#reproducible — Public Fediverse posts

Dear opensource developers,

I added an "adoption" list to the repro-env README, if you publish pre-compiled binaries and you successfully adopted it to allow anyone to reproduce them from source code to prove the absense of a build server compromise, you are very welcome to add yourself to the list. 😺

https://github.com/kpcyrd/repro-env#adoption

#reproducible #reproduciblebuilds #supplychainsecurity #rust

https://blog.gslin.org/archives/2026/05/11/13035/debian-%e4%b8%8b%e4%b8%80%e7%89%88-forky-%e5%b0%87%e6%9c%83%e5%bc%b7%e5%88%b6%e8%a6%81%e6%b1%82-reproducible-packaging/

Debian 下一版 (forky) 將會強制要求 reproducible packaging

#build #chain #debian #integrity #linux #package #packaging #reproducible #security #software #trust

Debian 14 will only contain reproducible packages

Reproducible builds are a set of rules that apply to software development, including applications and libraries, to create a verifiable path from the source code to the binary code. It allows you to build the library or the application bit-for-bit. Reproducible builds tend to have great features, including, but not limited to:

• Security and trust: Allows third-parties to make sure that the software hasn’t been altered or tampered with.
• Transparency in development: Makes sure that developers’ code always works the same way.
• Resilience against attacks: Allows third-parties to verify the developers’ software to prevent your projects from being compromised.

Half way through the development cycle of the upcoming Debian release expected in 2027, Debian 14 Forky, the Debian release team has made a decision regarding the reproducible builds effort. Over the years with the Reproducible Builds effort that makes sure that packages get built consistently bit-for-bit, the Debian release team has decided that reproducible builds must be satisfied for the Debian packages to be approved.

A new mandate for Debian 14 Forky states that the reproducible packages, which are packages that build consistently and with confidence bit-for-bit, must be shipped. The migration software will reject the package addition or update if said package no longer becomes reproducible.

The Debian release team has also provided a link that allows you to check the package reproducibility status for the upcoming version of Debian via https://reproduce.debian.net/.

Via: Phoronix

Debian 14 will only contain reproducible packages

Reproducible builds are a set of rules that apply to software development, including applications and libraries, to create a verifiable path from the source code to the binary code. It allows you to build the library or the application bit-for-bit. Reproducible builds tend to have great features, including, but not limited to:

• Security and trust: Allows third-parties to make sure that the software hasn’t been altered or tampered with.
• Transparency in development: Makes sure that developers’ code always works the same way.
• Resilience against attacks: Allows third-parties to verify the developers’ software to prevent your projects from being compromised.

Half way through the development cycle of the upcoming Debian release expected in 2027, Debian 14 Forky, the Debian release team has made a decision regarding the reproducible builds effort. Over the years with the Reproducible Builds effort that makes sure that packages get built consistently bit-for-bit, the Debian release team has decided that reproducible builds must be satisfied for the Debian packages to be approved.

A new mandate for Debian 14 Forky states that the reproducible packages, which are packages that build consistently and with confidence bit-for-bit, must be shipped. The migration software will reject the package addition or update if said package no longer becomes reproducible.

The Debian release team has also provided a link that allows you to check the package reproducibility status for the upcoming version of Debian via https://reproduce.debian.net/.

Via: Phoronix

Debian 14 will only contain reproducible packages

Reproducible builds are a set of rules that apply to software development, including applications and libraries, to create a verifiable path from the source code to the binary code. It allows you to build the library or the application bit-for-bit. Reproducible builds tend to have great features, including, but not limited to:

• Security and trust: Allows third-parties to make sure that the software hasn’t been altered or tampered with.
• Transparency in development: Makes sure that developers’ code always works the same way.
• Resilience against attacks: Allows third-parties to verify the developers’ software to prevent your projects from being compromised.

Half way through the development cycle of the upcoming Debian release expected in 2027, Debian 14 Forky, the Debian release team has made a decision regarding the reproducible builds effort. Over the years with the Reproducible Builds effort that makes sure that packages get built consistently bit-for-bit, the Debian release team has decided that reproducible builds must be satisfied for the Debian packages to be approved.

A new mandate for Debian 14 Forky states that the reproducible packages, which are packages that build consistently and with confidence bit-for-bit, must be shipped. The migration software will reject the package addition or update if said package no longer becomes reproducible.

The Debian release team has also provided a link that allows you to check the package reproducibility status for the upcoming version of Debian via https://reproduce.debian.net/.

Via: Phoronix

Debian 14 will only contain reproducible packages

Reproducible builds are a set of rules that apply to software development, including applications and libraries, to create a verifiable path from the source code to the binary code. It allows you to build the library or the application bit-for-bit. Reproducible builds tend to have great features, including, but not limited to:

• Security and trust: Allows third-parties to make sure that the software hasn’t been altered or tampered with.
• Transparency in development: Makes sure that developers’ code always works the same way.
• Resilience against attacks: Allows third-parties to verify the developers’ software to prevent your projects from being compromised.

Half way through the development cycle of the upcoming Debian release expected in 2027, Debian 14 Forky, the Debian release team has made a decision regarding the reproducible builds effort. Over the years with the Reproducible Builds effort that makes sure that packages get built consistently bit-for-bit, the Debian release team has decided that reproducible builds must be satisfied for the Debian packages to be approved.

A new mandate for Debian 14 Forky states that the reproducible packages, which are packages that build consistently and with confidence bit-for-bit, must be shipped. The migration software will reject the package addition or update if said package no longer becomes reproducible.

The Debian release team has also provided a link that allows you to check the package reproducibility status for the upcoming version of Debian via https://reproduce.debian.net/.

Via: Phoronix

Debian 14 will only contain reproducible packages

Reproducible builds are a set of rules that apply to software development, including applications and libraries, to create a verifiable path from the source code to the binary code. It allows you to build the library or the application bit-for-bit. Reproducible builds tend to have great features, including, but not limited to:

• Security and trust: Allows third-parties to make sure that the software hasn’t been altered or tampered with.
• Transparency in development: Makes sure that developers’ code always works the same way.
• Resilience against attacks: Allows third-parties to verify the developers’ software to prevent your projects from being compromised.

Half way through the development cycle of the upcoming Debian release expected in 2027, Debian 14 Forky, the Debian release team has made a decision regarding the reproducible builds effort. Over the years with the Reproducible Builds effort that makes sure that packages get built consistently bit-for-bit, the Debian release team has decided that reproducible builds must be satisfied for the Debian packages to be approved.

A new mandate for Debian 14 Forky states that the reproducible packages, which are packages that build consistently and with confidence bit-for-bit, must be shipped. The migration software will reject the package addition or update if said package no longer becomes reproducible.

The Debian release team has also provided a link that allows you to check the package reproducibility status for the upcoming version of Debian via https://reproduce.debian.net/.

Via: Phoronix

💁‍♂️ Want to know how to make computational research more reusable❓
👍 Join our short course on Supporting the understanding and reuse of #reproducible analysis workflows.

📅 Friday, May 8
🕓 8:30-10:15

Check out the #NFDI4Earth poster:
From Data Rocks to #FAIR Peaks: With NFDI4Earth’s services towards Harmonized Metadata and User-Centered Tools for Earth System Research.

📅 Friday, May 8
🕓 16:15–18:00

👉 https://52north.org/events/egu-general-assemly-2026/

#reproducibleresearch #datadiscovery #EGU26 #AquaINFRA

[arch-dev-public] Arch Linux now has a bit-for-bit reproducible Docker image

https://lists.archlinux.org/archives/list/[email protected]/thread/44PW52T547MACXFU5HZ5U7SIPAX3BAXS/

#Linux #ArchLinux #ReproducibleBuilds #Reproducible

@nickbearded i think older cheap pc platform is probably better value once prices crash and they will eventually selling the sw but also the hw you know it runs really well on is a key uniter point and then you have the total package, repeat for pihole, open source pineapple, kismet, ssl/tls proxy, squid caching proxy, web server and lamp stack, etc dedicated monitoring and analytics is another, central logging is another #bashcore modules #extensions #plugins #sbom #reproducible builds #ansible playbooks

@besendorf
> #FDroid is an App Store that does not allow developers to sign their own apps

Why lie though? Developers can always sign their own #FLOSS verified #reproducible built apps, we host almost 1000 of those.

Many developers choose not to submit to #Google, hence no matter if they sign or not, it does not matter if you download via Github, Obtainium or Accrescent, their apps won't be installable anyway.

If the #keepandroidopen site does not make this clear, please say so.

Testing Fountain Pen Inks

Question: has anyone done extensive testing on any fountain pen inks?

I don’t mean the standard Mountain of Ink style, sample card, writing sample, etc. visual comparisons. (I’d like to call this subjective measurement, but chromatographic measurements aren’t subjective if done in a controlled manner.)

I am thinking more objective testing: viscosity, density, flow rate @ a given line width, etc.

I was thinking about this type of testing tonight, and it seems to me that there are a lot of factors that would need to be controlled: temperature, air pressure / barometric pressure, nib consistency, friction (aka heat), etc. Given what I was thinking this could be an interesting experiment, if someone wanted to undertake controlling all the variables, and implementing the controls necessary for consistent results.

Testing Fountain Pen Inks

Question: has anyone done extensive testing on any fountain pen inks?

I don’t mean the standard Mountain of Ink style, sample card, writing sample, etc. visual comparisons. (I’d like to call this subjective measurement, but chromatographic measurements aren’t subjective if done in a controlled manner.)

I am thinking more objective testing: viscosity, density, flow rate @ a given line width, etc.

I was thinking about this type of testing tonight, and it seems to me that there are a lot of factors that would need to be controlled: temperature, air pressure / barometric pressure, nib consistency, friction (aka heat), etc. Given what I was thinking this could be an interesting experiment, if someone wanted to undertake controlling all the variables, and implementing the controls necessary for consistent results.

Testing Fountain Pen Inks

https://feddit.online/c/fountainpens/p/1528757/testing-fountain-pen-inks

Testing Fountain Pen Inks

https://feddit.online/c/fountainpens/p/1528757/testing-fountain-pen-inks

Testing Fountain Pen Inks

https://feddit.online/c/fountainpens/p/1528757/testing-fountain-pen-inks

From #ContainerDays London to Barcelona: big thanks to the #DevOps BCN #Meetup for having me!

I revisited my talk on moving beyond imperative #Docker builds toward #Declarative, #Reproducible and #Secure #OCI #Containers with #Nix:
Hermetic, network-isolated builds, clearer dependency graphs, better layer reuse across images, and a stronger supply-chain story (#SBOM + #SLSA provenance).

You can find the slides, transcript and more information at my website: https://www.arik-grahl.de/talks/devops-bcn-february-2026

What a great first day at #ContainerDays London.

Looking forward to see you tomorrow at 09:40 at my talk "Beyond #Docker Builds: #Declarative, #Reproducible and #Secure #OCI #Containers with #Nix".

https://www.arik-grahl.de/talks/container-days-london-2026/

#CDSLondon

After dithered images my next obsession is 'workflow managers' 🎈Yesterday night I binged some videos from #riffomonas about #reproducible research (CC248 to CC256). He used #snakemake , which looked very nice! Now I also looked up #nextflow It looks fierce!
I am going to learn one of them, and snakemake currently feels more approachable... But what do you think? Any advice? I want to use it in my #bioinformatics #pipeline s; I mainly write in R
#rstats #tidyverse
https://riffomonas.org

The recording of my #fosdem talk is now available!

https://fosdem.org/2026/schedule/event/RAUUL9-reproducible-xfs-images/

#linux #filesystem #xfs #reproducible #builds

Well after quite some months a new release has landed on main branch with git commit: https://codeberg.org/stagex/stagex/commit/f33076ccbcf484eee52cc6994a96dfa89a607b8c
With this release #StageX brings more freedom to everybody by using `natively` #llvm to build the complete tree (full source #bootstrapped and #reproducible as always), initializing the era of cross-compiling "easily" for any other CPU architecture.If that doesn't excites you, then get prepared for other even better things coming into the next release!
See you at #FOSSDEM26 for stickers!

@momo hi!

Yes you can see what's available as a package locally using the 'guix search' command or the package browser:

https://packages.guix.gnu.org/search/?query=clang

In Guix 'substitutes' is the term we use for #nix precompiled binaries. Most people use them. You can check if a substitute is available like this:

guix weather --substitute-urls=https://ci.guix.gnu.org --system=x86_64-linux [email protected]

The installer asks the user if they want to enable substitutes so it's easy to set-up.

The manual has more
details on ways to enable other channels and substitute servers. It also covers how to check a build against multiple substitute servers for #reproducible software and potentially a #security #supplychain indication.

Interested in #declarative computing, #linux or #reproducible software? #Guix is going to be at #FOSDEM for lots of goodness on #guile #scheme and the #nix approach to packaging #FreeSoftware - check out the talks various people are giving:

https://guix.gnu.org/blog/2026/meet-guix-at-fosdem-2026/

As usual the Declarative and Minimalist computing track will have lots of interesting #lisp #spritely and #nrepl talks!

In case you haven't heard it already: we at @fsi have started packaging software, to make awesome #FLOSS available to you #electronics and #chip #designers
Highlight so far include klayout and magic, which are now easily available to you #Guix users through simple invokations, like:

guix shell klayout -- klayout

or

guix shell magic -- magic

#GNU Guix not only allows for most up-to-date packages, #reproducible development and build environments and an absolute dedication to #freesoftware, it also eases contribution, extension and enhancement of already available solutions.

Check it out! Don't hesitate to reach out if you have questions!

https://f-si.org
https://guix.gnu.org

#silicon #freesilicon #FOSS #chipdesign #EDA #electronicdesignautomation

We built a containerised workflow that handles QC, doublet detection, CITE‑seq for scRNA‑seq data, and outputs a ready‑to‑use #Seurat object. One command, #reproducible results—ideal for labs without dedicated bioinformatics support.

#Workshop Announcement:
#Galaxy is an online platform for #reproducible #workflows. Learn how to create your own workflow and see if this is a tool that you can use for your own work.

This workshop is an entrance level, hands-on workshop. Bring your own laptop if you would like to type and click along or follow the demo on the screen.
The workshop is organize by Kees den Heijer and Mirela Minkova from SURF.

Photo by NASA on Unsplash

@fasterthanlime
There is a #bounty of $1000 to solve for #reproducible #rust to build x86_64-linux-gnu libstd for rust 1.91 with #stagex and be able to compile a dynamically linked rust binary with it that runs on #Debian.
Would you be interested to take the challenge?

#containers #linux

I take that back, a (ideally #bootstrappable) #reproducible declaratively defined OS distribution like #guix is the best means to maintain a global perspective of your OS. But unless you are a minimal uptime warrior that keeps everything in a /tmp-like directory that is flushed on shutdown, you still need email to keep track with whats going on! (and you can't convince me that setting up prometheus compares to working directly with the plumbing! at least for monolithic desktop user systems)

@codemonkeymike
Awesome 🔥❤️
Also instead of downloading an ISO like that, any way to build the exact ISO locally?😁
So that u can just push the flake and I'll fetch the latest one with caching.

Not sure if even the official nixos is doing this.
#nixbook #nix #os #iso #image #installation #reproducible #builds

Some notes about the whole #reproducible #computing environments idea and #guix implementation.

https://lovergine.com/about-computing-environments-for-reproducible-science.html

👀 Are you interested in #DataScience? #Open and #Reproducible research? #ResearchCommunities?

🤲 Have you contributed before to The Turing Way? If not, are you curious about it?

A minimal, declarative setup for productive Rust 🦀 hacking on Emacs + Guix

https://jointhefreeworld.org/blog/articles/rust/simple-guix-emacs-rust-development-environment/index.html

I noticed there was a blatant lack of resources and documentation on this particular setup.

With a tiny manifest and a small Emacs configuration, you get a powerful, reproducible, elegant Rust development environment.

#rust #guix #emacs #dev #manifest #shell #development #environment #ide #clippy #lsp #gnu #reproducible #direnv #eglot

Thanks to the @fsf for promoting GNU Guix's fundraising.

Like many other Free Software project's we depend on our users and fans support to pay for the project's expenses.

We're running a campaign to 'sustain and strengthen' Guix. As a #linux distribution we have a lot of #packages which costs quite a bit to build and distribute to users. And, as we use the declarative and reproducible system pioneered by #Nix we rebuild packages whenever there's a change.

If you'd like to know more about what we're doing, or support the project you can check out the blog post:

https://guix.gnu.org/en/blog/2025/fundraising-campaign-to-sustain-gnu-guix/

We appreciate any support that people can give!

#linux #guix #gnuguix #scheme #guile #freesoftware #declarative #reproducible

@zed @paulasadoorian paul may run arch btw, salt is really rough on lawns - try to use calcium chloride #salt vs salt instead? #reproducible builds #emba

This week in #FDroid (TWIF) is live:

* #Nextcloud store shenanigans
* #Cheogram in Space-s
* #DeltaChat and #ArcaneChat fork
* #FluffyChat feature full
* #Tachiyomi successor #Kahon
* #Inure #reproducible
* #PasswordStore fork
* #ReplicantOS and #NGI
* #NewPipe out of the 360p jail
+ 12 new apps
+ 195 updates

Go beyond clouds in https://f-droid.org/2025/05/15/twif.html

This week in #FDroid (TWIF) is live:

* #Nextcloud store shenanigans
* #Cheogram in Space-s
* #DeltaChat and #ArcaneChat fork
* #FluffyChat feature full
* #Tachiyomi successor #Kahon
* #Inure #reproducible
* #PasswordStore fork
* #ReplicantOS and #NGI
* #NewPipe out of the 360p jail
+ 12 new apps
+ 195 updates

Go beyond clouds in https://f-droid.org/2025/05/15/twif.html

This week in #FDroid (TWIF) is live:

* #Nextcloud store shenanigans
* #Cheogram in Space-s
* #DeltaChat and #ArcaneChat fork
* #FluffyChat feature full
* #Tachiyomi successor #Kahon
* #Inure #reproducible
* #PasswordStore fork
* #ReplicantOS and #NGI
* #NewPipe out of the 360p jail
+ 12 new apps
+ 195 updates

Go beyond clouds in https://f-droid.org/2025/05/15/twif.html

This week in #FDroid (TWIF) is live:

* #Nextcloud store shenanigans
* #Cheogram in Space-s
* #DeltaChat and #ArcaneChat fork
* #FluffyChat feature full
* #Tachiyomi successor #Kahon
* #Inure #reproducible
* #PasswordStore fork
* #ReplicantOS and #NGI
* #NewPipe out of the 360p jail
+ 12 new apps
+ 195 updates

Go beyond clouds in https://f-droid.org/2025/05/15/twif.html

This week in #FDroid (TWIF) is live:

* #Nextcloud store shenanigans
* #Cheogram in Space-s
* #DeltaChat and #ArcaneChat fork
* #FluffyChat feature full
* #Tachiyomi successor #Kahon
* #Inure #reproducible
* #PasswordStore fork
* #ReplicantOS and #NGI
* #NewPipe out of the 360p jail
+ 12 new apps
+ 195 updates

Go beyond clouds in https://f-droid.org/2025/05/15/twif.html

The Affordable DIY Mandeye Lidar System For Surveying Caves, And How To Convert 3D Clouds Into Traditional Cave Ground Plans And Extended Profiles
--
https://doi.org/10.5038/1827-806X.53.3.2535 <-- shared paper
--
#GIS #spatial #mapping #LiDAR #cave #cavediving #cavemapping #speleology #workflow #survey #remotesensing #pointcloud #mobilemapping #3Dmapping #profile #model #modeling #3dmodel #opensource #openhardware #reproducible #affordable #DIY #Mandeye

Debian 的 Live Image 可以重現構建了 (reproducible build)

在 Hacker News 上看到「Debian bookworm live images now reproducible (lwn.net)」，在 Debian 上的 Live Image 可以重現了構建了：「Debian bookworm live images now fully reproducible」。 Reproducible builds 可以證明 build 出來的東西沒有被「私下」加料，因為其他人也可以拿一樣的 source 編出同樣的 binary。 因為這是 OS 層的東西，算是 chain of trust 非常前端的一環，對於很在意安全性的人來說，這點讓 Debian 變成了可被稽核驗證的項目，而非單純相信原廠…

https://blog.gslin.org/archives/2025/03/27/12322/debian-%e7%9a%84-live-image-%e5%8f%af%e4%bb%a5%e9%87%8d%e7%8f%be%e6%a7%8b%e5%bb%ba%e4%ba%86-reproducible-build/

#builds #chain #debian #image #linux #live #reproducible #trust

NixOS and reproducible builds could have detected the xz backdoor

https://luj.fr/blog/how-nixos-could-have-detected-xz.html

#HackerNews #NixOS #reproducible #builds #xz #backdoor #security #technews

@axel all i am saying is don't underestimate the mkt, also don't overestimate it. what other tools do you think clients would benefit from? I'd say faster networking, nvme, more ram, pihole and various lamp scripts modded and tweaked, toplists, osint, analytic suite, seo, 24/7pkt cap. also would add r proxy from a vps - no quotas #wildcards #iaas #howtoforge #reproducible builds #tls proxy

Looking forward to upcoming #sdsl2024 session by @loreabad6. Excellent #reproducible slides: https://github.com/loreabad6/post #SDSL #geocompx.

Coinciding with the Spatial Data Sciences across Languages (#sdsl) workshop, I've released a new #opensource template for creating, auto-deploying and sharing #reproducible slides. Works with #RStats, #Python and more thanks to Quarto! See https://buff.ly/3zqQj8D and #sdsl talk incoming 🚀

Wanted to share that [Stageˣ] is now full source bootstrapped, 100% reproducible, signed by 2-3 independent reviewers/reproducers on every release, and can build itself.

It can be the base of reproducible build containers for most projects written in c, c++, nodejs, go, php, ocaml, rust, or zig.

I am thankful for the efforts of our team, and the patient advice and tireless debugging of people in the #reproducible-builds and #bootstrappable projects <3

https://codeberg.org/stagex/stagex

Are your #software environments truly #reproducible? Can the data obtained using complex software pipelines really pass the proof of time? Is your #research transparent and its results reproducible? Have a look at this nice article: https://www.nature.com/articles/s41597-022-01720-9 . The approach outlined in the article goes beyond research. I use #GNU #Guix in my daily work to test software. Try to replicate my bit-to-bit reproducible @irods test environment at https://github.com/ll4strw/irods_guix
#FreeSoftware #GNUGuix #iRODS

Four #principles for improved #statistical #ecology

#OpenAccess
@MethodsEcolEvol

"(1) define a focussed #ResearchQuestion, then plan #sampling and #analysis to answer it; (2) develop a #model that accounts for the #distribution and #dependence of your #data; (3) emphasise #EffectSizes to replace #StatisticalSignificance with #EcologicalRelevance; and (4) report your #methods and #findings in sufficient detail so that your research is valid and #reproducible"

https://besjournals.onlinelibrary.wiley.com/doi/full/10.1111/2041-210X.14270

The programme of today's event organised by the scientific network on #Open and #Reproducible #DataScience and #Statistics #ORDSMV is already going on strong!

In half an hour I'll talk about my five selfish reasons to join #OpenScience initatives!

You can find my slides here:
https://doi.org/10.5281/zenodo.10114221