---
layout: report
year: "2023"
month: "09"
title: "Reproducible Builds in September 2023"
draft: false
date: 2023-10-12 16:22:23
---
**Welcome to the September 2023 report from the [Reproducible Builds]({{ "/" | relative_url }}) project**
{: .lead}
[![]({{ "/images/reports/2023-09/reproducible-builds.png#right" | relative_url }})](https://reproducible-builds.org/)
In these reports, we outline the most important things that we have been up to over the past month. As a quick recap, whilst anyone may inspect the source code of free software for malicious flaws, almost all software is distributed to end users as pre-compiled binaries.
[![]({{ "/images/reports/2023-09/all-systems-go.png#right" | relative_url }})](https://cdn.media.ccc.de/events/all_systems_go/2023/h264-hd/asg2023-219-eng-Fast_correct_reproducible_builds_with_Nix_Bazel_hd.mp4)
Andreas Herrmann gave a talk at [All Systems Go 2023](https://cfp.all-systems-go.io/all-systems-go-2023/schedule/) titled "[Fast, correct, reproducible builds with Nix and Bazel](https://cfp.all-systems-go.io/all-systems-go-2023/talk/77YDZ8/)". Quoting from the talk description:
> You will be introduced to Google’s open source build system [Bazel](https://bazel.build/), and will learn how it provides fast builds, how correctness and reproducibility is relevant, and how Bazel tries to ensure correctness. But, we will also see where Bazel falls short in ensuring correctness and reproducibility. You will [also] learn about the purely functional package manager Nix and how it approaches correctness and build isolation. And we will see where Bazel has an advantage over Nix when it comes to providing fast feedback during development.
Andreas also shows how you can get the best of both worlds and combine Nix and Bazel, too. A [video of the talk](https://cdn.media.ccc.de/events/all_systems_go/2023/h264-hd/asg2023-219-eng-Fast_correct_reproducible_builds_with_Nix_Bazel_hd.mp4) is available.
[![]({{ "/images/reports/2023-09/diffoscope.png#right" | relative_url }})](https://diffoscope.org)
[diffoscope](https://diffoscope.org) is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb fixed compatibility with [`file(1)`](http://www.darwinsys.com/file/) version 5.45 [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/a0a02057)] and updated some documentation [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/58bcc17a)]. In addition, Vagrant Cascadian extended support for GNU Guix [[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/f0986b1d)][[...](https://salsa.debian.org/reproducible-builds/diffoscope/commit/8f057621)] and updated the version in that distribution as well. [[...](https://issues.guix.gnu.org/65791)].
[![]({{ "/images/reports/2023-09/summit.jpg#right" | relative_url }})]({{ "/events/hamburg2023/" | relative_url }})
Yet another reminder that our [upcoming Reproducible Builds Summit]({{ "/events/hamburg2023/" | relative_url }}) is set to take place from **October 31st — November 2nd 2023** in Hamburg, Germany.
If you haven't been before, our summits are a unique gathering that brings together attendees from diverse projects, united by a shared vision of advancing the Reproducible Builds effort. During this enriching event, participants will have the opportunity to engage in discussions, establish connections and exchange ideas to drive progress in this vital field.
If you're interested in joining us this year, please make sure to read the [event page]({{ "/events/hamburg2023/" | relative_url }}), the [news item]({{ "/news/2023/07/05/reproducible-builds-hamburg-meeting/" | relative_url }}), or the [invitation email](https://lists.reproducible-builds.org/pipermail/rb-general/2023-August/003057.html) that Mattia Rizzolo sent out recently, all of which have more details about the event and location.
We are also still looking for [sponsors to support the event]({{ "/images/hamburg2023/sponsor_invitation.pdf" | relative_url }}), so please reach out to the [organising team](mailto:2023-summit-team@lists.reproducible-builds.org) if you are able to help. Also note that [PackagingCon 2023](https://packaging-con.org/) is taking place in Berlin just before our summit.
On the Reproducible Builds website, Greg Chabala updated [the JVM-related documentation]({{ "/docs/jvm/" | relative_url }}) to update a link to the [`BUILDSPEC.md`](https://github.com/jvm-repo-rebuild/reproducible-central/blob/master/doc/BUILDSPEC.md) file. [[...](https://salsa.debian.org/reproducible-builds/reproducible-website/commit/5bc54c52)] And Fay Stegerman [fixed the builds failing because of a YAML syntax error](https://salsa.debian.org/reproducible-builds/reproducible-website/-/commit/eddc27b0).
### Distribution work
[![]({{ "/images/reports/2023-09/debian.png#right" | relative_url }})](https://debian.org/)
In Debian, this month:
* Debian bug [#940234](https://bugs.debian.org/940234) was originally opened in September 2019 by Aurelien Jarno to request that Debian "add a new requirement that repeatedly building the source package in the same environment produces identical `.dsc` file modulo the GPG signature". This month, however, Russ Allbery closed the bug due to [concerns about the viability of source reproducibility](https://bugs.debian.org/940234#57).
* 10 reviews of Debian packages were added, 56 were updated and 68 were removed this month adding to [our knowledge about identified issues](https://tests.reproducible-builds.org/debian/index_issues.html).
* Bastian Blank posted a mail to a number of Debian mailing lists titled "[Upcoming changes to Debian Linux kernel packages](https://lists.debian.org/msgid-search/20230924130147.qwnjrq4nvkm75wbt@shell.thinkmo.de/firsthit)". Under *Kernel modules will be signed with an ephemeral key*, Bastian wrote: "Yes, this will make the build unreproducible, but no better solution currently exists."
* Vagrant Cascadian posted about [various experiments with verification builds for Debian](https://lists.reproducible-builds.org/pipermail/rb-general/2023-September/003076.html) and [snapshotting the Debian archive](https://lists.reproducible-builds.org/pipermail/rb-general/2023-September/003085.html)
[![]({{ "/images/reports/2023-09/fdroid.png#right" | relative_url }})](https://f-droid.org/en/)
September saw F-Droid add ten new reproducible apps, and one existing app switched to reproducible builds. In addition, two reproducible apps were archived and one was disabled for a current total of 199 apps published with Reproducible Builds and using the upstream developer's signature. [[…](https://gitlab.com/obfusk/fdroid-misc-scripts/-/blob/master/reproducible/overview.md)] In addition, an extensive blog post was posted on [*f-droid.org*](https://f-droid.org/) titled "[*Reproducible builds, signing keys, and binary repos*](https://f-droid.org/2023/09/03/reproducible-builds-signing-keys-and-binary-repos.html)".
## Upstream patches
The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where appropriate. This month, we wrote a large number of such patches, including:
* [openSUSE monthly](https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/XIYVRAJLXYEGYQDPLRQNKKNEW6YLHBLE/)
* Bernhard M. Wiedemann:
* [`linuxsampler`](https://build.opensuse.org/request/show/1110543) (benchmarking issue)
* [`antlr3`](https://build.opensuse.org/request/show/1111485) (date)
* [`rpm`](https://build.opensuse.org/request/show/1112212) (embeds too many build details)
* [`seamonkey`](https://build.opensuse.org/request/show/1114150) (date)
* [`conky`](https://github.com/brndnmtthws/conky/pull/1619) (date and ordering-related issue)
* [`lsp-plugins-shared`](https://github.com/lsp-plugins/lsp-plugins-shared/pull/5) (date/copyright year issue)
* [`build-compare`](https://github.com/openSUSE/build-compare/issues/65)
* [`helix`](https://code.opensuse.org/package/helix/blob/feee6e9d8f1ad5b2396a4bed7917eb6536ae4d57/f/0001-fix-ub-in-diff-gutter.patch) (ASLR-related non-determinism)
* [`intel-graphics-compiler`](https://github.com/intel/intel-graphics-compiler/issues/302) (ASLR)
* Chris Lamb:
* [#1052950](https://bugs.debian.org/1052950) filed against [`sphinxcontrib-mermaid`](https://tracker.debian.org/pkg/sphinxcontrib-mermaid).
* [#1052970](https://bugs.debian.org/1052970) filed against [`mkdocs-material`](https://tracker.debian.org/pkg/mkdocs-material).
* [#1052989](https://bugs.debian.org/1052989) filed against [`apophenia`](https://tracker.debian.org/pkg/apophenia).
* [#1053205](https://bugs.debian.org/1053205) filed against [`lapackpp`](https://tracker.debian.org/pkg/lapackpp).
* [#1053263](https://bugs.debian.org/1053263) filed against [`blaspp`](https://tracker.debian.org/pkg/blaspp).
* Fridrich Strba applied 124 Java-related patches into [openSUSE](https://www.opensuse.org/):
* [`mysql-connector-java`](https://github.com/bmwiedemann/openSUSE/commit/628c90dad88383ef4f2364ad9e5f0b2d808a1b24), [`java-21-openjdk`](https://github.com/bmwiedemann/openSUSE/commit/02d54096fbf3c87d649e20ba43613645c6abab3c), [`apache-ivy`](https://github.com/bmwiedemann/openSUSE/commit/cb6f0f79d8b6ef2fae47853cf5d261d71151dd5a), [`maven-assembly-plugin`](https://github.com/bmwiedemann/openSUSE/commit/5a7aece151f6b8bded57f4a5540b499365e2bf5c), [`eclipse`](https://github.com/bmwiedemann/openSUSE/commit/ef06dc068a050d47bef1fb585f42021abd246ad6), [`antlr3`](https://github.com/bmwiedemann/openSUSE/commit/eb53155b97d331b311acc1f2674d45d4e4e22353), [`groovy18`](https://github.com/bmwiedemann/openSUSE/commit/f5e866820cb6222702bcf2ba5a8d6d0303492d3c), [`hbci4java`](https://github.com/bmwiedemann/openSUSE/commit/9a386b96c3d9dad2a6eab5f93f8f88ebf65f7300), [`ini4j`](https://github.com/bmwiedemann/openSUSE/commit/cb5ac1c6188b785373058dd303f9a23b2e87e9a9), [`hppc`](https://github.com/bmwiedemann/openSUSE/commit/5b70d4aab8e07da164907d3db9ec9f084fd5e982), [`checkstyle`](https://github.com/bmwiedemann/openSUSE/commit/d2c73692591575873a60fd8e47796e24af2d8994), [`glassfish-jaxb`](https://github.com/bmwiedemann/openSUSE/commit/2f2ec328f1506b8e9db92b84b8a40051a780ade7), [`tycho`](https://github.com/bmwiedemann/openSUSE/commit/ce24ff2f994b1e4f3a90c4eb757e1b1ad30a7a8a), [`xmvn`](https://github.com/bmwiedemann/openSUSE/commit/53524f50a1e9ddd3c16ee6683555683ca70f5212), [`mockito`](https://github.com/bmwiedemann/openSUSE/commit/267fda705161e0085ad2170661cde5ebf26595f8), [`languagetool`](https://github.com/bmwiedemann/openSUSE/commit/9d8a7a8c4546770338f94eb6b86ff5a982da3be5), [`json-lib`](https://github.com/bmwiedemann/openSUSE/commit/a22c22b64aa3d9213bb82a62b7e4f17d5d72b964), [`jnr-unixsocket`](https://github.com/bmwiedemann/openSUSE/commit/c744bdd8b2ea5ea934e380fc1ad4adbcb7e6231b), [`jnr-ffi`](https://github.com/bmwiedemann/openSUSE/commit/43fdbdb41085186426c0bbec4c926246377f1d16), [`jnr-enxio`](https://github.com/bmwiedemann/openSUSE/commit/b6b994a15e9d4ac67e6455d62734461ef34be79c), [`jboss-jaxrs-2.0-api`](https://github.com/bmwiedemann/openSUSE/commit/d4992c8c5e77aff53166dad2261efcc44eb6ede7), [`istack-commons`](https://github.com/bmwiedemann/openSUSE/commit/65dae6bcce32a3540cd27bbb3d410154c22608e7), [`rxtx-java`](https://github.com/bmwiedemann/openSUSE/commit/bb2912545030ab58f0d6a8141767cdad9c18bd59), [`glassfish-jaxb`](https://github.com/bmwiedemann/openSUSE/commit/c5a76c14560da07f0d545611ff4df3027fc6d606), [`glassfish-hk2`](https://github.com/bmwiedemann/openSUSE/commit/0f1235e660217329c3c0ddd760c3dff861a0fc74), [`findbugs`](https://github.com/bmwiedemann/openSUSE/commit/241e3e20fc411c9846c6b253136f611065c77a26), [`docker-client-java`](https://github.com/bmwiedemann/openSUSE/commit/59bb4ca434d401244aa5deccadee202d52f68b31), [`maven`](https://github.com/bmwiedemann/openSUSE/commit/5c8bab6a3048d8dec8fe0d7ac64dac6619d5788b), [`xmvn-connector-ivy`](https://github.com/bmwiedemann/openSUSE/commit/0e5e2e2c534d22efb7a7f54d8ec839b58db86fb3), [`xmlstreambuffer`](https://github.com/bmwiedemann/openSUSE/commit/e5c4c10ca0763ed15b75a84dd14bc5512aa9b42e), [`checkstyle`](https://github.com/bmwiedemann/openSUSE/commit/e55c3f454d6427f87e5812021894284d81a8e3ed), [`cglib`](https://github.com/bmwiedemann/openSUSE/commit/da6014bafc241ce143db654b2bc23a89c8094ac7), [`bean-validation-api`](https://github.com/bmwiedemann/openSUSE/commit/960b4e888f80b228135cc234477ac9e09e61eb15), [`aws-sdk-java`](https://github.com/bmwiedemann/openSUSE/commit/f0a1e21679a8bc35d30f57863d1f3b79c3380ce6), [`javapackages-tools`](https://github.com/bmwiedemann/openSUSE/commit/be5423ce10fef9a38e3cc7e86d380dc1d04fd5c6), [`ant`](https://github.com/bmwiedemann/openSUSE/commit/992a24a1fb6942e1752591296f4e4ee6bb9ee403), [`scala`](https://github.com/bmwiedemann/openSUSE/commit/3ea3c866ea32bf816f9d5a6a2f96b02b56e77988), [`osgi-service-log`](https://github.com/bmwiedemann/openSUSE/commit/c6654440f405cd682d662bd44a716a6807e3703f), [`jmdns`](https://github.com/bmwiedemann/openSUSE/commit/5dd404fcd577e7a36e4a95599407fbf31ddf95de), [`xml-security`](https://github.com/bmwiedemann/openSUSE/commit/e680dc065aeaa3ca03ba4f4730e81410da93d8a9), [`super-csv`](https://github.com/bmwiedemann/openSUSE/commit/cab5002161a888e8f59b99604edf48cfcb956212), [`osgi-service-jdbc`](https://github.com/bmwiedemann/openSUSE/commit/677c6d8e62609e3a25af6265109db40afca97c3f), [`msv`](https://github.com/bmwiedemann/openSUSE/commit/28c8aad118f6e5bb9875531f3a9d8268e13c510e), [`junit5`](https://github.com/bmwiedemann/openSUSE/commit/7a1defefce39e675b764e659b8e633cbcddeae88), [`jsr-311`](https://github.com/bmwiedemann/openSUSE/commit/197c227c2238421106f22bf604713a053e10b59a), [`jersey`](https://github.com/bmwiedemann/openSUSE/commit/d74346a8567addd60d16501ae458e1e98df8e708), [`itextpdf`](https://github.com/bmwiedemann/openSUSE/commit/464a350f091790c4bd36b6d854bd7a5b3a45aa9f), [`httpcomponents-asyncclient`](https://github.com/bmwiedemann/openSUSE/commit/cef76825846c02aabbbfef7cd370c7c2cb0496c2), [`ed25519-java`](https://github.com/bmwiedemann/openSUSE/commit/0569f1225068418767c6e1b780532a07ce36db28), [`jnacl`](https://github.com/bmwiedemann/openSUSE/commit/7d8a8dc5aea7b3a6da829c5633f075e88ea1414f), [`javaparser`](https://github.com/bmwiedemann/openSUSE/commit/bf8248211419a4ca91dc475b03870b536c0a8bb9), [`picocli`](https://github.com/bmwiedemann/openSUSE/commit/39ec1c5b43cad91cf8902c60fee0a701018e6b19), [`freemarker`](https://github.com/bmwiedemann/openSUSE/commit/d6896f46ddce39379c0275bdbbf70ed7e2889115), [`extra166y`](https://github.com/bmwiedemann/openSUSE/commit/f1a950a97bb379b38151bf3355d61b3b38a8c45f), [`javaparser`](https://github.com/bmwiedemann/openSUSE/commit/d0dc7b004ad283f551f20afa7b10dc0ddc2d3112), [`xstream`](https://github.com/bmwiedemann/openSUSE/commit/fb9881c3fd0b70c35e123d95615b0c32f2a53f61), [`woodstox-core`](https://github.com/bmwiedemann/openSUSE/commit/1a155bec00573373af930d89f973a6228951e0fb), [`uom-lib`](https://github.com/bmwiedemann/openSUSE/commit/e739234a8f07770d575086568401dfeccec58a07), [`unit-api`](https://github.com/bmwiedemann/openSUSE/commit/77f38f27522e64ca2105c5d7c8d37ca8450552ae), [`uncommons-maths`](https://github.com/bmwiedemann/openSUSE/commit/c1ab0df331ae3244c4d5e4b82f4ce22e925c5763), [`tycho`](https://github.com/bmwiedemann/openSUSE/commit/5056f98755fcd88eb18dce1070432efa345ac649), [`treelayout`](https://github.com/bmwiedemann/openSUSE/commit/a3da0c35a06f3d7bb654c95461d7df4f5a3dfed8), [`tiger-types`](https://github.com/bmwiedemann/openSUSE/commit/07fd846daac91df84bb0bf3293d23ea0cf9605bb), [`super-csv`](https://github.com/bmwiedemann/openSUSE/commit/021c838e260e384c02a2dea35a5eab3bd180fd36), [`stax-ex`](https://github.com/bmwiedemann/openSUSE/commit/ae827d0bfbf986c3d425e148e2a222d9e3f24a25), [`stax2-api`](https://github.com/bmwiedemann/openSUSE/commit/18fec898d32242d86485ca093ad441541ec1efed), [`sqlite-jdbc`](https://github.com/bmwiedemann/openSUSE/commit/19f6e01b2fca1596493b981283efc94a4231de0d), [`reflectasm`](https://github.com/bmwiedemann/openSUSE/commit/867ebbac93ec28f8f4c2fba1c9490c07a3a40a93), [`prometheus-simpleclient-java`](https://github.com/bmwiedemann/openSUSE/commit/840897e7ab694f229eb772670e6a40e7210bab39), [`powermock`](https://github.com/bmwiedemann/openSUSE/commit/cd916ba40053021bd0de8f5a5dd4e239c89e29b0), [`paranamer`](https://github.com/bmwiedemann/openSUSE/commit/13ab6315a75cf4278e8abe2d95849fda5eccbd0b), [`opennlp`](https://github.com/bmwiedemann/openSUSE/commit/3485a34e71d88345898337dc1601e71728ef2a4c), [`netty3`](https://github.com/bmwiedemann/openSUSE/commit/6faf212adb841d2ff461b16257ef5c89b4ee7353), [`mybatis`](https://github.com/bmwiedemann/openSUSE/commit/87fd0ce29a189c47971f3fb3c2cec4bcf5c60093), [`morfologik-stemming`](https://github.com/bmwiedemann/openSUSE/commit/cc0cd99c5d95c2347cf7b8f33d1089d88b0de718), [`minlog`](https://github.com/bmwiedemann/openSUSE/commit/827ea35529e42413c973154b8369449f236f26c7), [`maven-archetype`](https://github.com/bmwiedemann/openSUSE/commit/1d32b8adb3f4a02c1e954ac3dd9b6de0ea68d84a), [`mariadb-java-client`](https://github.com/bmwiedemann/openSUSE/commit/4557dc32917ca3e5c80f525d7f89c817fb8ff8ab), [`logback`](https://github.com/bmwiedemann/openSUSE/commit/15cb6db0c976dee88c264429f0a4eb81209822eb), [`kryo`](https://github.com/bmwiedemann/openSUSE/commit/f5a602f24f4d1b98b1d5ad4eb8a82e8707993544), [`jsonp`](https://github.com/bmwiedemann/openSUSE/commit/dc39c28cee06618b60d932ac223652d0e5c49f2e), [`jopt-simple`](https://github.com/bmwiedemann/openSUSE/commit/2187140e905f4cc06fe4e1c2e067c2a1f32512c2), [`jnr-posix`](https://github.com/bmwiedemann/openSUSE/commit/b9fb54a814a5852e9f9e8ce995aa521132c3aa58), [`jnr-constants`](https://github.com/bmwiedemann/openSUSE/commit/446361efb149b91bbe01f5424114ea478358ce59), [`jnr-a64asm`](https://github.com/bmwiedemann/openSUSE/commit/408da44863309fab2628c64508187def98a55674), [`jfreechart`](https://github.com/bmwiedemann/openSUSE/commit/c4e7352452242528fb8c430037489078c3fd3af5), [`jffi`](https://github.com/bmwiedemann/openSUSE/commit/264fab32abd04c22c30e6f01b57760dd55a46ad2), [`jetty-schemas`](https://github.com/bmwiedemann/openSUSE/commit/0e0ad06d5f4f59372cd74e623c32d9e648c8c8f3), [`jetty-minimal`](https://github.com/bmwiedemann/openSUSE/commit/a80bb85ce78ee967a9e29a093a5c9e3b41534903), [`jeromq`](https://github.com/bmwiedemann/openSUSE/commit/9bfb36da2e46fb8b0429bab8276be8494d58eb94), [`jctools`](https://github.com/bmwiedemann/openSUSE/commit/69909e93280d17283c3b3cb837e20b6ad25defea), [`jcsp`](https://github.com/bmwiedemann/openSUSE/commit/8ef7d30e02e39bcc1e7919766c7b688a7e4d1caa), [`jboss-websocket-1.0-api`](https://github.com/bmwiedemann/openSUSE/commit/36885173b0be96957f3470e2a05be29d6833fbb1), [`jboss-marshalling`](https://github.com/bmwiedemann/openSUSE/commit/a58f05cd6af66605b98e778b67ee4eb7e484cb3f), [`jboss-logmanager`](https://github.com/bmwiedemann/openSUSE/commit/3918aee4f04044dcc2146ba64db219759e4912cc), [`jboss-logging`](https://github.com/bmwiedemann/openSUSE/commit/7c2f3b06fb1f3a138face6ccc59622272bdcf265), [`javaewah`](https://github.com/bmwiedemann/openSUSE/commit/a15c5dfa79a739c5e54d6178bc145dfa78a74d92), [`jatl`](https://github.com/bmwiedemann/openSUSE/commit/78421ab2142cf61fc193e0f0e7a2c288401887e8), [`janino`](https://github.com/bmwiedemann/openSUSE/commit/9a186b2182e0e284d115d1849f3ae918ab9febea), [`jackson-modules-base`](https://github.com/bmwiedemann/openSUSE/commit/5437561ef780fdff13c8ee17506b4d302374f3f8), [`jackson-jaxrs-providers`](https://github.com/bmwiedemann/openSUSE/commit/697c57e7263af607e29c1a5234fb6f8dadb90408), [`jackson-datatypes-collections`](https://github.com/bmwiedemann/openSUSE/commit/3c40b6e74a6a42f86ed979727a27cdfe60143966), [`jackson-dataformat-xml`](https://github.com/bmwiedemann/openSUSE/commit/5a4eecdb5ed32e87516e3effeef7f75dfe09e5cc), [`jackson-dataformats-text`](https://github.com/bmwiedemann/openSUSE/commit/cf6b2241605805c975c14c15db3be55224e50094), [`jackson-dataformats-binary`](https://github.com/bmwiedemann/openSUSE/commit/c7f46f1dfc56c53c2b2ca2a897831c076b1979cc), [`indriya`](https://github.com/bmwiedemann/openSUSE/commit/ca9f70ee871ea7cb2dabbfd81a269ad189c561b9), [`google-gson`](https://github.com/bmwiedemann/openSUSE/commit/b6d647ce9d7710db5a965cbd9a59d73110b87c1e), [`glassfish-websocket-api`](https://github.com/bmwiedemann/openSUSE/commit/f9978bb106a6bf0719aab6e6e727fd2240d07d47), [`glassfish-transaction-api`](https://github.com/bmwiedemann/openSUSE/commit/59c7eee0d95ea6786100b2b4c99cf0e95a2be4a5), [`glassfish-jsp`](https://github.com/bmwiedemann/openSUSE/commit/3c7a31c268cb613a170129284d1f2dad1162575a), [`glassfish-jax-rs-api`](https://github.com/bmwiedemann/openSUSE/commit/9d6daa1085c6d6ba35d50f40ac552942d9df3c3a), [`glassfish-hk2`](https://github.com/bmwiedemann/openSUSE/commit/7c99433f098bab5d1f49ff5c9fa53d29723d737c), [`glassfish-fastinfoset`](https://github.com/bmwiedemann/openSUSE/commit/0ba5e1c83d695e78dfc1eaa32af57b31b6071274), [`felix-scr`](https://github.com/bmwiedemann/openSUSE/commit/dd7015c2d549220c0e5db05bf47d7655ed65dce1), [`felix-gogo-shell`](https://github.com/bmwiedemann/openSUSE/commit/a115b7e085aaf3164c227200a691a99d02fc162b), [`felix-gogo-command`](https://github.com/bmwiedemann/openSUSE/commit/c2b7f0d1b8f87e31d67dd968e8f16b3d7f3f3e20), [`disruptor`](https://github.com/bmwiedemann/openSUSE/commit/72ed04a5ec08d0f5372f3c6e1cab7811b3317233), [`apache-commons-ognl`](https://github.com/bmwiedemann/openSUSE/commit/7d999eb2ffc77e83d8c91d2fff1762c9733b4d0f), [`apache-commons-math`](https://github.com/bmwiedemann/openSUSE/commit/db6529fef8a58581e12502e9f70e6c6f1f139d83), [`apache-commons-csv`](https://github.com/bmwiedemann/openSUSE/commit/42d244a754aef2b752b46a606c5a8c1b16a63e79), [`antlr4`](https://github.com/bmwiedemann/openSUSE/commit/5b522f33499adf37ae44eb233ff405afc36e4bf3), [`jettison`](https://github.com/bmwiedemann/openSUSE/commit/c9ae6e816e9858064ed0ff97ec841e25ba5ad599), [`sisu`](https://github.com/bmwiedemann/openSUSE/commit/1dc23b3d72df06c4d71eb99d736cacbe5c9740f0), [`maven`](https://github.com/bmwiedemann/openSUSE/commit/16f034e19a36add5eab6d3d96e2825b19ba752f8)
* Pol Dellaiera:
* Since version 2.6.4, Composer (the PHP package manager) is now fully reproducible. See the work in the [corresponding PR](https://github.com/composer/composer/pull/11663).
## Testing framework
[![]({{ "/images/reports/2023-09/testframework.png#right" | relative_url }})](https://tests.reproducible-builds.org/)
The Reproducible Builds project operates a comprehensive testing framework (available at [tests.reproducible-builds.org](https://tests.reproducible-builds.org)) in order to check packages and other artifacts for reproducibility. In September, a number of changes were made by Holger Levsen:
* Disable `armhf` and `i386` builds due to Debian bug [#1052257](https://bugs.debian.org/1052257). [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/dce8e9b32)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/a52db3412)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/c3644e4af)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/4fca345f7)]
* Run *diffoscope* with a lower `ionice` priority. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/ac887a9bc)]
* Log every build in a simple text file [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/0927b70dd)] and create persistent stamp files when running diffoscope to ease debugging [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/7949a31c1)].
* Run schedulers one hour after `dinstall` again. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/eecd6c315)]
* Temporarily use *diffoscope* from the host, and not from a `schroot` running the tested suite. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/4f9ccd00c)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/58d9c5495)]
* Fail the *diffoscope* distribution test if the *diffoscope* version cannot be determined. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/51ef3b6f3)]
* Fix a spelling error in the 'email to IRC' gateway. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/4b1943955)]
* Force (and document) the reconfiguration of all jobs, due to the recent rise of zombies. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/49d4b10c6)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/a22047c3c)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/a9a5a798e)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/df4c18851)]
* Deal with a rare condition when killing processes which should not be there. [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/b63c2e408)]
* Install the Debian *backports* kernel in an attempt to address Debian bug [#1052257](https://bugs.debian.org/1052257). [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/c4773dc8b)][[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/288ef145b)]
In addition, Mattia Rizzolo fixed a call to `diffoscope --version` (as suggested by Fay Stegerman on our mailing list) [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/c4d19012e)], worked on an [openQA](https://open.qa/) credential issue [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/1c758e081)] and also made some changes to the machine-readable reproducible metadata, `reproducible-tracker.json` [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/fe2b114f3)]. Lastly, Roland Clobus added instructions for manual configuration of the [openQA](https://open.qa/) secrets [[...](https://salsa.debian.org/qa/jenkins.debian.net/commit/c7435f7d6)].
---
If you are interested in contributing to the Reproducible Builds project, please visit our [*Contribute*](https://reproducible-builds.org/contribute/) page on our website. However, you can get in touch with us via:
* IRC: `#reproducible-builds` on `irc.oftc.net`.
* Mailing list: [`rb-general@lists.reproducible-builds.org`](https://lists.reproducible-builds.org/listinfo/rb-general)
* Mastodon: [@reproducible_builds](https://fosstodon.org/@reproducible_builds)
* Twitter: [@ReproBuilds](https://twitter.com/ReproBuilds)