Mastouille

Esther Payne :bisexual_flag:So I had some more thoughts about FOSS sustainability. I've had them for some time. But this weeks issues reminded me of them.So here's a mild spruik for some of the orgs who make my digital spaces for myself and my project and also package <a href="https://chaos.social/@librecast" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@librecast</a> <a href="https://www.onepict.com/20250628-plussustain.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.onepict.com/20250628-plussustain.html</a><a href="https://chaos.social/tags/FossSustainability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FossSustainability</a> <a href="https://chaos.social/tags/Matrix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Matrix</a> <a href="https://chaos.social/tags/ReproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ReproducibleBuilds</a> <a href="https://chaos.social/tags/Outreachy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Outreachy</a>

IzzyOnDroid ✅<a href="https://floss.social/tags/AndroidAppRain" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AndroidAppRain</a> at <a href="https://apt.izzysoft.de/fdroid" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://apt.izzysoft.de/fdroid</a> today with 14 updated and 1 added apps:* Pomozen: a Pomodoro timer designed to boost productivity and focus 🛡️Enjoy your (1315) <a href="https://floss.social/tags/free" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#free</a> <a href="https://floss.social/tags/Android" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Android</a> <a href="https://floss.social/tags/apps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apps</a> with the <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IzzyOnDroid</a> repo – 627 of them (47.7%) are <a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reproducibleBuilds</a> :awesome:

IzzyOnDroid ✅Welcome to the RB family, Aegis 🥳<a href="https://apt.izzysoft.de/packages/com.beemdevelopment.aegis" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://apt.izzysoft.de/packages/com.beemdevelopment.aegis</a>Aegis Authenticator is a free, secure and open source app to manage your 2-step verification tokens for your online services.Thanks to the help of the Aegis team, the app is now finally RB – expect the green shield coming up in a few hours :awesome:<a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reproducibleBuilds</a> <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IzzyOnDroid</a>

IzzyOnDroid ✅Btw: kudos for this go to <a href="https://floss.social/@bg443" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@bg443</a> – who runs an independent builder (i.e. Ben is not a member of IzzyOnDroid himself, but his builder covers several of our apps. So it's verifying our builders are telling the truth, so to say).So while IoD takes the APKs directly from the devs, our builders verify they were indeed built from the source code the devs claim to – while independents like Ben verify we're not "cheating". The winners are YOU :awesome: <a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reproducibleBuilds</a> <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IzzyOnDroid</a>

IzzyOnDroid ✅Dear developers of <a href="https://floss.social/tags/Android" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Android</a> <a href="https://floss.social/tags/apps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apps</a> which are listed at <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IzzyOnDroid</a> and have been confirmed as <a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reproducibleBuilds</a> by one (or more) of our builders:I've been told by a dev:> There are only 3 things devs want. Stickers, badges and a good dev environment (and I'm not sure the last one is important)So there you go if you want to show the RB status of your app:<a href="https://shields.rbtlog.dev/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://shields.rbtlog.dev/</a>:awesome:

Simon TournierBlog post: What Guix could offer in computational medical environments?French national agency for secure drug and medicine (ANSM) requires for a medical device to have unambiguous identifications:1. reference of the product 2. reference of the maker 3. serial numberWell, through my lenses applied to software, it reads:1. <a href="https://social.sciences.re/tags/SoftwareHeritage" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SoftwareHeritage</a> identifier (<a href="https://social.sciences.re/tags/SWHID" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SWHID</a>) 2. <a href="https://social.sciences.re/tags/Guix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Guix</a>and 3. is redundant. 😁Well, a quick summary of a 30min talk I gave past week.Thanks my previous colleague Sam from APHP to give me the opportunity to brainstorm on this topic. 🤩<a href="https://simon.tournier.info/posts/2025-06-04-aphp-guix.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://simon.tournier.info/posts/2025-06-04-aphp-guix.html</a><a href="https://social.sciences.re/tags/ReproducibleResearch" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ReproducibleResearch</a> <a href="https://social.sciences.re/tags/OpenScience" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenScience</a> <a href="https://social.sciences.re/tags/Debian" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Debian</a> <a href="https://social.sciences.re/tags/ReproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ReproducibleBuilds</a>

Reproducible BuildsMay 2025 in Reproducible Builds: * Security audit of Reproducible Builds tools published * "When good pseudorandom numbers go bad" <a href="https://fosstodon.org/@jdnavarro" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@jdnavarro</a> * Academic articles * Distribution work * <a href="https://framapiaf.org/@debian" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@debian</a> * <a href="https://floss.social/@fdroidorg" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@fdroidorg</a> <a href="https://social.librem.one/@eighthave" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@eighthave</a> * <a href="https://chaos.social/@nixos_org" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@nixos_org</a> <a href="https://merveilles.town/@raboof" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@raboof</a> * <a href="https://fosstodon.org/@opensuse" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@opensuse</a> * <a href="https://fosstodon.org/@fedora" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@fedora</a> <a href="https://gts.dodgy.download/@jelly" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@jelly</a> * diffoscope and disorderfs * Website updates * Reproducibility testing framework * Upstream patches<a href="https://reproducible-builds.org/reports/2025-05/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://reproducible-builds.org/reports/2025-05/</a><a href="https://fosstodon.org/tags/ReproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ReproducibleBuilds</a>

Vagrant CascadianAlright, this year at <a href="https://floss.social/tags/FOSSY" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FOSSY</a> in Portland, I will both be hosting a booth for <a href="https://floss.social/tags/ReproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ReproducibleBuilds</a> and also presenting a talk..."Never Mind the Checkboxes, Here's Reproducible Builds"The Health policy is weaker than I would personally like with <a href="https://floss.social/tags/Masking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Masking</a> but at least last year there was significant voluntary compliance.<a href="https://floss.social/tags/PDX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PDX</a>

IzzyOnDroid ✅<a href="https://floss.social/tags/AndroidAppRain" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AndroidAppRain</a> at <a href="https://apt.izzysoft.de/fdroid" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://apt.izzysoft.de/fdroid</a> today brings you 13 updated and 1 added apps:* App2Proxy: redirect the traffic of selected apps through a local proxy using iptables (root needed) 🛡️And with that, we reached a new milestone: 600 of the apps at <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IzzyOnDroid</a> are <a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reproducibleBuilds</a> now 🥳Enjoy your <a href="https://floss.social/tags/free" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#free</a> <a href="https://floss.social/tags/Android" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Android</a> <a href="https://floss.social/tags/apps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apps</a> with the <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IzzyOnDroid</a> repo :awesome:

IzzyOnDroid ✅<a href="https://social.tchncs.de/@Billie" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Billie</a> oof, misconfiguration at our end 🙈 Sincere apologies! Corrected now, 0.62.9 will show up with the next sync (and future releases in time again).Oh, and btw: at <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IzzyOnDroid</a> of course as <a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reproducibleBuilds</a> :awesome:

IzzyOnDroid ✅<a href="https://floss.social/tags/AndroidAppRain" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AndroidAppRain</a> today brings 16 updated and removes 1 app: Infinity for Reddit was removed as it was not fully FOSS (no offense to the dev, but that branch the APK was built from is not public).How did we figure? Well, ALL attempts to achieve <a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reproducibleBuilds</a> failed, as the commit the APK was built from could not be found. That's what we mean when we say RB proves it's build from that exact code, with NOTHING ADDED or taken away.So: enjoy your 46.1% RB apps with the <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IzzyOnDroid</a> repo!

IzzyOnDroid ✅Welcome to the RB family, QRServ 🥳<a href="https://apt.izzysoft.de/packages/dev.uint.qrserv" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://apt.izzysoft.de/packages/dev.uint.qrserv</a>QRServ takes any selected file on your device and makes it available through its own HTTP server at an unused port number. The selected file can then be downloaded via web browser on another device or software that allows file downloads over HTTP from QR codes.This was made possible thanks to the efforts by its author – and thanks to his SteamDeck running our RB framework :awesome:<a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reproducibleBuilds</a> <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IzzyOnDroid</a> <a href="https://floss.social/tags/SteamDeck" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SteamDeck</a>

IzzyOnDroid ✅IzzyOnDroid got mentioned in the reproducible-builds.org blog for the April report with a huge block of multiple paragraphs 🥳<a href="https://reproducible-builds.org/reports/2025-04/#distribution-roundup" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://reproducible-builds.org/reports/2025-04/#distribution-roundup</a>Yes, our RB-framework is available for everyone to use. And today, we even got the first report of an installation running on a Steam Deck :awesome:<a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IzzyOnDroid</a> <a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reproducibleBuilds</a>

IzzyOnDroid ✅We have no new apps to report today (well, 10 updated apps is also good, right?) – but reached round numbers with our RBs once more:590 apps (45%) of the <a href="https://floss.social/tags/android" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#android</a> <a href="https://floss.social/tags/apps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#apps</a> at the <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IzzyOnDroid</a> repo are now <a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reproducibleBuilds</a> :awesome:

Vagrant CascadianSo sad to hear <a href="https://floss.social/tags/OSUOSL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OSUOSL</a> is in a bit of a pinch...They support so many free software projects that I work on, including <a href="https://floss.social/tags/Debian" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Debian</a> and <a href="https://floss.social/tags/ReproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ReproducibleBuilds</a> and probably several more I did not even realize!Please support those that support so many others if you can and spread the word!<a href="https://osuosl.org/blog/osl-future/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://osuosl.org/blog/osl-future/</a>

Stefano ZacchiroliCongrats to <a href="https://chaos.social/@luj" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@luj</a> and <a href="https://fediscience.org/@Zimm_i48" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Zimm_i48</a>, for the ACM SIGSOFT Distinguished Paper <a href="https://mastodon.xyz/tags/award" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#award</a> at <a href="https://mastodon.xyz/tags/MSR2025" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MSR2025</a>, for our joint paper «Does Functional Package Management Enable <a href="https://mastodon.xyz/tags/ReproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ReproducibleBuilds</a> at Scale? Yes.»Details, including link to an <a href="https://mastodon.xyz/tags/openaccess" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openaccess</a> preprint, at: <a href="https://2025.msrconf.org/details/msr-2025-technical-papers/32/Does-Functional-Package-Management-Enable-Reproducible-Builds-at-Scale-Yes-" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://2025.msrconf.org/details/msr-2025-technical-papers/32/Does-Functional-Package-Management-Enable-Reproducible-Builds-at-Scale-Yes-</a>The paper is going to be presented this afternoon at the conf here in Ottawa.<a href="https://mastodon.xyz/tags/Nix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Nix</a> cc: <a href="https://fosstodon.org/@reproducible_builds" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@reproducible_builds</a>

IzzyOnDroid ✅Welcome to the RB family, LinkGuardian 🥳<a href="https://apt.izzysoft.de/packages/dev.elbullazul.linkguardian" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://apt.izzysoft.de/packages/dev.elbullazul.linkguardian</a>LinkGuardian is an Android client for Linkwarden, helping you to manage your link collection. Thanks to joint efforts with its developer, <a href="https://pub.elbullazul.com/@elbullazul" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@elbullazul</a>, the app is now RB :awesome: <a href="https://floss.social/tags/reproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reproducibleBuilds</a> <a href="https://floss.social/tags/IzzyOnDroid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IzzyOnDroid</a>

Ludovic CourtèsMeanwhile, Gilmore makes an analogy between “reproducible builds” and “pure functions”: <a href="https://lists.reproducible-builds.org/pipermail/rb-general/2025-April/003736.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://lists.reproducible-builds.org/pipermail/rb-general/2025-April/003736.html</a>It sure feels like a déjà vu to the Nix and Guix folks but it’s good to see it brought up from a different perspective.<a href="https://toot.aquilenet.fr/tags/ReproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ReproducibleBuilds</a>

Guardian Project<a href="https://mastodon.world/@signalapp" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@signalapp</a> As a supporter of <a href="https://social.librem.one/tags/Signal" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Signal</a>, it is important to point out a key detail: Signal's own code is <a href="https://social.librem.one/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a>, but Signal uses multiple <a href="https://social.librem.one/tags/proprietary" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#proprietary</a> libraries from <a href="https://social.librem.one/tags/Google" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Google</a>. Those cannot be scrutinized since the source code is not open. We believe Signal should offer an actual open source version, and are ready to help. This exists already in the fork <a href="https://fosstodon.org/@MollyIM" rel="nofollow noopener noreferrer" target="_blank">https://fosstodon.org/@MollyIM</a> Also, apps like <a href="https://social.librem.one/tags/Element" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Element</a> <a href="https://social.librem.one/tags/Threema" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Threema</a> <a href="https://social.librem.one/tags/Wire" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Wire</a> are <a href="https://social.librem.one/tags/FOSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FOSS</a>, and have <a href="https://social.librem.one/tags/ReproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ReproducibleBuilds</a> on <a href="https://floss.social/@fdroidorg" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@fdroidorg</a> <a href="https://social.librem.one/tags/FDroid" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FDroid</a>

Vagrant CascadianImpatient to get a <a href="https://floss.social/tags/Backport" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Backport</a> of <a href="https://floss.social/tags/Dino" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Dino</a> 0.5 for <a href="https://floss.social/tags/Debian" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Debian</a> <a href="https://floss.social/tags/Bookworm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Bookworm</a> ... but the build logs were already published, including the hashes of all the binaries, I went ahead and performed a <a href="https://floss.social/tags/ReproducibleBuilds" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ReproducibleBuilds</a> check of locally built packages for amd64, arm64 and the "all" architecture... and came up with bit-for-bit identical results!<a href="https://people.debian.org/~vagrant/dino-im-reproduced/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://people.debian.org/~vagrant/dino-im-reproduced/</a>By the time you read this, identical binaries may already land on the Debian archive. I have a newer dino installed now! Try for yourself!

Recherches récentes

Options de recherche

Administré par :

Statistiques du serveur :

#reproduciblebuilds