ab69)], Mattia Rizzolo made a change to override a new Lintian warning due to the new test files&nbsp;[[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/1d6240fe)], Roland Clobus added support to detect and log if the `GNU_BUILD_ID` field in an ELF binary been modified&nbsp;[[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/4cbae2d1)], Sandro Jäckel updated a number of helpful links on the website&nbsp;[[...](https://salsa.debian.org/reproducible-builds/diffoscope-website/commit/d865cf3)] and Sergei Trofimovich made the uImage test output support `file(`) version 5.41&nbsp;[[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/74a59a8f)].


<br>

### [*reprotest*](https://tracker.debian.org/pkg/reprotest)

[*reprotest*](https://tracker.debian.org/pkg/reprotest) is the Reproducible Build's project end-user tool to build same source code twice in widely differing environments, checking the binaries produced by the builds for any differences.

This month, *reprotest* version `0.7.18` was [uploaded to Debian unstable](https://tracker.debian.org/news/1266892/accepted-reprotest-0718-source-into-unstable/) by Holger Levsen, which also included a change by Holger to clarify that Python 3.9 is used nowadays&nbsp;[[...](https://salsa.debian.org/reproducible-builds/reprotest/commit/880588d)], but it also included two changes by Vasyl Gello to implement "realistic" CPU architecture shuffling&nbsp;[[...](https://salsa.debian.org/reproducible-builds/reprotest/commit/15e3c65)] and to log the selected variations when the verbosity is configured at a sufficiently high level&nbsp;[[...](https://salsa.debian.org/reproducible-builds/reprotest/commit/a2911a6)]. Finally, Vagrant Cascadian [updated reprotest to version 0.7.18](https://git.savannah.gnu.org/cgit/guix.git/commit/?id=fb3b26b2ab73a2f0da4a3f3ae6e00ce098f9e610) in [GNU Guix](https://www.gnu.org/software/guix/).

<br>

### Upstream patches

The Reproducible Builds project detects, dissects and attempts to fix unreproducible packages. We try to send all of our patches upstream where appropriate. We authored a large number of such patches this month, including:

* Bernhard M. Wiedemann:

    * [`gtk4`](https://gitlab.gnome.org/GNOME/gtk/-/merge_requests/4077) (date-related issue)
    * [`ipxe`](https://build.opensuse.org/request/show/922815) (version upgrade)
    * [`libsoup2`](https://build.opensuse.org/request/show/922724) (build failure in the future)
    * [`pari`](https://bugzilla.opensuse.org/show_bug.cgi?id=1192192) (parallelism-related issue)

* Chris Lamb:

    * [#901307](https://bugs.debian.org/901307) filed against [`sphinx-gallery`](https://tracker.debian.org/pkg/sphinx-gallery) ([re-opened with extensive updates](https://bugs.debian.org/901307#54)).
    * [#995809](https://bugs.debian.org/995809) filed against [`libinput`](https://tracker.debian.org/pkg/libinput).
    * [#995865](https://bugs.debian.org/995865) filed against [`python-pipx`](https://tracker.debian.org/pkg/python-pipx).
    * [#996200](https://bugs.debian.org/996200) filed against [`node-inquirer`](https://tracker.debian.org/pkg/node-inquirer).
    * [#996674](https://bugs.debian.org/996674) filed against [`libminidns-java`](https://tracker.debian.org/pkg/libminidns-java).
    * [#996834](https://bugs.debian.org/996834) filed against [`pytools`](https://tracker.debian.org/pkg/pytools).
    * [#996881](https://bugs.debian.org/996881) filed against [`pikepdf`](https://tracker.debian.org/pkg/pikepdf).
    * [#996948](https://bugs.debian.org/996948) filed against [`sphinx`](https://tracker.debian.org/pkg/sphinx) ([forwarded upstream](https://github.com/sphinx-doc/sphinx/pull/9755))
    * [#996999](https://bugs.debian.org/996999) filed against [`fenics-basix`](https://tracker.debian.org/pkg/fenics-basix).
    * [#997000](https://bugs.debian.org/997000) filed against [`snakemake`](https://tracker.debian.org/pkg/snakemake).
    * [#997689](https://bugs.debian.org/997689) filed against [`smplayer`](https://tracker.debian.org/pkg/smplayer).
    * [#997949](https://bugs.debian.org/997949) filed against [`python-duniterpy`](https://tracker.debian.org/pkg/python-duniterpy).
    * [#998104](https://bugs.debian.org/998104) filed against [`afnix`](https://tracker.debian.org/pkg/afnix).
    * [#998059](https://bugs.debian.org/998059) filed against [`sphinx`](https://tracker.debian.org/pkg/sphinx) ([forwarded upstream](https://github.com/sphinx-doc/sphinx/issues/9778)).

* Vagrant Cascadian:

    * [#977684](https://bugs.debian.org/977684) filed against [`mahimahi`](https://tracker.debian.org/pkg/mahimahi) ([filed upstream](https://github.com/ravinet/mahimahi/pull/147)).
    * [#985187](https://bugs.debian.org/985187) filed against [`ffmpeg`](https://tracker.debian.org/pkg/ffmpeg) ([forwarded upstream](https://ffmpeg.org/pipermail/ffmpeg-devel/2021-October/287098.html))
    * [#995646](https://bugs.debian.org/995646) filed against [`abntex`](https://tracker.debian.org/pkg/abntex).
    * [#995647](https://bugs.debian.org/995647) filed against [`cfi`](https://tracker.debian.org/pkg/cfi).
    * [#995648](https://bugs.debian.org/995648) filed against [`cffi`](https://tracker.debian.org/pkg/cffi).
    * [#995650](https://bugs.debian.org/995650) filed against [`chktex`](https://tracker.debian.org/pkg/chktex).
    * [#995651](https://bugs.debian.org/995651) filed against [`fdutils`](https://tracker.debian.org/pkg/fdutils).
    * [#995652](https://bugs.debian.org/995652) filed against [`gnu-standards`](https://tracker.debian.org/pkg/gnu-standards).
    * [#995654](https://bugs.debian.org/995654) filed against [`malaga`](https://tracker.debian.org/pkg/malaga).
    * [#995741](https://bugs.debian.org/995741) filed against [`latex-mk`](https://tracker.debian.org/pkg/latex-mk).
    * [#995745](https://bugs.debian.org/995745) filed against [`kannel`](https://tracker.debian.org/pkg/kannel).
    * [#995747](https://bugs.debian.org/995747) filed against [`xnee`](https://tracker.debian.org/pkg/xnee).
    * [#995886](https://bugs.debian.org/995886), [#995896](https://bugs.debian.org/995896), [#995953](https://bugs.debian.org/995953) & [#995954](https://bugs.debian.org/995954) filed against [`cxref`](https://tracker.debian.org/pkg/cxref).
    * [#995960](https://bugs.debian.org/995960) filed against [`xnee`](https://tracker.debian.org/pkg/xnee).
    * [#996184](https://bugs.debian.org/996184) filed against [`binutils-or1k-elf`](https://tracker.debian.org/pkg/binutils-or1k-elf).
    * [#996194](https://bugs.debian.org/996194) & [#996572](https://bugs.debian.org/996572) filed against [`gcc-arm-none-eabi`](https://tracker.debian.org/pkg/gcc-arm-none-eabi).
    * [#996599](https://bugs.debian.org/996599) filed against [`xdmf`](https://tracker.debian.org/pkg/xdmf).
    * [#996679](https://bugs.debian.org/996679) filed against [`flightgear`](https://tracker.debian.org/pkg/flightgear).
    * [#997036](https://bugs.debian.org/997036) & [#997037](https://bugs.debian.org/997037) filed against [`kvirc`](https://tracker.debian.org/pkg/kvirc).

<br>

### Testing framework

[![]({{ "/images/reports/2021-10/testframework.png#right" | relative_url }})](https://tests.reproducible-builds.org/)

The Reproducible Builds project runs a testing framework at [tests.reproducible-builds.org](https://tests.reproducible-builds.org), to check packages and other artifacts for reproducibility. This month, the following changes were made:

* Holger Levsen:

    * [Debian](https://debian.org)-related changes:

        * Incorporate a fix from *bremner* into '`builtin-pho`' related to binary-NMUs.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/cfe68cba)]
        * Keep *bullseye* environments around longer, in an attempt to fix a Jenkins issue.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/878ada14)]
        * Improve the documentation of `buildinfos.debian.net`.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/ef18fb87)]
        * Improve documentation for the '`builtin-pho`' setup.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/fc01549e)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/ec2f1754)]

    * [OpenWrt](https://openwrt.org)-related changes:

        * Also use -j1 for better debugging.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/d0853ec4)]
        * Document that that Python 3.x is now used.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/c0ffc4ad)]
        * Enable further debugging for the toolchain build.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/985e6231)]

    * New `snapshot.reproducible-builds.org` service:

        * Actually add new node.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/c2344063)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/2c6e55af)]
        * Install `xfsprogs` on `snapshot.reproducible-builds.org`.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/cd334d27)]
        * Create account for `fpierret` on new node.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/50e16fb9)]
        * Run `node_health_check` job on new node too.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/2045b027)]

* Mattia Rizzolo:

    * [Debian](https://debian.org)-related changes:

        * Handle schroot errors when invoking *diffoscope* instead of masking them.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/9b0620f6)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/f831f1a1)]
        * Declare and define some variables separately to avoid masking the subshell return code.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/532d3a0b)]
        * Fix variable name.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/97e76c98)]
        * Improve log reporting.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/299ab336)]
        * Execute `apt-get update` with the `-q` argument to get more decent logs.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/9b13cfd5)]
        * Set the Debian HTTP mirror and proxy for `snapshot.reproducible-builds.org`.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/9dea33de)]
        * Install the `libarchive-tools` package (instead of `bsdtar`) when updating Jenkins nodes.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/180cb3de)]

    * Be stricter about errors when starting the node agent&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/131eb841)] and don't overwrite NODE\_NAME so that we can expect Jenkins to properly set for us&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/2af6c39e)].
    * Explicitly warn if the `NODE_NAME` is not a fully-qualified domain name (FQDN).&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/2828b20f)]
    * Document whether a node runs in the future.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/66a44b4f)]
    * Disable `postgresql_autodoc` as it not available in bullseye.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/ed92df9b)]
    * Don't be so eager when deleting schroot internals, call to schroot -e to terminate the schroots instead.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/ab993ac3)]
    * Only consider `schroot` underlays for deletion that are over a month old.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/3537b671)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/b30138a6)]
    * Only try to unmount `/proc` if it's actually mounted.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/fa802be1)]
    * Move the `db_backup` task to its own Jenkins job.&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/02fccbf3)]

Lastly, Vasyl Gello added usage information to the `reproducible_build.sh` script&nbsp;[[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/54c427b5)].

<br>

### Contributing

If you are interested in contributing to the Reproducible Builds project, please visit our [*Contribute*](https://reproducible-builds.org/contribute/) page on our website. However, you can get in touch with us via:

 * IRC: `#reproducible-builds` on `irc.oftc.net`.

 * Twitter: [@ReproBuilds](https://twitter.com/ReproBuilds)

 * Mailing list: [`rb-general@lists.reproducible-builds.org`](https://lists.reproducible-builds.org/listinfo/rb-general)